A lot of founders who have spent time around global SaaS, or sell to customers outside India, have at least a passing sense of what a data protection notice-and-choice regime looks like. It is a reasonable starting instinct to assume India's Digital Personal Data Protection Act, 2023 is basically the same thing, translated. That assumption is where a lot of avoidable mistakes start.
This is not a legal opinion on the two laws, and it is not going to walk through GDPR's specific articles, because getting those details right requires a lawyer reading the actual text, not a blog post. What is worth doing here is naming the places where founders carry an assumption from one regime into the other, and the DPDP Act simply does not work that way.
"Notice and choice" is familiar, but the mechanics are India's own
Most global privacy regimes, including the one many product and growth teams already have some familiarity with, work on a general idea of telling people what happens to their data and getting their agreement to it. The DPDP Act shares that general shape. Where it diverges is in the specific roles, procedures, and enforcement structure the Act sets up, which are its own and were not simply copied from anywhere else.
One concrete example: the DPDP Act creates a defined role called a Consent Manager, a registered entity through which a person can give, manage, review, and withdraw consent across multiple data fiduciaries in one place. This is a specific, defined position under the Act, not a generic description of any app that collects consent. A Shopify compliance tool is not a Consent Manager under the Act, and nothing about running a store or a tool on it registers anyone as one. Founders who assume any consent-collecting software is automatically playing this role are assuming a formal status that has to be separately granted, not inferred from function.
The enforcement body is not a court, and it works case by case
The DPDP Act's enforcement runs through the Data Protection Board of India, which is not a court in the traditional sense and decides penalties case by case rather than through a fixed fine schedule triggered automatically. Section 33 of the Act sets the financial penalty framework. Multiple public sources confirm the penalty for failing to take reasonable security safeguards, a Section 8(5) obligation, can reach up to Rs 250 crore, and the Board can double that figure for repeat or grave breaches under Section 33(3). This is a real number worth knowing, stated plainly once, not as a threat: it describes the ceiling the Board can reach in a given case, not a bill that arrives automatically.
The compliance date is specific to this Act
The DPDP Act's obligations do not all land on day one. The product's own planning treats full Section 33 exposure as beginning 13 May 2027, meaning that is the point past which the obligations the Act created become enforceable against stores that have not acted. This kind of staged timeline, tied to India's own notification and rules process, is not something a founder can infer from how another country's law phased in its own obligations. It has to be read from what India's own notifications say.
Why the assumption is expensive, not harmless
None of this means the two regimes are unrelated in spirit. A business that already runs a reasonably clean notice-and-consent process for other markets is closer to ready than one starting from nothing. But closer is not the same as covered, and the specific mechanics, who counts as a Consent Manager, who decides penalties and how, when the clock actually starts, belong to the DPDP Act on its own terms. Treating it as a find-and-replace exercise on an existing privacy policy is usually where the gap first shows up.
Where this becomes concrete for a day-to-day store is simpler than the law itself: a privacy notice that actually names the real processors a store uses, a consent banner that logs answers as proof, and a place to receive and track shopper rights requests, which is what Consent Jet's four functions are built to do, inside the DPDP Act's own terms rather than anyone else's.