When does the GDPR apply to an Indian business?
A common misconception is that the General Data Protection Regulation (GDPR) applies universally to every Indian company. Under Article 3(2), the GDPR applies to an Indian company without an EU establishment only if processing activities relate to:
- The offering of goods or services (whether paid or free) to data subjects located in the European Union or United Kingdom; or
- The monitoring of their behaviour as far as their behaviour takes place within the EU (e.g. behavioural tracking cookies).
We conduct an applicability audit to determine your exact exposure, preventing unnecessary operational overhead while ensuring legitimate European business channels are completely protected.
Key GDPR readiness services
- Article 30 Record of Processing Activities (ROPA): Structuring formal European data registries with documented lawful bases (Article 6) and special category exemptions (Article 9).
- International Data Transfer Mechanisms: Implementing EU Standard Contractual Clauses (SCCs) and UK International Data Transfer Agreements (IDTAs) alongside Transfer Impact Assessments (TIAs).
- Article 28 Processor Compliance: Aligning master service agreements with mandatory processor obligations required by European enterprise buyers.
- Data Protection Officer (DPO) Advisory: Determining whether mandatory DPO appointment triggers apply under Article 37.