DPDP Act vs GDPR: how consent differs

India's DPDP Act, 2023 and the EU's GDPR agree on the core of consent: it must be freely given, specific, informed and unambiguous, given by a clear affirmative action, as easy to withdraw as to give, and provable by the organisation relying on it. The DPDP Act goes further in a few places that matter in practice. Consent must also be unconditional and limited to the data the purpose needs; there is no "legitimate interests" basis to fall back on; everyone under 18 is a child; and consent can reach you through a registered Consent Manager.

This guide compares the two clause by clause, so a team with a GDPR consent setup can see what carries over and what has to change.

Side by side

	DPDP Act, 2023 and DPDP Rules, 2025	GDPR
Definition	Free, specific, informed, unconditional and unambiguous, with a clear affirmative action, limited to the data necessary for the specified purpose (Section 6(1))	Freely given, specific, informed and unambiguous, by a statement or clear affirmative action (Article 4(11))
Lawful bases	Consent or certain legitimate uses, a closed list (Sections 4(1) and 7)	Six bases, including contract and legitimate interests (Article 6(1))
Bundled or conditional consent	Consent must be unconditional; parts that infringe the law are invalid (Section 6(1)–(2))	Conditioning a service on unnecessary consent weighs against "freely given" (Article 7(4))
Proof	The Data Fiduciary must prove notice and consent (Section 6(10))	The controller must be able to demonstrate consent (Article 7(1))
Withdrawal	Any time, with ease comparable to giving it; processors must stop too (Section 6(4)–(6))	Any time; "as easy to withdraw as to give consent" (Article 7(3))
Children	Under 18; verifiable parental consent before processing any of a child's personal data (Sections 2(f) and 9(1))	Under 16 for information society services, which Member States may lower to 13 (Article 8(1))
Sensitive data	No special categories, and no "explicit consent" tier	Special categories need explicit consent or another Article 9(2) condition
Notice languages	English or any of the 22 languages in the Eighth Schedule to the Constitution (Section 6(3))	No fixed list; clear and plain language
Intermediaries	Consent may be given and withdrawn through a registered Consent Manager (Section 6(7))	No equivalent
Maximum penalty	No consent-specific item; in our reading the catch-all item 7 of the Schedule applies, up to ₹50 crore	Up to €20 million or 4% of worldwide annual turnover for breaching the conditions for consent (Article 83(5)(a))

Where the DPDP Act is stricter

No legitimate interests

Under the GDPR, much processing runs on contract (Article 6(1)(b)) or legitimate interests (Article 6(1)(f)) rather than consent. Under the DPDP Act, you may process personal data only with consent or for one of the legitimate uses listed in Section 7 (Section 4(1)). Those uses are specific: for example, data a person voluntarily gives you for a specified purpose without objecting to its use (Section 7(a)), legal obligations (7(d)), medical emergencies (7(f)) and employment (7(i)). There is no open-ended balancing test.

What to change: re-map every processing activity your GDPR records put under contract or legitimate interests. Each one now needs consent or a specific Section 7 use. See legitimate uses under DPDP Section 7 for each use and its limits.

Unconditional, and only the data you need

Section 6(1) adds two words the GDPR definition does not have: consent must be unconditional, and limited to the personal data necessary for the specified purpose. The Act's illustration: a telemedicine app asks for consent to provide its service and to read the user's phone contacts. Because the contacts are not needed for telemedicine, her consent covers only the telemedicine processing.

Every under-18 is a child

The GDPR's age threshold is 16 or lower, and only for information society services. The DPDP Act treats everyone under 18 as a child (Section 2(f)) and requires verifiable consent of a parent or lawful guardian before processing any of their personal data (Section 9(1)), with the method set by Rule 10 from 13 May 2027. The same applies to a person with a disability who has a lawful guardian.

Notices in 22 languages

A consent request must give the person the option to read it in English or any language in the Eighth Schedule to the Constitution (Section 6(3)). The GDPR asks for clear and plain language but sets no list. See the DPDP consent notice checklist for what Rule 3 adds.

Where they differ in structure

"Explicit consent"

The GDPR has two levels: ordinary consent, and explicit consent for special categories such as health, biometric or religious data (Article 9(2)(a)). The DPDP Act does not use the word "explicit" and has no special categories. One standard, a clear affirmative action under Section 6(1), applies to all personal data, and children's data has its own rules. In practice, a DPDP consent should look like a GDPR one: an unticked box, a separate toggle per purpose, nothing inferred from silence (the GDPR's Recital 32 says the same).

Consent Managers

The DPDP Act lets a person give, review and withdraw consent through a Consent Manager registered with the Data Protection Board (Section 6(7)); registration opens on 13 November 2026. The GDPR has nothing equivalent. See what is a Consent Manager under the DPDP Act?

Scope

The DPDP Act applies to digital personal data, including data collected on paper and later digitised (Section 3(a)). The GDPR also covers manual records in a filing system (Article 2(1)).

What carries over from a GDPR setup

Much of a sound GDPR consent setup works under the DPDP Act:

• opt-in by a clear affirmative action, never pre-ticked;
• separate consent per purpose;
• withdrawal that is as easy as consenting, and that stops processing (see withdrawal of consent under the DPDP Act);
• consent records detailed enough to prove who agreed to what, when, and on which notice.

What to add or change:

1. Re-map processing on contract or legitimate interests to consent or a Section 7 legitimate use.
2. Rewrite notices to Rule 3: an itemised description of the data, the purposes and the link to withdraw, exercise rights and complain to the Board.
3. Offer notices in the Eighth Schedule languages your users read.
4. Treat users under 18 as children and add verifiable parental consent.
5. Make sure withdrawals reach your processors (Section 6(6)).
6. Be ready to accept consents and withdrawals through Consent Managers.

Frequently asked questions

Is GDPR consent valid under the DPDP Act?

Not automatically. A GDPR-compliant consent will usually meet most of Section 6(1), but you still need a notice that meets Section 5 and Rule 3, consent that is unconditional and limited to necessary data, and parental consent for anyone under 18.

Does the DPDP Act require explicit consent?

The DPDP Act does not use the term. It requires consent to be free, specific, informed, unconditional and unambiguous with a clear affirmative action (Section 6(1)), for all personal data. The GDPR's separate explicit-consent standard applies only to its special categories of data.

Is there a legitimate interests basis under the DPDP Act?

No. Section 4(1) allows processing only with consent or for the legitimate uses listed in Section 7, which are specific situations such as voluntarily provided data, legal obligations, medical emergencies and employment.

What is the age of consent under the DPDP Act?

Eighteen. Section 2(f) defines a child as anyone under 18, and Section 9(1) requires verifiable consent of a parent or lawful guardian before processing a child's personal data.

Can one consent setup serve both laws?

Yes, if it is built to the stricter rule on each point: purpose-level opt-in, easy withdrawal that reaches processors, versioned notices in the languages required, under-18 handling and records that prove each consent.

Where Consentrio fits

Consentrio is a consent management platform for India's DPDP Act. Purpose-based consent, easy withdrawal, rights requests and an auditable consent record are core to both the DPDP Act and the GDPR, so the same setup supports both: versioned notices with translation workflows, consent capture through web, mobile and server SDKs, a preference centre for withdrawal, signed notifications to processors, and a tamper-evident audit trail. For the DPDP rules in full, see DPDP Act consent requirements.