AI Data Privacy: DPDP Act vs GDPR Compliance Guide

Introduction

For AI companies operating across borders, compliance with data protection regulations is no longer optional — it is a prerequisite for doing business. Two of the most consequential frameworks are the European Union's General Data Protection Regulation and India's Digital Personal Data Protection Act, 2023.

While GDPR has been the global benchmark since 2018, the DPDP Act introduces a framework tailored to India's digital ecosystem. For AI companies serving users in both jurisdictions, the overlap and divergence between these regimes create specific challenges around data localization, consent, audit trails, and the use of personal data for model training.

This guide compares the two frameworks across nine dimensions that matter most for AI systems, with practical guidance for achieving compliance in both jurisdictions simultaneously.

Jurisdiction and Applicability

GDPR applies to any organization processing personal data of individuals in the EU, regardless of where the organization is based. Its extraterritorial scope means an AI company in Bangalore handling EU user data is fully subject to GDPR.

The DPDP Act applies to the processing of digital personal data within India, and to data processing outside India if it relates to offering goods or services to individuals in India. The territorial scope is similar to GDPR but explicitly limited to digital personal data, excluding offline and non-digital processing.

For an AI company, this means: if you process data from EU users, GDPR applies. If you process data from Indian users, DPDP applies. If you process data from both, you must comply with both simultaneously.

Consent Requirements

Both frameworks require consent for processing personal data, but they differ in key details.

Under GDPR, consent must be freely given, specific, informed, and unambiguous. It requires a clear affirmative action — pre-ticked boxes or implied consent do not qualify. Data subjects have the right to withdraw consent at any time, and withdrawal must be as easy as giving consent.

The DPDP Act similarly requires consent that is free, specific, informed, unconditional, and unambiguous, with a clear affirmative action. However, the DPDP Act introduces the concept of a consent manager — a trusted intermediary that allows data principals to manage their consent preferences through a single interface. This is a significant innovation over GDPR's approach, which places consent management entirely on each data fiduciary.

For AI applications, a critical difference is how consent applies to model training. GDPR's legitimate interest basis can sometimes be used for model development without explicit consent, though this is legally contested. The DPDP Act takes a stricter position: consent must be obtained for each specific purpose, and using data for model training requires separate, explicit consent beyond the consent for service delivery.

Data Localization

Data localization is where the two frameworks diverge most significantly.

GDPR does not mandate data localization. It permits cross-border data transfers subject to adequate safeguards — Standard Contractual Clauses, Binding Corporate Rules, or adequacy decisions. Data can leave the EU as long as protections follow the data.

The DPDP Act takes a more restrictive approach. While the Act itself does not explicitly mandate data localization, it empowers the central government to notify significant data fiduciaries who must store data within India. The Rules under the DPDP Act, published in early 2025, clarify that certain categories of personal data must be stored exclusively in India, with mirror copies permitted for processing outside the country under strict conditions.

For AI companies, the practical implication is significant. A RAG system processing Indian users' data likely needs its vector database and source documents hosted in India. Cross-border inference calls may be restricted. Companies that architecture their infrastructure for data localization from day one save substantial rework compared to those that treat it as an afterthought.

Audit and Logging Requirements

Both frameworks require audit trails, but the DPDP Act is more prescriptive.

GDPR requires data controllers to maintain records of processing activities and to implement measures that demonstrate compliance (the accountability principle). The specific logging requirements are principle-based rather than prescriptive.

The DPDP Act mandates that significant data fiduciaries implement audit mechanisms, conduct annual data protection impact assessments, and maintain detailed logs of all data processing activities. The Rules specify minimum logging requirements including timestamps, purpose of processing, identities of data processors involved, and records of data subject requests.

For AI systems, audit logging must capture every query that touches personal data — the input, the retrieved context, the generated output, and the rationale for any automated decisions. This is not merely a compliance exercise; these logs are essential for debugging, incident response, and demonstrating compliance during regulatory audits.

Rights of Data Subjects

Both frameworks grant individuals rights over their personal data, with substantial overlap and notable differences.

GDPR provides the right to access, rectification, erasure (right to be forgotten), restriction of processing, data portability, and objection to processing. The right to explanation of automated decisions is implied but not explicit in the regulation text.

The DPDP Act provides rights to access, correction, erasure, and grievance redressal. Notably, the DPDP Act does not include an explicit right to data portability or a general right to object to processing. It does, however, include a right to nominate — the ability to designate a nominee who can exercise data rights on behalf of the data principal after their death or incapacity.

For AI systems, the right to erasure creates a specific technical challenge. If an individual requests deletion of their data, the system must ensure all copies — including those in vector embeddings, training datasets, and cached responses — are deleted. This is straightforward for structured databases but technically complex for vector embeddings, where the individual's data is distributed across the embedding space rather than stored in a single identifiable row.

Penalties and Enforcement

The penalty structures differ in both scale and approach.

GDPR penalties can reach the higher of 20 million euros or 4% of global annual turnover. Enforcement has been active: between 2018 and 2026, EU regulators have issued over 2 billion euros in fines across thousands of cases.

The DPDP Act imposes penalties of up to 250 crore rupees (approximately 30 million USD) for each instance of non-compliance. While the absolute numbers are lower than GDPR, the relative impact on Indian companies of comparable size is substantial. The Act also introduces a graded penalty structure based on the severity and duration of non-compliance, with separate penalties for failure to implement security safeguards, failure to notify data breaches, and failure to fulfill data principal requests.

Critically, the DPDP Act does not provide a private right of action — individuals cannot sue companies directly for damages. Enforcement is handled exclusively by the Data Protection Board of India. This is a significant departure from GDPR, which grants individuals the right to seek compensation through courts.

Practical Compliance for AI Companies

For AI companies serving both EU and Indian users, compliance requires addressing the stricter of each requirement:

• Data localization: host infrastructure for Indian user data in India, with EU data transfer mechanisms following GDPR requirements
• Consent: implement purpose-specific consent collection that meets both GDPR specificity and DPDP's explicit consent for model training
• Audit logging: maintain the detailed logs required by DPDP, which exceed GDPR's record-keeping requirements
• Deletion: implement vector-level erasure capabilities to satisfy both GDPR's right to erasure and DPDP's right to deletion
• Data protection impact assessments: conduct DPIAs as mandated by DPDP, which are a recommended practice under GDPR but mandatory under DPDP for significant data fiduciaries