Cross-Border Data Protection: Comparative Analysis of GDPR and India's DPDP Act

Abstract

The General Data Protection Regulation 2016 and India's Digital Personal Data Protection Act 2023 represent two of the most consequential data-protection instruments globally. They share structural commitments to individual rights, principles-based processing, and accountability-based compliance, while differing in material respects on cross-border transfer mechanisms, sensitive-data classification, public-authority exemptions, regulator independence, and enforcement architecture. This paper offers a comparative doctrinal analysis of the two regimes with particular attention to cross-border data transfers, a site of sustained regulatory innovation since the 2020 Schrems II decision invalidated the EU-US Privacy Shield. It examines the GDPR's Chapter V mechanisms adequacy decisions, standard contractual clauses, binding corporate rules, and derogations—and the DPDP Act's section 16 notified-jurisdictions framework. The paper argues that India's post-2023 position is converging with European practice but retains structural differences in the public-authority and government-access domains that complicate the prospect of a reciprocal adequacy arrangement. It proposes calibrated reforms to support interoperability.