Skip to content
India AI Rulebook
Going Global · AI Policy

DPDP vs GDPR, framed for AI builders

Building AI for India and Europe? Check both sets of rules. They differ on training data, public data and automated decisions. This guide compares six key points and flags what remains uncertain.

Last updated: 1 November 2026Written and edited by Sandesh Kokate

Checked against primary sources where marked. Items marked Confirmation pending are not yet checked. See the list

A caveat first

India's AI Governance Guidelines are soft law — they can't override the DPDP Act. So where the Act is silent or ambiguous about AI, that's an open interpretive question, not a settled rule. We flag those spots below rather than paper over them.

Six points that matter for AI

  • Legal basis for training on personal data

    DPDP (India)
    Law — s.4(1), s.6(1), s.7: use consent or a listed legitimate use. There is no general legitimate-interest ground. Our reading: reuse for model training usually needs fresh, specific consent if no legitimate use applies.
    GDPR (EU)
    Article 6(1)(f) can support training and use of AI, but not by default. EDPB Opinion 28/2024 calls for three tests: a valid interest, necessity and a balance of rights. Record the assessment.
    For AI builders

    Europe offers a flexible (if conditional) basis for training; India usually pushes you back to consent.

  • Publicly available / scraped personal data

    Interpretive
    DPDP (India)
    Law — section 3(c)(ii): the Act excludes personal data made public by the person, or by someone under a legal duty. Finding data online is not enough by itself.
    GDPR (EU)

    Public access does not remove GDPR protection. The EDPB's July 2026 consultation draft explains existing duties for scraping. A public page does not prove consent (draft paragraphs 43–45).

    What the draft guidelines say, if you train models on scraped data:

    • Consent may be hard to obtain for large-scale scraping. Legitimate interests may apply to private bodies only after all three tests (draft paragraphs 43–47).
    • robots.txt, ai.txt, CAPTCHAs and login walls can affect what people reasonably expect. They do not decide lawfulness on their own (draft pages 17–18).
    • Article 14 notice duties still apply. The exception for disproportionate effort needs a case-specific check and public information (draft paragraphs 25–30). A prior opt-out is a possible extra safeguard, not a fixed duty (draft page 19).
    • Buying a scraped dataset from a broker does not move the problem to the broker.
    • Article 9(2) needs an exception for special-category data. This includes health, beliefs and biometric data used to identify a person uniquely.

    This source is version 1.0, adopted on 7 July 2026 for consultation. We reopened it on 1 November 2026. Later finalisation remains unconfirmed.

    For AI builders

    India and the EU now sit far apart on this.

  • Automated decisions & profiling

    DPDP gap
    DPDP (India)
    The opened Act has no dedicated right to object to a solely automated decision. Consent and grounds (ss.4, 6, 7) and accuracy duties (s.8(3)) still apply.
    GDPR (EU)
    Article 22 generally protects against solely automated decisions with legal or similar significant effects. Its exceptions matter. Contract and explicit-consent exceptions require safeguards: human review, a chance to give a view and contest the decision.
    For AI builders

    Europe constrains automated decisioning head-on; India, for now, does not.

  • Research / statistical exemption

    DPDP (India)
    Section 17(2)(b) exempts research, archiving and statistics only under prescribed standards, and not for decisions about specific people. Rule 16 and the Second Schedule set the standards.
    GDPR (EU)
    Article 89 requires research safeguards, such as keeping only needed data. It is not a lawful basis by itself. An Article 6 basis and any needed Article 9 exception still apply.
    For AI builders

    Both offer a research lane. India's fits a pure research model, not a deployed product that acts on individuals.

  • Children's data

    DPDP (India)
    A child is under 18 (s.2(f)). Section 9(1) requires verifiable parental consent; s.9(3) restricts tracking and targeted ads. Rule 12 exemptions are narrow and conditional.
    GDPR (EU)
    Article 8 concerns consent-based online services offered directly to children. It generally needs parental authorisation below 16. Member States may lower this to 13, but not below. It is not a universal GDPR age limit. Children need special protection (recital 38).
    For AI builders

    Check the child's age and the actual processing. Do not assume a blanket exemption. See our children's-data page.

  • Cross-border transfers

    DPDP (India)
    Section 16(1) permits country restrictions by notification. Rule 15 concerns government requirements for foreign-state access. Current restrictions remain unconfirmed in our limited check. Sector rules can add stricter limits (s.16(2)).
    GDPR (EU)
    Chapter V allows transfers through adequacy decisions (Article 45), safeguards such as SCCs (Article 46), or an applicable Article 49 exception. This is not a simple country allowlist.
    For AI builders

    Opposite defaults — India permits by default, the EU restricts by default. See what's still pending.

Bottom line for AI builders

India's public-data exclusion can be broader. GDPR legitimate interests may offer a conditional training basis. Neither gives blanket permission to train on personal data. Some DPDP questions need interpretation. Treat those readings as a starting point, not a final legal answer.

Sources

Source
MeitY — DPDP Act (Gazette PDF)

DPDP Act, 2023 — Sections 3(c)(ii), 7, 9, 16 & 17(2)(b)

We opened this on 2026-11-01

Source
EUR-Lex — GDPR official text

EU GDPR — Regulation (EU) 2016/679 (Arts 6, 8, 9, 22, 89)

Status not confirmed

Status not confirmed — no status check recorded

Source
EDPB — Opinion 28/2024

EDPB Opinion 28/2024 on AI models

Status not confirmed

Status not confirmed — no status check recorded

Source
EDPB Guidelines 03/2026 on web scraping in the context of generative AI

Draft. Consultation runs to 30 October 2026, so the wording can still change. Reopened the cited text on 1 November 2026. The earlier status date is retained: current amendments or finalisation were not fully verified. A readable document alone is not a fresh current-status check.

Verified — 2026-08-18

Draft — checked 2026-08-18

Source

EDPB Guidelines 02/2026 on anonymisation

Primary source not yet confirmed. Attempted official-source check on 1 November 2026 did not yield the cited document or a verified current status. No fresh statusCheckedOn is asserted.

Status not confirmed

Status not confirmed — no status check recorded

Last updated: 1 November 2026 · Written and edited by Sandesh Kokate

Educational only, and a high-level comparison — not jurisdiction-specific legal advice. Re-verify against the Gazette of India and EUR-Lex before relying on anything here.

Checking data and algorithms (Indian law)

Law — every Data Fiduciary (DPDP Act, Section 8(3)). If personal data will be used to make a decision about someone, or shared with another Data Fiduciary, you must keep it complete, accurate and consistent.

Law — Significant Data Fiduciaries only (DPDP Rules, Rule 13(3)).Check that technical measures for processing personal data are not likely to risk people's rights. This includes algorithmic software and measures for hosting, displaying, uploading, modifying, publishing, transmitting, storing, updating or sharing data. Rule 13 starts under Rule 1(4); we use the main-duty planning date for planning.

These are Indian duties. GDPR and the EU AI Act are EU laws. They are not Indian law.

Official text — DPDP Act, 2023, Section 8(3)
(3) Where personal data processed by a Data Fiduciary is likely to be— (a) used to make a decision that affects the Data Principal; or (b) disclosed to another Data Fiduciary, the Data Fiduciary processing such personal data shall ensure its completeness, accuracy and consistency.
Official text — DPDP Rules, 2025, Rule 13(3)
(3) A Significant Data Fiduciary shall observe due diligence to verify that technical measures including algorithmic software adopted by it for hosting, display, uploading, modification, publishing, transmission, storage, updating or sharing of personal data processed by it are not likely to pose a risk to the rights of Data Principals.

How does this apply to you?

Take the 2-minute self-check to find out whether you're a Data Fiduciary, Data Processor, or both — with your personalised action checklist.

Take the DPDP Applicability Check

Your answers stay in your browser. If you choose "Email me this report", we send your email address and result type to our report service.