Regulation (EU) 2016/679 · Data protection law · European Union
What is the GDPR?
The General Data Protection Regulation is the European Union's data protection law, applied since 25 May 2018. It binds organisations established in the EU and those outside it, including Indian companies, that offer goods or services to people in the EU or monitor their behaviour. Fines reach EUR 20 million or 4 percent of worldwide turnover, whichever is higher.
Sources: Regulation (EU) 2016/679 (General Data Protection Regulation), EUR-Lex; Regulation (EU) 2016/679, full text (CELEX 32016R0679), EUR-Lex; Guidelines 3/2018 on the territorial scope of the GDPR (Article 3), version adopted after public consultation, EDPB; Adequacy decisions, European Commission
Key facts
| Who made it, who enforces it | Adopted by the European Parliament and the Council on 27 April 2016. Enforced by the national supervisory authority of each EU member state (and the EEA states), coordinated by the European Data Protection Board. India has no supervisory authority under the GDPR; an Indian company deals with the authority of the member state where its representative, customers or data subjects are |
|---|---|
| Dates | Adopted 27 April 2016. Entered into force 24 May 2016. Applies from 25 May 2018 (Art. 99(2)) |
| Structure | 99 Articles in 11 Chapters, preceded by 173 recitals. The chapters that matter most to an Indian company are II (principles), III (rights of the data subject), IV (controller and processor), V (transfers to third countries) and VIII (remedies, liability and penalties) |
| When it applies to an Indian company | Directly, under Art. 3(2), when you process the personal data of people in the EU and the processing relates to "the offering of goods or services, irrespective of whether a payment of the data subject is required" to them, or to "the monitoring of their behaviour as far as their behaviour takes place within the Union". Contractually, under Art. 28, when you process data on behalf of an EU controller, which binds you to the processor duties through the data processing agreement. The EDPB's Guidelines 3/2018 explain both routes |
| What is mandatory | A lawful basis for every processing purpose (Art. 6), privacy notices (Arts. 13 and 14), handling of data subject rights (Arts. 15 to 22), a written processor contract (Art. 28), records of processing (Art. 30), security appropriate to the risk (Art. 32), breach notification to the supervisory authority within 72 hours where feasible (Art. 33), data protection impact assessments for high-risk processing (Art. 35), a data protection officer in the cases Art. 37 lists, and, for a company outside the EU caught by Art. 3(2), a representative in the EU (Art. 27) unless an exemption applies |
| Transfers to India | The European Commission has not adopted an adequacy decision for India, so personal data sent from the EU to an Indian company needs a Chapter V safeguard: most often the Commission's standard contractual clauses (Art. 46(2)(c)), with a transfer impact assessment, or binding corporate rules for intra-group transfers (Art. 47) |
| Penalties | Two tiers. Art. 83(4): up to EUR 10 million or 2 percent of total worldwide annual turnover of the preceding financial year, whichever is higher, for breaches of controller and processor duties such as Arts. 25 to 39. Art. 83(5): up to EUR 20 million or 4 percent, for breaches of the principles, lawful basis, data subject rights and transfer rules. Supervisory authorities can also order processing to stop (Art. 58) |
| Certificate or audit | None required. Art. 42 allows certification mechanisms approved by a supervisory authority or the EDPB; an ISO 27001 or ISO 27701 certificate is not one of them. EU controllers audit their Indian processors under the contract (Art. 28(3)(h)), and supervisory authorities can investigate directly |
| Cost in India | Not published yet. Infofacility will post an Indian price range, with what it covers, once it has three comparable quotes. |
| Pairs with | The DPDP Act 2023 (India's law, with different definitions, a closed list of "certain legitimate uses" in s. 7 instead of an open legitimate-interests basis, and its own breach rule), ISO 27701 for the management system, SOC 2's privacy category for US customers, and the CCPA for California |
Who needs it
- An Indian company meets the GDPR in one of two ways. Directly, when it sells to or tracks people in the EU: a SaaS product with EU users, an app in EU app stores, an e-commerce site shipping to Europe, a website that profiles EU visitors. Then Art. 3(2) applies to you as a controller, with the full set of duties and, in most cases, an EU representative under Art. 27. Indirectly, when it processes data for an EU customer: IT services, BPO, analytics, support, payroll. Then your customer is the controller, you are a processor, and the data processing agreement under Art. 28 passes the processor duties and the transfer safeguards to you.
- The second route is far more common in India, and it is where most GDPR work in Indian companies happens: negotiating Art. 28 clauses and standard contractual clauses, running transfer impact assessments, answering the customer's due-diligence questionnaire, supporting their data subject requests and reporting incidents inside the customer's 72-hour window. Indian subsidiaries of EU groups sit in both camps, as processors for the parent and sometimes as controllers for their own staff and local customers.
- The GDPR is not India's law. The DPDP Act 2023 governs personal data in India, and the two differ in definitions, lawful bases, breach timelines and penalties. A company that complies with the GDPR has most of the machinery the DPDP Act will need, but not all of it; Infofacility's comparison lists the differences clause by clause.
How it works
Step 1
Work out whether and how it applies
List your EU-facing products and your EU customers. For each, decide whether you are a controller under Art. 3(2), a processor under Art. 28, or both. The answer sets everything that follows.
Step 2
Map the personal data and its flows
What you hold about people in the EU, where it came from, why, where it sits, who sees it and where it goes. This becomes your Art. 30 record of processing.
Step 3
Fix the legal basis and the paperwork
A lawful basis for each purpose (Art. 6), privacy notices (Arts. 13 and 14), a data processing agreement for each customer or vendor (Art. 28), and standard contractual clauses with a transfer impact assessment for every flow from the EU to India (Art. 46).
Step 4
Appoint the people the law names
An EU representative under Art. 27 if Art. 3(2) catches you and no exemption applies; a data protection officer under Art. 37 if your core activities involve large-scale regular monitoring or special-category data.
Step 5
Build the processes
Data subject requests answered within a month (Art. 12(3)), breach detection and notification within 72 hours (Art. 33) and to affected people where the risk is high (Art. 34), and a DPIA before high-risk processing (Art. 35).
Step 6
Secure the data and prove it
Measures appropriate to the risk (Art. 32): encryption, access control, logging, vendor management. An ISO 27001 or ISO 27701 certificate is the usual evidence an EU customer asks for, though neither is required by the Regulation.
Step 7
Keep records and review
Accountability (Art. 5(2)) means being able to show compliance, not just claim it. Review the data map, the contracts and the risk assessments when products, vendors or countries change.
Get there with Infofacility
GRC · Infofacility service
GDPR and CCPA compliance
Records, notices, contracts and rights handling for selling into the EU and California. 6 to 10 weeks.
Request a callbackQuestions
Does the GDPR apply to an Indian company with no office in the EU?
Yes, if Art. 3(2) is met: you offer goods or services to people in the EU, whether or not they pay, or you monitor their behaviour there. Having EU users of a product, shipping to EU addresses or tracking EU visitors for advertising all count. Processing data only for an EU customer, as a processor, binds you through the Art. 28 contract and may also trigger Art. 3(2) in its own right; the EDPB's Guidelines 3/2018 work through the cases.
Does India have an adequacy decision?
No. As of this review the European Commission's list of adequate countries does not include India, so every transfer of personal data from the EU to India needs a Chapter V safeguard, most often the Commission's standard contractual clauses under Art. 46(2)(c) together with a transfer impact assessment. The DPDP Act 2023 has not changed this.
Can an Indian company be fined under the GDPR?
Yes. Art. 83 applies to any controller or processor within the Regulation's scope, and the EU representative under Art. 27 is the point of contact for enforcement. In practice, supervisory authorities have focused on companies with an EU presence, and the more immediate consequence for an Indian processor is contractual: an EU customer who cannot show a compliant processor must stop the transfer.
Is GDPR compliance the same as DPDP compliance?
No. They overlap in structure (notice, purpose, security, breach, rights) but differ in detail: the DPDP Act replaces the GDPR's open legitimate-interests basis with a closed list of "certain legitimate uses" in s. 7, has its own definitions of data fiduciary and data principal, its own breach notification rule and a penalty schedule in rupees. A GDPR programme is a head start, not a finish line.
Change log
4 Nov 2026 First version.
This page explains the law in plain English. It is not legal advice.
Weekly · Watching 6 regulators