#DPDP v/s #GDPR – 10 Key Highlights

The Digital Personal Data Protection Act (DPDP) of India and the General Data Protection Regulation (GDPR) of the European Union are both data protection regulations, but there are key differences:

1. Territorial Scope

DPDP Act: Applies to organizations processing personal data of individuals in India.
GDPR: Applies to organizations processing personal data of EU residents, regardless of the organization’s location.

2. Definition of Personal Data

DPDP Act: Defines personal data as any data that can be used to identify a person, including sensitive personal data.
GDPR: Defines personal data as any information relating to an identified or identifiable natural person.

3. #Consent Requirements

DPDP Act: Requires explicit consent for processing sensitive personal data.
GDPR: Requires explicit consent for processing personal data, with specific requirements for informed and unambiguous consent.

4. Data Protection Officer (#DPO)

DPDP Act: Does not mandate the appointment of a DPO.
GDPR: Requires the appointment of a DPO for certain organizations, such as those processing sensitive data on a large scale.

5. #DataBreachNotification

DPDP Act: Requires notification of data breaches to the authority, but does not specify a timeline.
GDPR: Requires notification of data breaches to the supervisory authority within 72 hours.

6. Cross-Border Data Transfers

DPDP Act: Allows cross-border data transfers with explicit consent or under a contract.
GDPR: Allows cross-border data transfers under specific conditions, such as standard contractual clauses or binding corporate rules.

7. #DataSubjectRights

DPDP Act: Provides data subjects with rights, including the right to access, correct, and erase personal data.
GDPR: Provides data subjects with similar rights, including the right to access, rectify, erase, restrict processing, object to processing, and data portability.

8. #Enforcement and #Penalties

DPDP Act: Empowers the authority to impose penalties, including fines.
GDPR: Empowers supervisory authorities to impose fines of up to €20 million or 4% of the organization’s global annual turnover.

9. #DataLocalization

DPDP Act: Requires sensitive personal data to be stored in India.
GDPR: Does not have specific data localization requirements.

10. Extraterritorial Jurisdiction

DPDP Act: Does not explicitly provide for extraterritorial jurisdiction.
GDPR: Provides for extraterritorial jurisdiction, allowing the EU to regulate organizations outside the EU that process personal data of EU residents.

These differences reflect the unique approaches of India and the EU to data protection, with varying emphasis on issues like consent, data localization, and extraterritorial jurisdiction.

#DhananjayRokde