1. Consent is the centre of gravity
GDPR gives six lawful bases; consent is one, and legitimate interest does much of the heavy lifting for ordinary commercial processing. DPDP is built primarily around consent, with a defined set of "legitimate uses" carved out in the Act.
The practical effect: where a European team says "we rely on legitimate interest," an Indian team often has no equivalent, and must either obtain consent or fall within an enumerated use. A playbook that starts from the lawful-basis menu does not port.
2. The notice is a product surface, not a document
GDPR familiarised teams with privacy notices. DPDP raises the bar on when and in what form the notice is given: before or with the request for consent, in a manner the data principal can understand, in the languages the Rules prescribe. That turns the notice into a product and content problem, not a legal-document problem.
3. The regulator is new and the law is young
GDPR has a decade of supervisory practice, DPAs, and fines to benchmark against. DPDP is early: the Board is finding its feet, the Rules are being operationalised, and enforcement patterns are not yet established.
That cuts both ways. There is less precedent to learn from, and less room to argue that "everyone does it this way."
4. The penalty shape is different
GDPR fines are graded on turnover, with a familiar two-tier structure. DPDP sets fixed maxima per obligation, from ₹250 crore down to ₹10,000, mapped to domains.
That changes strategy: exposure is not proportional to your revenue, it is attached to which obligation you failed. A large company and a small one can face the same ceiling for the same breach of the same obligation.
5. SDF is a category, not a role
There is no exact GDPR analogue to the Significant Data Fiduciary. A DPO is a role you appoint; an SDF is a category you fall into, carrying DPIA, independent-audit and reporting duties. Organisations used to scoping GDPR work by processing activity need a different lens here.
What to reuse, and what to rebuild
Teams can divide their existing programme into two distinct tracks:
- Reuse: the habit of data mapping, the instinct to minimise, the discipline of records of processing, and the concept of rights requests.
- Rebuild: the lawful-basis strategy, the notice design and its language coverage, the penalties model you plan against, and the SDF assessment.
The point is not that GDPR experience is useless. It is that the differences are where the failures will be, and they are invisible if you assume the two regimes are the same shape.
DPDP Done is an AI-powered DPDP Act 2023 audit engine built by Cyber Vigilance Group. Not legal advice. www.dpdpdone.com