Privacy Professionals Need To Unlearn Their GDPR Biases Before Interpreting The Provisions Of The DPDP Act.

Prepared by Shubhank Suman, AI, Privacy, and IP Counsel

Most privacy professionals in India learned data protection law through the GDPR. We studied the recitals, prepared for the CIPP/E, and became used to thinking in terms of Article 6 lawful bases, Article 35 impact assessments, and the broader architecture of European privacy law.

The problem is that this training can make us see things in the DPDP Act that are not actually there. The DPDP Act was not written as an Indian GDPR. Although some of its language may sound familiar, its structure and protections are different. In several places, the Act gives familiar concepts a narrower role.

In others, it leaves out safeguards that a GDPR-trained reader may instinctively assume must exist. It is tempting to treat these omissions as drafting mistakes. But that explanation does not always hold up. Some of the missing protections appeared in earlier Indian data protection bills and were later taken out. We therefore need to resist the urge to import GDPR principles into the Act simply because they feel familiar or necessary. The table below identifies nine places where GDPR instinct and the DPDP Act’s actual text lead to different answers.

Provisions Where GDPR Instinct And The DPDP Act Leads To Different Answers

Point of divergence	DPDP Act, 2023	GDPR
Paper records	The Act covers digital personal data. Paper records remain outside its scope unless they are digitized.	The GDPR also covers organized paper records that form, or are intended to form, part of a filing system.
Employment processing	Section 7(i) allows employers to process personal data for specified employment purposes as a “legitimate use.” It does not require consent or a balancing test.	Employers must identify Article 6 lawful basis. Contractual necessity and legitimate interests are subject to necessity or balancing requirements.
State and government processing	Section 17 allows the Central Government to exempt State instrumentalities from several obligations on specified grounds. The provision contains no express necessity-and-proportionality test.	Article 23 permits restrictions only where they are necessary, proportionate, and supported by appropriate safeguards.
Sensitive personal data	The Act has no separate category for sensitive data. Health, biometric, genetic, religious, and similar data are governed by the same general framework as other personal data.	Article 9 generally prohibits the processing of special-category data unless an additional exception applies.
Publicly available data	The Act does not apply to personal data made publicly available by the individual, or by someone legally required to publish it.	Public availability does not create a general exemption. GDPR principles, lawful-basis requirements, and individual rights usually continue to apply.
Automated decisions and profiling	The Act gives individuals no specific right against automated decisions or profiling. “Profiling” appeared in the 2022 Bill but was removed from the 2023 Act.	Article 22 protects individuals from certain decisions based solely on automated processing that have legal or similarly significant effects.
Data Protection Impact Assessments	Only notified Significant Data Fiduciaries must conduct periodic DPIAs. A high-risk activity does not by itself trigger this duty for every organization.	Article 35 requires any controller to conduct a DPIA before processing that is likely to create a high risk.
Compensation for harm	Penalties imposed under the Act go to the Consolidated Fund of India. The Act itself gives the affected person no right to compensation.	Article 82 gives individuals a direct right to claim compensation for material or non-material damage.

1. Why We Keep Making This Mistake

The difference becomes clear from the Act’s opening provisions. The word “privacy” does not appear in its operative text. Instead, the DPDP Act is concerned with protecting personal data while allowing it to be processed for lawful purposes. It does not seek to restate the broader right to privacy recognized by the Supreme Court in Puttaswamy.

That is not the only sign that we are dealing with a very different law. The DPDP Act covers only digital personal data. It does not create a separate category for sensitive data. It says nothing about profiling or automated decision-making. It allows broad exemptions for the State without setting out an express proportionality test. And when a penalty is imposed, the money goes to the government, not to the person who was harmed.

None of this is hidden. It is there in the text of the Act. Yet many of us read past it because we learned privacy law through the GDPR.

Most people practicing in this field today were trained through the CIPP/E, the GDPR recitals, and years of CJEU judgments and EDPB guidance. That training is valuable, but it also shapes what we expect a data protection law to say. When the DPDP Act uses familiar language, we instinctively connect it to concepts we already know.

A Data Fiduciary sounds like a controller. A Data Principal sounds like a data subject. The Consent Manager has no real GDPR equivalent, but we still try to fit it into a familiar category. The terms feel close enough, so we assume the legal structure behind them must also be similar.

It is not.

The real problem is not that GDPR knowledge is irrelevant. It is that GDPR reasoning tends to fill the gaps in the DPDP Act without us noticing. We assume that familiar safeguards and legal tests must exist somewhere in the background, even when the Act does not contain them.

The drafting history makes that assumption difficult to defend. Some of the protections missing from the final Act appeared in earlier versions of India’s data protection legislation and were later removed. Others remained absent through successive drafts. We should therefore be careful before treating every gap as an oversight, or filling it with a GDPR principle that Parliament did not enact.

2. What Parliament Actually Left Out

The clearest differences are often found by comparing the 2022 Bill with the law Parliament eventually passed.

Take profiling. The 2022 Bill applied to processing outside India where it was connected with either offering goods or services to people in India or profiling them. It also defined profiling as processing used to analyze or predict a person’s behavior, attributes, or interests.

Both references disappeared from the 2023 Act. Section 3 now reaches processing outside India only when it is connected with offering goods or services to Data Principals in India. A foreign ad-tech company that only profiles Indian users, without offering them goods or services, may therefore fall outside the Act’s territorial scope. The Act also contains no equivalent of Article 22 of the GDPR for certain solely automated decisions.

The position on non-consensual processing also needs care. The 2022 Bill used the expression “deemed consent,” while the final Act uses “certain legitimate uses.” Both versions relied on specified statutory situations rather than an open-ended equivalent of the GDPR’s legitimate-interests ground. Neither introduced the balancing test required by Article 6(1)(f). Section 7(i), therefore, should not be read as though it contains one.

The final Act also introduced a broad exclusion for publicly available personal data. Section 3(c)(ii) excludes data made publicly available by the Data Principal or by someone legally required to publish it. Under the GDPR, public availability does not generally take personal data outside the law. Even where Article 9(2)(e) applies to special-category data manifestly made public by the individual, the rest of the GDPR framework continues to apply.

The DPIA requirement followed a different path. The 2022 Bill and the final Act both reserve the statutory DPIA duty for notified Significant Data Fiduciaries. The 2025 Rules retain that entity-based approach. This is unlike Article 35 of the GDPR, where the likely risk of a particular processing activity triggers the duty, regardless of whether the controller belongs to a specially designated class.

These differences should not automatically be filled with GDPR concepts. Courts may interpret the Act in light of the Constitution and ordinary principles of statutory interpretation, but that is different from treating safeguards found in the GDPR as though they appear in the DPDP Act.

Telling a client that Section 7(i) contains an Article 6(1)(f) balancing test, or that Section 17 expressly requires an Article 23-style necessity-and-proportionality assessment, does not make the advice safer. It adds tests that Parliament did not write into the statute.

What Changed Between The 2022 Draft And The DPDP Act, 2023

Issue	Draft DPDP Bill, 2022	DPDP Bill, 2023	Final DPDP Act, 2023
Profiling	“Profiling” was defined and was also a ground for applying the Bill to processing outside India. A foreign entity profiling people in India could be covered even if it did not offer them goods or services.	The definition and the profiling-based territorial trigger were removed. Extraterritorial application was limited to processing connected with offering goods or services to Data Principals in India.	The 2023 Bill’s narrower approach was retained in Section 3(b).
Automated decision-making	“Automated” was defined, but the Bill provided no specific right against automated decisions and no equivalent of GDPR Article 22.	The definition of “automated” remained, but no right to human review, intervention, or protection against solely automated decisions was added.	The same position was retained. Automated operations may be processing, but automated decisions are not separately regulated.
Processing without consent	Section 8 used the concept of “deemed consent” for specified situations, including employment. It was a fixed statutory list, not an open-ended legitimate-inter interests’ ground.	“Deemed consent” was replaced with “certain legitimate uses.” The grounds were revised and placed in Section 7.	Section 7 retains the fixed list of certain legitimate uses, including employment-related processing.
Publicly available personal data	The Bill did not contain the present exclusion for personal data made publicly available by the Data Principal or under a legal obligation.	A new exclusion was added for such publicly available personal data.	Section 3(c)(ii) retains the exclusion, placing qualifying data outside the Act’s application.

Way Forward

Before carrying an EDPB position or a GDPR recital into DPDP Act advice, it helps to ask three things. Does the Act actually have an equivalent provision, or just a similar-sounding word. Was that protection present in an earlier draft and then removed, which tells you it was a choice and not an accident. And does applying the GDPR reading widen the client's compliance burden beyond what the Act requires, or does it overstate a protection Parliament chose to leave out. Either way, know which direction you are moving the client in, and say so.