Does my Indian business need to comply with GDPR?

If your Indian business serves customers in the European Union — through a website, app, or service — you may be subject to GDPR regardless of where your business is incorporated. GDPR applies based on where your customers are located, not where you are. Indian SaaS companies, exporters with EU customers, and service businesses with European clients should assess their GDPR exposure.

Comparison Guide

DPDP Act vs GDPR India

India's DPDP Act 2023 vs Europe's GDPR — which laws apply to your Indian business and what do you need to do differently?

Get Expert Guidance

Not sure which option suits your business? Talk to an IBEAN specialist — we'll help you identify the right advisory approach.

WhatsApp Us

Direct line to our advisory team

Fixed-fee diagnostic first. No commitment required.

The short answer

DPDP applies to your Indian business if you process digital personal data of Indian citizens. GDPR applies if you serve EU customers — regardless of where your business is incorporated. Most Indian businesses need DPDP compliance; Indian businesses with EU customers or investors need both.

Side-by-side comparison

Dimension	DPDP Act 2023 (India)	GDPR (European Union)
Jurisdiction	India — Digital Personal Data Protection Act 2023	European Union — General Data Protection Regulation 2018
Scope	Digital personal data of Indian citizens; businesses processing such data	Personal data of EU residents; applies to any business serving EU customers
Penalty	Up to ₹250 crore per breach (notification failure, data security lapses)	Up to €20 million or 4% of global annual turnover (whichever is higher)
Consent requirement	Explicit consent; specific purpose; data principal rights	Six legal bases for processing; explicit consent for sensitive data
Data principal rights	Access, correction, erasure, grievance redressal	Broader: access, rectification, erasure, portability, objection, automated decision
Cross-border transfer	To whitelisted countries (list to be notified by government)	Adequacy decision, SCCs, BCRs required
DPO requirement	Significant Data Fiduciaries (to be notified) — Data Protection Officer mandatory	Public authorities and certain processors — DPO mandatory
Data breach notification	72 hours to Data Protection Board (proposed; rules pending)	72 hours to supervisory authority; without undue delay to data subjects

Frequently asked questions

Frequently Asked Questions

Frequently asked questions

5 Questions

The DPDP Act applies to any business that processes digital personal data of Indian citizens — either within India or outside India. This covers virtually all Indian businesses that collect customer data (name, phone, email, address, financial information) digitally. The specific compliance obligations (data localisation requirements, Significant Data Fiduciary status) are still being notified through Rules.

The DPDP Act 2023 provides for penalties up to: ₹250 crore for failure to notify data breach; ₹200 crore for failure to implement security safeguards; ₹200 crore for processing children's data in violation of the Act; ₹150 crore for failure to comply with data principal rights obligations. These are significant penalties for Indian businesses of any size — DPDP compliance is not optional.

IBEAN's Fractional CISO service covers DPDP Act compliance: data inventory and classification, consent mechanism design, data principal rights fulfilment process, data breach response plan (72-hour notification capability), vendor data processing agreement review, and readiness for Significant Data Fiduciary obligations. We also advise on CERT-In compliance which overlaps with DPDP data security requirements.

DPDP has a narrower scope of data principal rights than GDPR (no right to portability or to object to automated decisions under DPDP currently). DPDP focuses specifically on digital personal data; GDPR covers both digital and non-digital personal data. The consent and notice requirements are broadly similar. For Indian businesses already GDPR-compliant, DPDP compliance is typically achievable with moderate additional effort.

help_outline

Additional questions? Contact the advisory team

Is your Indian business DPDP compliant?

IBEAN's Fractional CISO service covers DPDP Act compliance — data inventory, consent mechanisms, breach response, and readiness for Significant Data Fiduciary obligations.

DPDP compliance guide