DPDP vs GDPR, framed for AI builders

Six points that matter for AI

• Legal basis for training on personal data

  DPDP (India)

  Consent-first. There is no general 'legitimate interest' basis — only a closed list of 'legitimate uses' (Section 7: legal obligations, government functions, medical emergencies, employment, etc.). Reusing data collected for another purpose to train a model generally needs fresh, specific consent.

  GDPR (EU)

  Legitimate interest (Art 6(1)(f)) can support AI training and deployment, per the EDPB's Opinion 28/2024, if it passes a three-step Legitimate Interests Assessment.

  For AI builders

  Europe offers a flexible (if conditional) basis for training; India usually pushes you back to consent.

• Publicly available / scraped personal data

  Interpretive

  DPDP (India)

  India's DPDP Act has a broad carve-out. If someone has made their personal data publicly available themselves, or the law requires it to be public, the Act largely does not apply to it — section 3(c)(ii).

  GDPR (EU)

  The EU has moved the other way. In July 2026 the EDPB published draft guidelines saying plainly that public visibility is not a legal basis. If scraped data includes personal data, the GDPR applies to it.

  What the draft guidelines say, if you train models on scraped data:

  • Consent will not work at scale. You need legitimate interest instead, and you have to document the balancing test.
  • robots.txt, ai.txt, CAPTCHAs and login walls now count. Ignoring them weighs against you, because they show what people reasonably expected.
  • You must still publish a clear privacy notice, even if telling each person individually would be disproportionate. You must also offer a way to opt out before you collect.
  • Buying a scraped dataset from a broker does not move the problem to the broker.
  • Special-category data — health, beliefs, biometrics — is off limits unless you have an Article 9(2) exception.

  These are drafts. Consultation runs to 30 October 2026, so the wording can still change.

  For AI builders

  India and the EU now sit far apart on this.

• Automated decisions & profiling

  DPDP gap

  DPDP (India)

  No dedicated automated-decision-making right. General duties (purpose-specific consent, data accuracy) apply, but there is no specific provision letting a person object to a solely automated decision.

  GDPR (EU)

  Article 22 gives a right not to be subject to a solely automated decision with legal or similarly significant effects, plus safeguards like human review.

  For AI builders

  Europe constrains automated decisioning head-on; India, for now, does not.

• Research / statistical exemption

  DPDP (India)

  Processing for research, archiving or statistical purposes is exempt (Section 17(2)(b)) — but only if done to prescribed standards and NOT used to make decisions about specific individuals.

  GDPR (EU)

  Article 89 allows research processing with safeguards (data minimisation, etc.).

  For AI builders

  Both offer a research lane. India's fits a pure research model, not a deployed product that acts on individuals.

• Children's data

  DPDP (India)

  Anyone under 18. Verifiable parental consent required; no behavioural monitoring; no targeted advertising to children.

  GDPR (EU)

  Consent age 16 for online services (member states may lower to 13); profiling of children is discouraged but not banned outright.

  For AI builders

  India is stricter and broader — if under-18s can use your product, the full regime applies. See our children's-data page.

• Cross-border transfers

  DPDP (India)

  Transfers are allowed to every country EXCEPT those the government restricts (a blacklist) — and no restricted list has been notified yet. Sector rules (e.g. RBI localisation) still apply on top.

  GDPR (EU)

  Transfers allowed to 'adequate' countries, or with safeguards like Standard Contractual Clauses (an allowlist).

  For AI builders

  Opposite defaults — India permits by default, the EU restricts by default. See what's still pending.