DPDP vs LGPD
Both are post-GDPR frameworks written by countries that watched Europe's rollout closely and then made their own calls. India narrowed the lawful-basis list down to consent plus a small set of legitimate uses. Brazil kept the full ten-basis GDPR structure. Downstream, that changes how the DPO obligation attaches, how the regulator is set up, and how the penalty is calculated. The differences that actually matter in a compliance programme are below.
01The quick answer
LGPD reads like a Brazilian adaptation of GDPR. DPDP reads like India took a more streamlined, purpose-limited path. Both apply extraterritorially.
LGPD gives you ten lawful bases including legitimate interests, requires a DPO regardless of size, and adds explicit data subject rights (portability, revision of automated decisions) that DPDP lacks. DPDP consolidates around consent and Sec. 7 legitimate uses, gives you the nomination right that LGPD lacks, and prescribes 22-language notice availability that LGPD does not.
02Ten differences, side by side
| Topic | DPDP Act 2023 (India) | LGPD (Brazil) |
|---|---|---|
| Data scope | Digital personal data only (Sec. 3). | All personal data, digital or physical (Art. 1). |
| Lawful bases | Consent (Sec. 6) plus Sec. 7 legitimate uses (State functions, medical emergency, employment, court orders, disaster). | Ten lawful bases (Art. 7): consent, compliance with legal obligation, public policies, research, contract, regular exercise of rights, protection of life, health protection, legitimate interest, credit protection. |
| Rights count | Four: access, correction and erasure, grievance, nomination (Sec. 11-14). | Nine (Art. 18): confirmation of processing, access, correction, anonymisation, portability, elimination, information about sharing, information about consent, revocation of consent. |
| Data portability | Not a stand-alone right. | Yes (Art. 18 V). Portability to another provider on consumer request. |
| Nomination | Yes (Sec. 14). Nominate a person to exercise rights on death or incapacity. | No direct equivalent. |
| Language | Notice available in English by default and in any of 22 Eighth Schedule languages on request (Rule 3). | Portuguese for Brazilian residents. No formal multi-language requirement. |
| DPO requirement | Mandatory only for designated Significant Data Fiduciaries (Rule 12). Others publish a Sec. 8(9) contact person. | Every Data Controller must appoint a DPO (encarregado). No size threshold. Micro-enterprises and startups have simplified requirements per ANPD resolutions. |
| Penalty design | Fixed rupee caps per breach. Up to Rs. 250 crore (~USD 30M) under the Schedule. | Up to 2 percent of Brazil turnover, capped at BRL 50 million (~USD 10M) per violation. Daily fines, public disclosure, and processing bans also available. |
| Regulator | Data Protection Board of India. Appeals to TDSAT. | Autoridade Nacional de Proteção de Dados (ANPD). Independent regulatory agency since 2025. Appeals through Brazilian federal courts. |
| Effective date | Phased. Some rules in force 13 Nov 2025. Substantive core from 14 May 2027. | In force since 18 September 2020. Administrative sanctions enforceable from 1 August 2021. |
03What carries across
If you built to LGPD first and now need to add DPDP, expect a partial reuse.
Carries across:
- Data mapping and inventory work
- Consent capture patterns (LGPD needs opt-in for many bases, similar to DPDP consent)
- Breach detection and internal response muscle
- DPO function (LGPD has DPO by default; DPDP wants it only for SDFs but the function is similar)
- Data Subject rights handling infrastructure
New for India:
- 22-language notice availability on request under Rule 3
- Sec. 14 nomination handling
- Rule 10 verifiable parental consent via DigiLocker
- Consent Manager registration path under Rule 4
- Sec. 8(9) grievance officer publication with Rule 3(b)(iii) link
- Sec. 33 penalty math is different: fixed rupee caps versus LGPD's 2 percent turnover cap
- No portability right in DPDP; if your LGPD stack offers it, keep offering it as a customer benefit