DPDP vs GDPR, framed for AI builders
Building an AI product for both India and Europe? The two regimes agree on the basics and then split apart exactly where AI lives — training data, public data, automated decisions. Here's a side-by-side on the points that actually matter for AI, not a generic feature list.
India's AI Governance Guidelines are soft law — they can't override the DPDP Act. So where the Act is silent or ambiguous about AI, that's an open interpretive question, not a settled rule. We flag those spots below rather than paper over them.
Six points that matter for AI
| Topic | DPDP (India) | GDPR (EU) | For AI builders |
|---|---|---|---|
| Legal basis for training on personal data | Consent-first. There is no general 'legitimate interest' basis — only a closed list of 'legitimate uses' (Section 7: legal obligations, government functions, medical emergencies, employment, etc.). Reusing data collected for another purpose to train a model generally needs fresh, specific consent. | Legitimate interest (Art 6(1)(f)) can support AI training and deployment, per the EDPB's Opinion 28/2024, if it passes a three-step Legitimate Interests Assessment. | Europe offers a flexible (if conditional) basis for training; India usually pushes you back to consent. |
| Publicly available / scraped personal dataInterpretive | India's DPDP Act has a broad carve-out. If someone has made their personal data publicly available themselves, or the law requires it to be public, the Act largely does not apply to it — section 3(c)(ii). | The EU has moved the other way. In July 2026 the EDPB published draft guidelines saying plainly that public visibility is not a legal basis. If scraped data includes personal data, the GDPR applies to it. What the draft guidelines say, if you train models on scraped data:
These are drafts. Consultation runs to 30 October 2026, so the wording can still change. | India and the EU now sit far apart on this. |
| Automated decisions & profilingDPDP gap | No dedicated automated-decision-making right. General duties (purpose-specific consent, data accuracy) apply, but there is no specific provision letting a person object to a solely automated decision. | Article 22 gives a right not to be subject to a solely automated decision with legal or similarly significant effects, plus safeguards like human review. | Europe constrains automated decisioning head-on; India, for now, does not. |
| Research / statistical exemption | Processing for research, archiving or statistical purposes is exempt (Section 17(2)(b)) — but only if done to prescribed standards and NOT used to make decisions about specific individuals. | Article 89 allows research processing with safeguards (data minimisation, etc.). | Both offer a research lane. India's fits a pure research model, not a deployed product that acts on individuals. |
| Children's data | Anyone under 18. Verifiable parental consent required; no behavioural monitoring; no targeted advertising to children. | Consent age 16 for online services (member states may lower to 13); profiling of children is discouraged but not banned outright. | India is stricter and broader — if under-18s can use your product, the full regime applies. See our children's-data page. |
| Cross-border transfers | Transfers are allowed to every country except one the government restricts by notification under Section 16(1). We have found no such notification. Sector rules (e.g. RBI localisation) still apply on top. | Transfers allowed to 'adequate' countries, or with safeguards like Standard Contractual Clauses (an allowlist). | Opposite defaults — India permits by default, the EU restricts by default. See what's still pending. |
Legal basis for training on personal data
- DPDP (India)
- Consent-first. There is no general 'legitimate interest' basis — only a closed list of 'legitimate uses' (Section 7: legal obligations, government functions, medical emergencies, employment, etc.). Reusing data collected for another purpose to train a model generally needs fresh, specific consent.
- GDPR (EU)
- Legitimate interest (Art 6(1)(f)) can support AI training and deployment, per the EDPB's Opinion 28/2024, if it passes a three-step Legitimate Interests Assessment.
For AI buildersEurope offers a flexible (if conditional) basis for training; India usually pushes you back to consent.
Publicly available / scraped personal data
Interpretive- DPDP (India)
- India's DPDP Act has a broad carve-out. If someone has made their personal data publicly available themselves, or the law requires it to be public, the Act largely does not apply to it — section 3(c)(ii).
- GDPR (EU)
The EU has moved the other way. In July 2026 the EDPB published draft guidelines saying plainly that public visibility is not a legal basis. If scraped data includes personal data, the GDPR applies to it.
What the draft guidelines say, if you train models on scraped data:
- Consent will not work at scale. You need legitimate interest instead, and you have to document the balancing test.
- robots.txt, ai.txt, CAPTCHAs and login walls now count. Ignoring them weighs against you, because they show what people reasonably expected.
- You must still publish a clear privacy notice, even if telling each person individually would be disproportionate. You must also offer a way to opt out before you collect.
- Buying a scraped dataset from a broker does not move the problem to the broker.
- Special-category data — health, beliefs, biometrics — is off limits unless you have an Article 9(2) exception.
These are drafts. Consultation runs to 30 October 2026, so the wording can still change.
For AI buildersIndia and the EU now sit far apart on this.
Automated decisions & profiling
DPDP gap- DPDP (India)
- No dedicated automated-decision-making right. General duties (purpose-specific consent, data accuracy) apply, but there is no specific provision letting a person object to a solely automated decision.
- GDPR (EU)
- Article 22 gives a right not to be subject to a solely automated decision with legal or similarly significant effects, plus safeguards like human review.
For AI buildersEurope constrains automated decisioning head-on; India, for now, does not.
Research / statistical exemption
- DPDP (India)
- Processing for research, archiving or statistical purposes is exempt (Section 17(2)(b)) — but only if done to prescribed standards and NOT used to make decisions about specific individuals.
- GDPR (EU)
- Article 89 allows research processing with safeguards (data minimisation, etc.).
For AI buildersBoth offer a research lane. India's fits a pure research model, not a deployed product that acts on individuals.
Children's data
- DPDP (India)
- Anyone under 18. Verifiable parental consent required; no behavioural monitoring; no targeted advertising to children.
- GDPR (EU)
- Consent age 16 for online services (member states may lower to 13); profiling of children is discouraged but not banned outright.
For AI buildersIndia is stricter and broader — if under-18s can use your product, the full regime applies. See our children's-data page.
Cross-border transfers
- DPDP (India)
- Transfers are allowed to every country except one the government restricts by notification under Section 16(1). We have found no such notification. Sector rules (e.g. RBI localisation) still apply on top.
- GDPR (EU)
- Transfers allowed to 'adequate' countries, or with safeguards like Standard Contractual Clauses (an allowlist).
For AI buildersOpposite defaults — India permits by default, the EU restricts by default. See what's still pending.
Bottom line for AI builders
The two regimes are closest on children and research, and diverge most on training basis, public data, and automated decisions. India is more permissive on public and training data but currently offers individuals less on automated decisions — and several DPDP-for-AI questions remain interpretive, so treat the training-data and public-data positions as directional, not final.
Sources
DPDP Act, 2023 — Sections 3(c)(ii), 7, 9, 16 & 17(2)(b)
Notified — checked 2026-10-06. Opened the DPDP Act, 2023 (Gazette PDF). Partly in force: most duties start 13 May 2027 (G.S.R. 843(E)).
EU GDPR — Regulation (EU) 2016/679 (Arts 6, 8, 9, 22, 89)
Status unverified — no status check recorded
EDPB Opinion 28/2024 on AI models
Status unverified — no status check recorded
Draft. Consultation runs to 30 October 2026, so the wording can still change.
Draft — checked 2026-08-18
EDPB Guidelines 02/2026 on anonymisation
Draft. Consultation runs to 30 October 2026. Replaces the 2014 opinion and sets three tests for anonymity — no record isolation, no linkage, no inference. Whether data is anonymous can differ between two organisations holding it. No URL sourced.
Draft — checked 2026-08-18
Last updated: 17 August 2026 · Written and edited by Sandesh Kokate
Educational only, and a high-level comparison — not jurisdiction-specific legal advice. Re-verify against the Gazette of India and EUR-Lex before relying on anything here.
Checking data and algorithms (Indian law)
Law — every Data Fiduciary (DPDP Act, Section 8(3)). If personal data will be used to make a decision about someone, or shared with another Data Fiduciary, you must keep it complete, accurate and consistent.
Law — Significant Data Fiduciaries only (DPDP Rules, Rule 13(3)). A Significant Data Fiduciary must take care to check that the technical measures it uses for hosting, displaying, uploading, modifying, publishing, transmitting, storing, updating or sharing personal data, including algorithmic software, are not likely to put people's rights at risk. Rule 13 starts on 13 May 2027.
These are Indian duties. GDPR and the EU AI Act are EU laws. They are not Indian law.
Official text — DPDP Act, 2023, Section 8(3)
Official text — DPDP Rules, 2025, Rule 13(3)
How does this apply to you?
Take the 2-minute self-check to find out whether you're a Data Fiduciary, Data Processor, or both — with your personalised action checklist.
Take the DPDP Applicability CheckYour answers stay in your browser. If you choose "Email me this report", we send your email address and result type to our report service.