GDPR Compliance for Indian Companies — Complete 2026 Guide

Does GDPR Apply to Your Indian Company? The Definitive Answer

The most common misconception among Indian founders, CIOs, and legal teams: “We’re an Indian company, so GDPR doesn’t apply to us.” This is wrong — and increasingly expensive to get wrong.

GDPR’s extraterritorial reach is defined by Article 3. It applies to any organisation that:

• Article 3(1): Has an establishment in the EU (even a single sales office or subsidiary), or
• Article 3(2)(a): Offers goods or services to EU residents — whether or not payment is involved, or
• Article 3(2)(b): Monitors the behaviour of EU residents (analytics, tracking, profiling).

If your Indian company develops software for an EU client, processes EU employee payroll, runs a SaaS product used by EU subscribers, provides BPO services involving EU customer data, or operates a website targeting EU users — GDPR applies to you.

India Does Not Have EU Adequacy — What This Means

When the EU transfers personal data to a third country, it requires either: (a) an adequacy decision confirming the country’s data protection laws are equivalent to GDPR, or (b) appropriate safeguards such as Standard Contractual Clauses (SCCs). As of June 2026, India does not have an EU adequacy decision.

This means every transfer of EU personal data to India — by an EU client sending data to its Indian IT vendor, an EU company using an Indian SaaS platform, or an EU employer transferring employee data to an Indian HR system — requires an appropriate transfer mechanism. The most widely used mechanism for Indian companies is the 2021 Standard Contractual Clauses issued by the European Commission.

Analysts and regulators expect a formal EU adequacy assessment of India to begin sometime in 2026–2027, informed by the DPDP Act 2023 implementation and the independence of the Data Protection Board of India. Until then, SCCs remain the mandatory route.

Standard Contractual Clauses (SCCs) — What Indian Companies Must Know

The 2021 SCCs (Commission Implementing Decision 2021/914) replaced the older 2001 and 2010 SCCs and are the only valid transfer mechanism for contract-based data transfers as of December 2022. They come in four modules:

Module	Use Case	Typical Indian Scenario
Module 1 (C2C)	Controller to Controller	EU company shares customer data with Indian analytics firm
Module 2 (C2P)	Controller to Processor	EU client instructs Indian IT vendor to process its data (most common)
Module 3 (P2P)	Processor to Processor	Indian IT vendor sub-processes to another Indian sub-contractor
Module 4 (P2C)	Processor to Controller	Indian company returns processed data to an EU company

Transfer Impact Assessment (TIA): Following the Schrems II ruling (C-311/18, 2020), SCCs alone are insufficient if the receiving country’s legal framework undermines SCC protections. Indian companies must conduct a TIA evaluating Indian surveillance laws (Telegraph Act, IT Act Section 69) and government data access rights, and implement supplementary measures (end-to-end encryption, pseudonymisation, contractual restrictions on government disclosure) where necessary.

Key GDPR Obligations for Indian Processors and Controllers

1. Record of Processing Activities (Article 30)

Every organisation with 250+ employees, or that processes data likely to result in high risk, must maintain a RoPA documenting: processing purposes, data categories, data subject categories, recipients, transfers, retention periods, and security measures. Indian IT and BPO companies almost always trigger this requirement. The RoPA must be available to the supervisory authority on request.

2. Data Subject Rights (Articles 15–22)

EU data subjects have enforceable rights that your systems and processes must be able to satisfy: Right of access (Article 15) — respond within 1 month; Right to erasure / right to be forgotten (Article 17); Right to data portability (Article 20) — provide data in machine-readable format; Right to object to automated decision-making (Article 22). As a processor, you must be able to support your EU controller in fulfilling these rights — build the workflows before you sign the SCC, not after.

3. Breach Notification (Articles 33–34)

Personal data breaches must be notified to the relevant EU supervisory authority within 72 hours of the controller becoming aware (Article 33). If the breach is likely to result in high risk to data subjects, they must be notified directly (Article 34). As an Indian processor, you must notify your EU controller “without undue delay” upon becoming aware — your contract must specify a shorter timeline (typically 24–36 hours) to allow the controller to meet the 72-hour deadline.

4. Data Protection Impact Assessment (Article 35)

A DPIA is mandatory before processing that is “likely to result in a high risk” to data subjects — including systematic profiling, large-scale processing of special category data, and systematic monitoring of publicly accessible areas. Indian healthtech, fintech, and adtech companies processing EU data commonly trigger this requirement. A DPIA must identify risks and document risk-reduction measures.

5. Data Protection Officer (Article 37)

Mandatory when: (a) processing is carried out by a public authority, (b) core activities involve large-scale, systematic monitoring, or (c) core activities involve large-scale special category data. Many Indian BPOs, healthtech companies, and HR software vendors trigger this. A DPO can be an employee or an external service provider — they must have expert knowledge of data protection law and operate independently.

GDPR vs DPDP Act — Key Differences Indian Companies Must Understand

Dimension	GDPR	DPDP Act 2023
Legal bases for processing	6 lawful bases (consent, contract, legal obligation, vital interest, public task, legitimate interest)	Primarily consent-based; legitimate use for specific purposes (Section 7)
Data subject rights	8 rights including portability, restriction, objection, automated decision-making	4 rights: access, correction, erasure, nomination (Section 12–14)
DPIA requirement	Mandatory for high-risk processing (Article 35)	Annual DPIA for Significant Data Fiduciaries only (Rule 12)
Data breach notification	72 hours to supervisory authority, no materiality threshold	72 hours to DPBI, no materiality threshold (Section 8(6), Rule 7)
Cross-border data transfers	Adequacy decision or SCCs required	Whitelisted countries; restrictions apply (Section 16)
Maximum penalty	EUR 20 million or 4% global turnover	Rs 250 crore per instance; up to Rs 250 crore cumulative

Bottom line: GDPR compliance does not automatically mean DPDP Act compliance, and vice versa. Indian companies serving both Indian and EU data subjects must build a dual-compliance programme — or use a unified framework (ISO 27001 + ISO 27701) that satisfies both.

GDPR Penalties — What Indian Companies Are at Risk Of

GDPR enforcement is active, cross-border, and escalating. Key enforcement decisions affecting non-EU companies include Meta’s EUR 1.2 billion fine (2023, Irish DPC), Amazon’s EUR 746 million fine (2021, Luxembourg CNPD), and WhatsApp’s EUR 225 million fine (2021). EU supervisory authorities have confirmed jurisdiction over non-EU companies offering services to EU data subjects.

Indian companies face the same penalty tiers: Tier 1 (up to EUR 20M or 4% global turnover): unlawful processing, consent violations, cross-border transfer failures, breach of data subject rights. Tier 2 (up to EUR 10M or 2% global turnover): failure to maintain RoPA, no DPO where required, inadequate security measures, notification failures.

Practical GDPR Compliance Roadmap for Indian Companies

1. Week 1–2 — Scoping: Confirm GDPR applicability. Identify all EU personal data flows (inbound and outbound). Map your role — controller or processor — for each flow.
2. Week 3–4 — Data Mapping: Build your RoPA. Identify processing purposes, legal bases, retention periods, and third-party recipients for each data category.
3. Week 5–6 — Contract Review: Audit all contracts with EU clients and partners for GDPR-compliant DPA clauses and SCCs. Execute updated SCCs where missing.
4. Week 7–8 — TIA: Conduct Transfer Impact Assessment for each EU-to-India data flow. Document supplementary measures.
5. Week 9–10 — Rights and Breach Procedures: Build data subject rights workflows. Draft and test breach notification procedures (to EU controller within 36 hours).
6. Week 11–12 — DPO and Representative: Assess DPO requirement. Designate EU representative if required under Article 27.
7. Month 4+ — Ongoing: Annual RoPA review, training refresh, DPIA for new high-risk processing, surveillance audit of SCC compliance.