If your business operates across borders – or even just runs ads that reach people in different countries – you’re likely dealing with more than one data protection law at once, whether you’ve mapped that out or not. Here’s a straightforward comparison of the three frameworks most businesses run into: GDPR, India’s DPDP Act, and the EU AI Act.
GDPR (European Union) – The Original Benchmark
In force since 2018, GDPR set the template that most later data protection laws borrow from. Its core principles: explicit consent for data collection, purpose limitation (only use data for what you said you’d use it for), the right to access and delete personal data, and mandatory breach notification. It applies to any business processing the personal data of people in the EU, regardless of where that business is based – a single newsletter signup from an EU visitor is enough to bring GDPR into play.
India’s DPDP Act – GDPR’s Younger, Stricter-in-Places Cousin
India’s Digital Personal Data Protection Act, with Rules now in phased rollout through 2027, borrows GDPR’s consent-first approach but diverges in some notable ways. It has no separate category for “sensitive” data the way GDPR does. Its children’s data threshold is a uniform 18 years old – stricter than most global frameworks. And unlike GDPR, breach notification is required regardless of how minor the breach is. Critically: being GDPR-compliant does not automatically mean you’re DPDP-compliant. The two frameworks need to be checked separately.
The EU AI Act – The New One Most Businesses Haven’t Mapped Yet
Unlike GDPR and DPDP, which govern personal data generally, the EU AI Act specifically governs how AI systems are built and used. For most marketing use cases, the relevant piece is the transparency obligations under Article 50, becoming enforceable from August 2026: AI-generated content needs to be identifiable, and chatbot interactions need to be disclosed. Like GDPR, it applies extraterritorially – if your AI-driven campaigns reach EU audiences, the rules apply regardless of where your business sits.
Side by Side
- What they govern: GDPR and DPDP – personal data generally. EU AI Act – specifically AI systems and AI-generated content.
- Who it applies to: All three apply based on whose data is affected or where AI output reaches, not where your business is registered.
- Consent model: GDPR and DPDP both require clear, informed consent, but DPDP’s is stricter on children’s data and breach notification.
- Penalties: All three carry serious financial penalties – GDPR up to 4% of global turnover, DPDP up to \u20b9250 crore per violation, EU AI Act up to 7% of global turnover for the most serious violations.
What This Means Practically
Most businesses don’t need a legal department to handle this – they need marketing and data practices that are built around consent, transparency, and documentation from the start, rather than compliance bolted on after the fact. A campaign that’s honest about data collection, clear about AI use, and careful with what it does with customer information tends to clear the bar on all three frameworks at once, because the underlying principle – treat people’s data like it matters – is the same across all of them.
The businesses that will struggle are the ones treating each new law as a separate fire to put out. The ones that will be fine are the ones who built good data habits once and just keep applying them as the map of regulations keeps growing.