GDPR vs India's DPDP Act: Health Data Compliance

Two major privacy regimes

The EU's GDPR and India's Digital Personal Data Protection (DPDP) Act both govern how organisations handle personal data, including sensitive health information — but they take different approaches.

Key similarities

• Consent and lawful processing as a foundation.
• Data-subject/principal rights (access, correction, erasure).
• Accountability and security obligations.
• Cross-border transfer considerations.

Notable differences

• Special categories: GDPR explicitly classifies health data as a special category needing extra protection; DPDP treats personal data more uniformly but with strong consent requirements.
• Roles: GDPR uses controller/processor; DPDP uses Data Fiduciary/Data Processor and Data Principal.
• Transfers: GDPR relies on adequacy decisions and SCCs; DPDP allows transfers except to restricted jurisdictions.

Practical compliance

1. Map where health data flows.
2. Capture granular, revocable consent.
3. Honour data-principal/subject rights.
4. Use DPAs and appropriate transfer mechanisms.

Anxya Health's privacy practices account for GDPR, DPDP, CCPA and HIPAA. Informational only, not legal advice.