The DPDP Act is India’s most significant data protection law. It creates compliance obligations for every organization that processes digital personal data of people in India, wherever the organization is based. Full compliance is mandatory by May 13, 2027, and phased implementation is already under way. Penalties reach up to 250 crore rupees per violation, roughly 27 million euros, which is more than GDPR’s fixed maximum of 20 million euros. The Act applies to any entity offering goods or services to people in India. GDPR compliance covers only 60-70% of DPDP requirements, with critical differences in consent and cross-border transfers, and over 157 countries now have data protection laws. This guide covers what the DPDP Act requires and how multinational organizations should build cloud compliance around it.
What the DPDP Act Requires for Cloud Compliance
The DPDP Act requires organizations to have a lawful basis for processing, run consent mechanisms, appoint data protection officers where they are Significant Data Fiduciaries and set up grievance redressal. Notices must also be available in English or any of the languages in India’s Eighth Schedule, which has no GDPR equivalent and means real localization work.
Consent under the DPDP Act must be free, specific, informed, unconditional and unambiguous, given through a clear affirmative action. GDPR allows six lawful bases, including legitimate interest; the DPDP Act allows only two, consent and certain legitimate uses. Processing that relies on legitimate interest under GDPR therefore needs explicit consent under Indian law.
Children’s data gets stronger protection: parental consent is required for anyone under 18, against GDPR’s default threshold of 16. Organizations the government designates as Significant Data Fiduciaries face extra duties, including periodic impact assessments, independent audits and an India-based DPO. Multinational cloud providers should assess whether the volume and sensitivity of the Indian data they handle could lead to SDF designation.
Phase 1 (November 2025) set up the Data Protection Board and its complaint mechanisms. Phase 2 (November 2026) opens consent manager registration, limited to India-incorporated entities with a net worth of at least 2 crore rupees. The last step, Phase 3 (May 2027), requires full compliance on consent, notice, data principal rights, breach notification, retention, erasure and security safeguards. Work toward compliance well before the deadline, because infrastructure changes, testing, training and process changes all take months to embed across teams.
How the DPDP Act Compares to GDPR
The DPDP Act borrows from GDPR but differs in important ways, so GDPR compliance alone does not satisfy Indian requirements.
The DPDP Act Cloud Compliance Framework
The cloud compliance framework below covers the DPDP requirements that multinational organizations need to add to their existing GDPR controls.
| Requirement | GDPR Approach | DPDP Act Approach |
|---|---|---|
| Lawful Basis | Six bases including legitimate interest | ✗ Only consent and legitimate use permitted |
| Cross-Border Transfers | Adequacy decisions plus SCCs | ◐ Permitted unless government blacklists countries |
| Children’s Protection | Parental consent under 16 | ✗ Parental consent under 18 required |
| Data Scope | All personal data including paper | Yes: Digital personal data only |
| Data Portability | Right to data portability included | ◐ Not included in DPDP Act |
The DPDP Act’s blacklist approach to cross-border transfers gives flexibility but adds uncertainty, because the government can restrict transfers to a country at any time without the long assessment that GDPR adequacy decisions involve. No restricted countries had been published as of early 2026, so transfers are broadly allowed for now. Still, prepare data localization contingencies: map every cross-border flow and have India-based processing options ready to switch on, so a sudden restriction does not disrupt operations.
A single data breach can trigger more than one penalty. Failing to take reasonable security safeguards can cost up to 250 crore, and failing to notify the Data Protection Board and affected individuals can add up to 200 crore. Because penalties are fixed rather than tied to turnover, the exposure is disproportionately heavy for smaller organizations that handle large volumes of Indian personal data.
Talk to an ExpertUnsure how the DPDP Act affects your cloud setup? Review it with our team.
Building a Multinational Cloud Compliance Strategy
A multinational cloud compliance strategy should treat the most protective rule as the baseline. Organizations that already comply with GDPR can focus on the DPDP gap instead of starting over, but that gap includes differences that configuration changes alone cannot close. Consent systems must support India-specific purpose limitation and multilingual notices that GDPR programs never built, and grievance redressal needs defined timelines and escalation paths that match the Data Protection Board’s expectations. A gap assessment should list every point where DPDP differs from existing GDPR controls and set a plan to close each one within the phased timeline.
Five DPDP Act Priorities for Cloud Leaders
Based on the compliance landscape, here are five DPDP Act priorities:
- Conduct a DPDP gap assessment against existing GDPR controls: GDPR covers 60-70% of DPDP requirements, so pinpoint the gaps in consent, children’s protections and cross-border transfers. You then spend on the gap instead of rebuilding compliance from scratch.
- Redesign consent flows for Indian users: The DPDP Act does not allow legitimate interest as a basis, so move GDPR legitimate-interest processing to explicit consent for people in India, with notices available in English or Eighth Schedule languages.
- Assess Significant Data Fiduciary designation risk: The government designates SDFs based on the volume and sensitivity of data and the risk to individuals, so assess whether your Indian processing could qualify and prepare for duties such as an India-based DPO and audits.
- Prepare data localization contingency plans: The government can restrict cross-border transfers at any time, so map all Indian data flows and design India-region processing that can be switched on quickly.
- Build unified compliance architecture across frameworks: With over 157 countries now having data protection laws, use one compliance platform that maps controls across GDPR, DPDP and other frameworks at once, avoiding duplicate implementations.
In Brief
Key Takeaway The DPDP Act requires full compliance by May 2027, with penalties of up to 250 crore per violation. GDPR covers 60-70% of the requirements, and the key gaps are consent instead of legitimate interest, parental consent up to 18 instead of 16, and blacklist instead of adequacy-based transfers. One breach can trigger several penalties. Start from GDPR, close the DPDP gap, prepare localization contingencies and build one compliance architecture instead of separate programs.
Looking Ahead: Data Sovereignty Convergence
The DPDP Act will keep developing as the Data Protection Board issues guidance and enforcement sets precedents. SDF designations are expected to cover major platforms, including global technology companies with large Indian user bases, and data localization rules may widen beyond today’s sector-specific mandates.
Organizations that wait for enforcement patterns before acting risk 250 crore penalties from May 2027.
The 18-month window looks generous, but organizational change makes it tight. Organizations building unified architecture now will adapt more easily as the rules evolve.
India joins Europe, Brazil, China and over 150 other jurisdictions with comprehensive data protection frameworks. For cloud leaders, the DPDP Act turns data sovereignty from a European concern into a global operating requirement, because every market where the organization processes personal data now needs a compliance architecture. Organizations with unified frameworks will onboard new jurisdictions faster.
Organizations running a separate program for each jurisdiction face rising costs with every new law. A unified architecture pays back through lower implementation costs, faster regulatory response and simpler operations, and the DPDP Act is forcing that decision for organizations that used to manage compliance country by country.
Our ServiceCloud Services and Platform Engineering
Frequently Asked Questions
References
- DPDP Phased Timeline, SDF Obligations, Penalties, Cross-Border: Recording Law — India DPDP Act Compliance Guide 2026
- GDPR vs DPDP Comparison, 60-70% Coverage, Gap Assessment: TCSA — DPDP Act vs GDPR Complete Comparison
- Global Data Protection Landscape, 157 Countries, Sovereignty: Forcepoint — Global Data Protection Laws in 2026
Security Insights, Delivered.
Practical, vendor-neutral analysis of threats, tools, and architecture decisions.