DPDP Act VS DPDP vs CCPA: Key Differences

Different Rules for Consent

DPDP uses an opt-in model where you must get clear permission before you collect any personal data. CCPA uses an opt-out model for most data. This means California law allows you to collect data first, but you must give users a way to stop the sale or sharing of that data later. Your website banners for California users will need a different flow than the ones used for Indian residents.

Who the Laws Protect

DPDP covers all digital personal data of Indian residents. CCPA only protects California residents. CCPA also has a revenue rule and mostly applies to businesses making over $25 million or those buying and selling data of 50,000 or more people. DPDP applies to almost any business handling digital data in India. If you are an Indian startup, you might be exempt from CCPA but you are likely covered by DPDP.

Specific Data Categories

CCPA lists specific types of sensitive information like social security numbers, precise location, or genetic data. It gives users a specific right to limit how you use this sensitive data. DPDP does not currently have a separate category for sensitive data with different rules. It treats all personal data under the same consent framework until the government issues further rules.

Feature	DPDP Act 2023	CCPA (California)
Main Model	Opt-in (Consent first)	Opt-out (Right to stop)
Target	Indian residents	California residents
Business Size	Any size handling digital data	Revenue or data thresholds
Right to Delete	Included	Included
Right to Opt-out	Not applicable (uses consent)	Explicit right to stop sale/share
Employee Data	Covered	Covered
Notice Requirement	Mandatory at collection	Mandatory at collection

This week

Review your website’s data collection forms and cookie banners. Check if you use a single “I Agree” button for all users. If you have California customers, you must add a “Do Not Sell or Share My Personal Information” link for them, while keeping the mandatory consent checkbox for your Indian users.

FAQ

Q: Can I use the same privacy policy for both laws? A: No. CCPA requires specific sections like “Do Not Sell My Personal Information” and disclosure of financial incentives. DPDP requires details about the Data Protection Officer and specific consent notices for Indian residents.

Q: Does DPDP have a revenue limit like CCPA? A: No. DPDP applies to any Data Fiduciary processing digital personal data in India regardless of turnover. CCPA generally only applies to businesses with over $25 million in revenue or those meeting specific data volume thresholds.

Q: Do both laws require a Data Protection Officer? A: DPDP requires a DPO for Significant Data Fiduciaries. CCPA does not strictly require a person with that specific title, but you must designate a contact point for consumers to exercise their data rights.