Skip to content
SecuriFii

Regulation · EU

GDPR Compliance

An Indian company can be caught by the GDPR without an office in Europe — directly, if it offers services to people in the EU or monitors them, or through the contracts its European customers sign. The obligations differ sharply between the two, and most of the expense of getting it wrong starts with not knowing which one applies.

Discuss this
Standard
Regulation (EU) 2016/679
Applies from
25 May 2018
Breach to regulator
72 hours
Upper fine tier
€20m or 4%
India adequacy
None

How the GDPR reaches an organisation outside the EU

The General Data Protection Regulation has applied since 25 May 2018. Article 3(2) extends it to a controller or processor not established in the Union where its processing relates to offering goods or services to people in the Union, whether or not they pay, or to monitoring their behaviour there. A company caught this way must, under Article 27, designate in writing a representative in the Union, unless a narrow exemption for occasional, low-risk processing applies.

Far more Indian firms meet the GDPR as processors, acting on a European customer’s documented instructions. Their duties arrive through the Article 28 contract: processing only on instructions, confidentiality, security under Article 32, controlled use of sub-processors, help with data subject requests and impact assessments, and deletion or return of the data at the end.

Either way, personal data moving from the EU to India is a restricted transfer. India has no adequacy decision from the European Commission, so transfers usually rely on Standard Contractual Clauses. The 2021 clauses are written for importers not themselves subject to the GDPR; for importers caught directly by Article 3(2), the Commission says it is still developing an additional set — which is worth knowing before you sign a transfer schedule.

What it will ask of you

Whichever route the GDPR takes to reach you, these are the artefacts a customer, or a supervisory authority, asks for first.

  • A role decision, per processing activity

    Where you are controller and where processor, written down activity by activity. It decides whether Article 3(2) and Article 27 apply at all, and what your contracts can honestly promise.

  • Records of processing activities

    Article 30 requires controllers and processors to keep written records and make them available to the supervisory authority on request. The exemption for organisations under 250 people falls away if processing is not occasional, is likely to result in a risk, or involves special category or criminal offence data.

  • Impact assessments where risk is high

    Under Article 35, a controller assesses high-risk processing before it starts — profiling with significant effects, large-scale special category data, systematic monitoring of public areas. Processors are contractually bound to help.

  • A breach process that beats the clock

    Controllers notify the supervisory authority without undue delay and where feasible within 72 hours of awareness; processors notify the controller without undue delay. Your contract will usually set a shorter figure than either.

Why organisations invest in it

  • European procurement asks for it: the data processing agreement, the transfer schedule and the security questionnaire arrive together.
  • Precise transfer answers — where data sits, who can reach it, what protects it — shorten every subsequent European sale.
  • Transfers sit in the GDPR’s upper fine tier, up to €20 million or 4% of worldwide turnover, above the processor obligations.
  • The same records and processes serve India’s DPDP Act, so one programme answers both regimes.

Not sure this is the standard you need?

Tell us what triggered the question — a customer, an auditor, a contract clause — and we will say which of these applies, including when the answer is none of them.

Ask a practitioner

Where we come in, and where we stop

Supervisory authorities enforce the GDPR. Certification under Article 42 is voluntary, is issued by an accredited certification body or a supervisory authority against approved criteria, and by the Regulation’s own words does not reduce your responsibility for compliance. We build the programme and the evidence. We do not certify, and we do not give legal opinions.

Ours

  • Scope analysis under Article 3, and the controller and processor determination per activity
  • Data mapping and Article 30 records of processing
  • DPIA method, templates and facilitated assessments
  • Article 28 terms reviewed for what they commit you to operationally
  • Breach detection, decision and notification procedures, and a rehearsal
  • Transfer documentation and the factual answers for a transfer impact assessment
  • Preparation for an Article 42 certification, where you choose to pursue one

Not ours

  • A legal opinion on whether you comply with the GDPR — that wants a lawyer
  • Acting as your Article 27 representative in the Union
  • Article 42 certification — an accredited certification body or a supervisory authority

How we build it

Questions of legal interpretation go to your counsel. Where you want certification, it is issued by an accredited certification body or a supervisory authority, never by us.

  1. 01Scope and role determinationWhether Article 3(2) reaches you, and where you are controller or processor for each processing activity. Everything downstream — representative, records, contracts — depends on this.
  2. 02Data mapping and recordsWhat personal data you hold, where it came from, where it flows and how long it stays — produced as Article 30 records rather than a one-off spreadsheet.
  3. 03Contracts and transfersArticle 28 terms read for the capabilities they promise, and transfer schedules answered precisely: location, access, compulsion risk and the technical measures that reduce it.
  4. 04Risk and impact assessmentA DPIA method applied where processing is high risk, at design time, with records kept — and the help a processor owes its controller made practical.
  5. 05Rights and breach handlingProcesses to find one person’s data across your systems, and an incident path that can meet your contractual notification window, rehearsed before it is needed.
  6. 06Evidence and reviewAn evidence pack a customer audit or regulator request can be answered from, and an internal review cycle to keep it current.

What you get from us

  • A written scope analysis and role determination per processing activity
  • Article 30 records of processing and data flow maps
  • A DPIA procedure, with completed assessments for high-risk processing
  • An operational reading of your Article 28 commitments, with gaps closed
  • Breach and data subject rights procedures, tested in a tabletop exercise
  • A reusable transfer questionnaire response pack

Common questions

Does the GDPR apply to an Indian company with no EU office?

It can. Directly under Article 3(2) if you offer goods or services to people in the EU or monitor their behaviour there; far more commonly through an Article 28 processor agreement with an EU customer, where obligations arrive by contract.

Do we need an EU representative?

Only if Article 3(2) applies to you, and then unless your processing is occasional, excludes large-scale special category or criminal data, and is unlikely to result in a risk to individuals. A processor working purely on an EU customer’s instructions is generally not within Article 3(2).

Is there such a thing as GDPR certification?

Yes, under Article 42 — voluntary, issued by an accredited certification body or a supervisory authority against approved criteria, and valid for up to three years. The EDPB keeps a public register of approved schemes. Article 42(4) is explicit that certification does not reduce your responsibility for compliance.

Can we receive EU personal data in India?

Yes, with a transfer mechanism. India has no adequacy decision, so transfers usually rely on Standard Contractual Clauses plus an assessment of the destination’s law and practice and any supplementary measures it calls for.

What are the maximum fines?

Up to €10 million or 2% of worldwide annual turnover for obligations including Articles 25 to 39, where processor duties and security sit; up to €20 million or 4% for principles, data subject rights and transfers to third countries. Whichever is higher applies in each tier.

Ready to scope it?

Send the date you are working to and roughly how large the organisation is. You will get a reply from a practitioner with an honest read on whether the date is reachable.

Start the conversation

Related services

All services

Related insights

All insights