SEPTEMBER - ARTICLE

Legal Basis Under GDPR vs. DPDP Act, 2023: Understanding the Fundamental Difference

Privacy compliance professionals often use the term “legal basis” when determining whether an organisation can lawfully process personal data. While this concept is central to the EU General Data Protection Regulation (GDPR), it is important to recognise that the Digital Personal Data Protection Act, 2023 (DPDP Act) follows a different statutory architecture.

At first glance, the two frameworks appear similar. Both regulate the processing of personal data, impose obligations on organisations, protect individuals, and recognise consent as an important mechanism for lawful processing. However, the way lawful processing is established is fundamentally different.

GDPR: A Multi-Basis Model

Under Article 6 of the GDPR, processing of personal data must generally be supported by one of six recognised legal bases:

• Consent
• Contractual necessity
• Legal obligation
• Vital interests
• Public task
• Legitimate interests

These are independent legal bases. An organisation therefore evaluates each processing activity and determines which basis makes the processing lawful.

For example, processing employee information to fulfil an employment contract may rely on Article 6(1)(b). Processing information to comply with a statutory obligation may rely on Article 6(1)(c). Certain business activities may potentially rely on legitimate interests under Article 6(1)(f), subject to the applicable requirements and balancing considerations.

Consequently, “legal basis” becomes a fundamental field in GDPR privacy governance, RoPA, data inventories and compliance assessments.

DPDP Act: A Different Architecture

The DPDP Act does not reproduce this six-category GDPR framework. Instead, its statutory structure principally revolves around two routes for lawful processing:

Consent under Section 6, and certain legitimate uses under Section 7.

Section 6 establishes the requirements for valid consent, including that consent must be free, specific, informed, unconditional and unambiguous, and capable of being demonstrated by the Data Fiduciary.

Section 7 identifies specific circumstances in which personal data may be processed as a legitimate use.

This distinction is important because the expression “legitimate use” under DPDP should not automatically be treated as equivalent to “legitimate interests” under GDPR Article 6(1)(f). GDPR legitimate interests form a broad legal basis that involves assessing the organisation’s legitimate interest, necessity and the rights and interests of the individual. DPDP Section 7 instead provides for specified statutory circumstances.

Why This Matters

Organisations implementing DPDP compliance should therefore avoid simply copying a GDPR legal-basis dropdown containing:

Consent / Contract / Legal Obligation / Legitimate Interest / Vital Interest / Public Task.

Such a model can incorrectly imply that these are all independent legal bases under Indian law.

A more appropriate DPDP compliance model would capture:

Processing Activity → Purpose → Consent or Applicable Legitimate Use → Specific DPDP Provision → Supporting Evidence

For example, instead of recording merely “Legitimate Interest”, a DPDP system should identify the applicable Section 7 provision and the circumstances supporting its use.

Conclusion

The difference between GDPR and DPDP is therefore more than terminology. GDPR uses a broad, multi-basis model of lawfulness, while DPDP adopts a different statutory structure centred on consent and specified legitimate uses.

For privacy management platforms, RoPA systems and compliance frameworks, this distinction is critical. DPDP should not be treated as a GDPR framework with different section numbers. Organisations should design their Indian privacy governance around the specific lawful grounds and statutory provisions of the DPDP Act, supported by appropriate evidence and documentation.