Data Privacy Across Borders: A Comparative Analysis of European Union and Indian Protection Laws

Abstract

Cross-border data protection frameworks increasingly shape global digital governance as privacy rights intersect with economic imperatives. This article examines the European Union’s General Data Protection Regulation (GDPR) and India’s Digital Personal Data Protection Act (DPDP Act) through comparative legal analysis, evaluating their distinct approaches to international data transfers and privacy safeguards. The GDPR establishes privacy as a fundamental right through extraterritorial application and stringent adequacy mechanisms, while India’s DPDP Act balances individual data protection with economic development objectives in one of the world’s fastest-growing digital markets. This study employs doctrinal methodology and comparative legal analysis to explore privacy within the international human rights framework, emphasising personal data sovereignty as essential to human dignity. Drawing on surveillance theory and analysing the GDPR’s adequacy mechanism against India’s data localisation and cross-border transfer provisions, the research reveals significant divergences in regulatory philosophy and enforcement mechanisms. The analysis demonstrates that India’s evolving engagement with global data protection standards positions it as a critical actor in developing harmonised international frameworks. The findings indicate that reconciling the EU’s rights-based approach with India’s development-oriented model requires adaptive governance structures that accommodate diverse regulatory contexts. This research contributes to understanding how divergent legal traditions can converge toward cooperative data governance, highlighting implications for international trade negotiations, digital sovereignty debates, and the architecture of future cross-border data transfer mechanisms that balance privacy protection with economic integration.