GDPR Compliance and European Data Protection

It does when the company offers goods or services to people in the European Union, paid or free, or monitors their behaviour there, for example through tracking and profiling on a website or app. Being based in India does not remove the obligation, because the GDPR follows the people whose data is processed rather than the location of the business. It also reaches Indian IT services and SaaS companies indirectly: when an EU client engages you to process personal data on its behalf, you act as a processor and the client must bind you to GDPR duties by contract. A company with no EU customers, users or clients, and no monitoring of people in the EU, is usually outside its scope. We confirm applicability during scoping by looking at your markets, websites, apps and client contracts rather than assuming either way.

Usually, yes, if the GDPR applies to you because you target or monitor people in the EU and you have no establishment there. Article 27 requires such controllers and processors to appoint a representative in one of the member states where the people concerned are, in writing, to act as a contact point for supervisory authorities and data subjects. There is a narrow exception for processing that is occasional, does not involve large-scale special category or criminal data, and is unlikely to create risk, but most businesses that actively sell into Europe do not fit it. The representative is not a data protection officer and does not take on your liability. We assess whether the exception applies to you, and if not, help you define the representative's role and the records they need access to, so enquiries are answered within the time the law expects.

The European Commission has not issued an adequacy decision for India, so personal data leaving the EU for India needs another transfer tool. For most businesses that means the Standard Contractual Clauses adopted in June 2021, choosing the module that matches the relationship, such as controller to processor, together with a transfer impact assessment. That assessment looks at the law and practice in India that could affect the data and records the supplementary measures you use, such as encryption, access controls and pseudonymisation. Binding corporate rules are an option for large groups but take longer to approve. The same analysis applies to onward transfers to your own sub-processors. We map every flow of EU data into India and beyond, put the right clauses in place with clients and vendors, and document the assessment so it stands up when a client or authority asks for it.

As a processor you handle personal data only on your client's documented instructions, and Article 28 requires a written contract setting out the subject matter, duration, purpose and type of data, plus your obligations. Those include confidentiality commitments for your staff, appropriate security measures, engaging sub-processors only with the controller's authorisation and on equivalent terms, helping the controller respond to data subject requests and carry out impact assessments, deleting or returning data at the end of the service, and making available the information needed to show compliance, including allowing audits. You must also notify the controller of a personal data breach without undue delay and keep records of processing for your clients. Processors can be fined directly. We review your client contracts, build the processes behind each clause and prepare the evidence EU clients ask for during vendor assessments.

A controller must notify the competent supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of a breach, unless it is unlikely to result in a risk to people's rights and freedoms. If notification comes later, the reasons for the delay must be given. Where the breach is likely to result in a high risk, the affected individuals must also be told without undue delay. A processor must inform its controller without undue delay after becoming aware, which in practice means within the few hours your contracts usually specify. Every breach, reportable or not, has to be documented. The 72-hour clock is short enough that decisions made during an incident decide compliance, so we build a breach procedure with clear roles, an assessment template and prepared notification drafts, and rehearse it before it is needed.

Largely, yes, with care over the differences. Both laws expect you to know what personal data you hold and why, give clear notices, respect individuals' rights, secure the data, manage processors and handle breaches, so one data inventory, one records system, one rights process and one incident procedure can serve both. The differences matter, though. The DPDP Act relies mainly on consent and a short list of legitimate uses and has no general legitimate interests basis, its notice and consent rules are specific, it treats children's data differently, and its breach intimation follows the DPDP Rules, 2025 rather than the 72-hour GDPR standard. Most DPDP Act duties apply from 13 May 2027. We build a shared control set and document where each law needs its own handling, so neither programme is copied blindly from the other.

For most mid-sized Indian companies, two to four months to reach a defensible position, following our phases. Data mapping and lawful basis analysis take two to three weeks, the gap assessment two to three, rights and consent processes three to four, records and impact assessments two to four, and transfers and breach readiness two to three, with a readiness review at the end. A processor serving a handful of EU clients with well-defined services moves faster than a consumer business with many products, apps and marketing tools. What stretches the timeline is usually data mapping, because personal data turns up in analytics, support tools, spreadsheets and backups nobody listed, and contract remediation, because client and vendor agreements take time to renegotiate. We commit to a timeline after the gap assessment, once the number of processing activities and contracts is known.

We do not publish a figure for GDPR work, because the scope varies too much for a range to be useful. A processor with a few EU clients and a single platform needs a fraction of the work a consumer company with EU-facing apps, marketing and analytics does. The quote depends on the number of processing activities and systems, whether you act as controller, processor or both, how many client and vendor contracts need Standard Contractual Clauses or processor terms, whether impact assessments are required, and how much documentation already exists. Some costs sit outside our fee: an EU representative service if you need one, legal review in a member state where specific local advice is required, and your own team's time. If you are also preparing for the DPDP Act, combining the two lowers the total. We scope first, then give a fixed price in writing.