DPDPA, GDPR & CCPA compliance — global privacy compliance backed by legal expertise.

GDPR applies to any organisation that has an establishment in the EU, or processes personal data of EU data subjects in connection with offering goods or services to them, or monitoring their behaviour within the EU. If your SaaS product has EU users, if you market to EU residents, or if you process EU employee data, GDPR likely applies to you regardless of where your servers or company are located. We advise on applicability and compliance obligations.

DPDPA grants Data Principals four core statutory rights — access, correction and erasure, grievance redressal, and nomination — plus the ability to withdraw consent. It does not include a right to data portability and has no explicit, general right against solely automated decision-making, both of which GDPR provides. DPDPA also relies almost entirely on consent as its legal basis for processing, where GDPR recognises six separate lawful bases including legitimate interest and contractual necessity. Enforcement differs too: DPDPA uses the Data Protection Board of India, now active and hearing early matters, while GDPR uses supervisory authorities in each EU member state.

The DPDP Rules 2025 were notified on 14 November 2025 — they are not pending delegated legislation. The operative compliance deadline for most substantive obligations is 13 May 2027, which gives organisations a genuine transition window, but the rules themselves, including the Consent Manager framework, breach notification procedure, and Significant Data Fiduciary criteria, are finalised and published, not awaiting future rule-making.

This is one of the most complex questions in current privacy law. The GDPR right to erasure, and the DPDPA's erasure obligation under Section 12, both apply to personal data used in AI training. For data used in model weights, erasure may require model retraining or machine unlearning techniques, since the data is not stored in a directly deletable record the way a database row is. We advise on a risk-based approach — documenting consent at training time, maintaining training data records, and advising on technical and legal responses to erasure requests targeting AI training data.

No — an integrated programme is both possible and more effective. We start by mapping all processing activities and identifying the strictest applicable requirement in each area. The resulting programme typically satisfies all three frameworks with modest additional effort beyond the most demanding baseline. We build integrated documentation — a single privacy policy that satisfies all three frameworks, a single RoPA, and a unified data subject rights process.

No. Unlike GDPR, DPDPA does not grant a general right to data portability. If your product also has EU users, however, GDPR's portability right will still apply to that user segment, meaning a portability feature may be commercially or legally necessary regardless of DPDPA's narrower scope.