DATA PRIVACY IN FINTECH: GDPR VS. INDIA'S DPDP ACT — A COMPARATIVE ANALYSIS

Authors

  • Mr. Sangmesh Ainapur Asst Prof., Dept. of MBA, Lingaraj Appa Engineering College, Bidar
  • Shradha Andur Student, Department of Master of Business Administration, Guru Nanak Dev Engineering College, Bidar, Karnataka, India
  • Shradha K Student, Department of Master of Business Administration, Guru Nanak Dev Engineering College, Bidar, Karnataka, India

Keywords:

GDPR, DPDP Act, Data Privacy, FinTech, Personal Data Protection, Regulatory Compliance, Data Localisation, Consent Framework, Cross-Border Data Transfer, Financial Technology, India, European Union, Data Fiduciary, Right to Erasure, Algorithmic Accountability

Abstract

The rapid growth of FinTech has changed the way people use financial services, while also increasing concerns about data privacy and security. This study compares the European Union’s GDPR and India’s Digital Personal Data Protection (DPDP) Act in the context of FinTech operations. Using data from legal documents, regulatory reports, and academic studies from 2016–2024, the article examines key areas such as consent, data processing, compliance requirements, enforcement, and cross-border data transfer. The study finds that although both laws focus on protecting personal data, the GDPR follows a stricter rights-based approach, whereas India’s DPDP Act takes a more flexible and sovereignty-focused approach. The paper also highlights the compliance challenges faced by FinTech firms operating in both regions and suggests policy recommendations for better alignment with global data protection standards.

References

I. Albrecht, J. P. (2016). How the GDPR will change the world. European Data Protection Law Review, 2(3), 287–289.

II. Arner, D. W., Barberis, J., & Buckley, R. P. (2016). FinTech, RegTech, and the reconceptualization of financial regulation. Northwestern Journal of International Law & Business, 37(3), 371–413.

III. Bhatia, G., & Kak, A. (2020). The Personal Data Protection Bill, 2019: A comparative analysis. IT for Change Working Paper. Bengaluru: IT for Change.

IV. Chander, A., & Lê, U. P. (2015). Data nationalism. Emory Law Journal, 64(3), 677–739.

V. Cranston, R. (2018). GDPR compliance costs for FinTech startups: An empirical assessment. Journal of Financial Regulation, 4(2), 211–234.

VI. European Data Protection Board (EDPB). (2024). Annual report 2023. Brussels: EDPB.

VII. Financial Stability Board (FSB). (2019). FinTech and market structure in financial services. Basel: FSB.

VIII. Goodman, B., & Flaxman, S. (2017). European Union regulations on algorithmic decision making and a 'right to explanation.' AI Magazine, 38(3), 50–57.

IX. Greenleaf, G. (2022). India's DPDP Act 2023 in global context: A complex hybrid. Privacy Laws & Business International Report, 185, 1–7.

X. International Association of Privacy Professionals (IAPP). (2020). GDPR three years later: Compliance benchmarking survey. Portsmouth, NH: IAPP.

XI. Joshi, P., & Kaul, A. (2023). Data localisation under India's DPDP Act: Implications for cross border FinTech. National Law School of India Review, 35(1), 45–68.

XII. Kuner, C., Svantesson, D. J. B., Cate, F. H., Lynskey, O., & Millard, C. (2020). GDPR: Two years on. International Data Privacy Law, 10(2), 83–85.

XIII. Parsheera, S. (2023). India's Digital Personal Data Protection Act 2023: An analysis. NIPFP Working Paper Series No. 402. New Delhi: National Institute of Public Finance and Policy.

XIV. Solove, D. J. (2006). A taxonomy of privacy. University of Pennsylvania Law Review, 154(3), 477–560.

XV. Supreme Court of India. (2017). Justice K.S. Puttaswamy (Retd.) v. Union of India, (2017) 10 SCC 1.

XVI. Voigt, P., & von dem Bussche, A. (2017). The EU General Data Protection Regulation (GDPR): A practical guide. Cham: Springer.

XVII. Wachter, S., Mittelstadt, B., & Russell, C. (2017). Counterfactual explanations without opening the black box: Automated decisions and the GDPR. Harvard Journal of Law & Technology, 31(2), 841–887.

XVIII. Westin, A. F. (1967). Privacy and freedom. New York: Atheneum.

XIX. World Economic Forum (WEF). (2020). Data free flow with trust (DFFT): Paths towards free and trusted data flows. Geneva: WEF.

XX. Zetzsche, D. A., Buckley, R. P., Arner, D. W., & Barberis, J. N. (2017). From FinTech to TechFin: The regulatory challenges of data-driven finance. New York University Journal of Law and Business, 14(2), 393–446.

Additional Files

Published

01-06-2026

How to Cite

Mr. Sangmesh Ainapur, Shradha Andur, & Shradha K. (2026). DATA PRIVACY IN FINTECH: GDPR VS. INDIA’S DPDP ACT — A COMPARATIVE ANALYSIS. International Educational Journal of Science and Engineering, 9(05), 588–593. Retrieved from https://iejse.com/journals/index.php/iejse/article/view/396

Issue

Vol. 9 No. 05 (2026): SPECIAL ISSUE MAY - NATIONAL CONFERENCE ON EMERGING TRENDS IN ENGINEERING, TECHNOLOGY AND MANAGEMENT

Section

Articles

License

Copyright (c) 2026 International Educational Journal of Science and Engineering

Creative Commons License

This work is licensed under a Creative Commons Attribution 4.0 International License.