DPDPA vs GDPR: seven differences that change what you build
Not a table of statutory contrasts. The seven places where the two regimes diverge enough to change your data model, your consent screens and your engineering backlog.
Not a table of statutory contrasts. The seven places where the two regimes diverge enough to change your data model, your consent screens and your engineering backlog.
The designation is discretionary, so the useful question is not whether you are one but what it would cost to be treated as one. Three additional duties, and why we tell large consumer platforms to assume it.
The requirement is not the expensive part — the architecture is. A three-tier design that meets 180 days in Indian jurisdiction at roughly a fifth of the licensing-led cost.
The Act set the principles. The Rules set the engineering requirements. Here is what changes in your systems — notice structure, breach clocks, and verifiable parental consent.
The failure is never detection. It is authorisation — nobody knows who can file, and the person who does is asleep. Here is how to build a reporting capability that survives a Saturday.