DPDP vs CCPA — Data Privacy Law Comparison India US

Quick Answer

The DPDP Act 2023 and California Consumer Privacy Act (CCPA) share a rights-based approach but differ significantly: the DPDP Act requires opt-in consent for processing while CCPA operates on an opt-out model. Both laws require privacy notices, data deletion rights, and restriction of sale of personal data. Indian companies with US operations must comply with both — understanding the differences prevents over-engineering or under-compliance.

Quick AnswerDPDP requires opt-in consent for all data processing; CCPA follows an opt-out model. DPDP applies to all organisations processing Indian citizen data; CCPA has revenue and data volume thresholds.

DPDP Compliance Checklist

Understand opt-in (DPDP) vs opt-out (CCPA) consent models — implement the stricter standard for shared data
Map which users are Indian residents (DPDP) vs California residents (CCPA) — different rights apply
Implement 'Do Not Sell or Share' (CCPA) + granular consent toggles (DPDP) in your preference centre
Review DSAR timelines: DPDP (response expected promptly) vs CCPA (45 days)
Ensure privacy policy covers both DPDP and CCPA rights in clear, accessible language
Review sale of data provisions — CCPA restricts sale; DPDP restricts sharing without consent
Implement unified data deletion workflow covering both DPDP and CCPA deletion rights
Train data teams on handling DSARs from both Indian and California residents
Conduct biannual review of both regulations — CPRA amendments continue to evolve
Consider unified privacy framework satisfying both laws — reduces operational complexity

Download Full Compliance Guide (Free)

Get the complete sector-specific checklist, risk areas, and 30-day action plan — delivered to your inbox.

Frequently Asked Questions

What are the key differences between DPDP and CCPA?+

DPDP uses opt-in consent; CCPA uses opt-out. CCPA has business thresholds ($25M revenue or 100K consumers); DPDP applies to all organisations. DPDP enforcement is by a government board; CCPA by California AG and a dedicated Privacy Protection Agency.

Does DPDP or CCPA apply to a US company serving Indian customers?+

DPDP applies to any organisation processing personal data of Indian residents, regardless of the company's location. A US company with Indian customers must comply with DPDP.

Can one privacy policy satisfy both DPDP and CCPA?+

A well-drafted combined privacy policy can address both, but must clearly state the rights available to each group and provide appropriate mechanisms (opt-in for India, opt-out for California).

Related DPDP Tools

DPDP Readiness Score Privacy Gap Analysis Vendor Risk Scorecard DPDP Maturity Assessment DPA Generator DPIA Builder

Quick Answer

DPDP vs CCPA comparison India California — Complete DPDP Compliance Guide

DPDP Compliance Checklist

Download Full Compliance Guide (Free)

Frequently Asked Questions

Related DPDP Tools

Need Expert DPDP Help?

The Sunday DPDP Brief