India is one of the world’s largest hubs for IT services, SaaS, BPO, fintech, e-commerce and outsourcing. Much of that business involves the personal data of people in Europe. That makes one question urgent for thousands of Indian companies: does the EU General Data Protection Regulation (GDPR) apply to us, even though we are based in India?
For most businesses serving European customers or processing European data, the answer is yes. At the same time, India has its own law, the Digital Personal Data Protection Act, 2023 (DPDP Act), now supported by the DPDP Rules, 2025. Indian businesses must therefore manage two regimes at once.
Sam O Martin LLP is a data protection law firm in India that provides GDPR compliance services at a national level, helping organizations in Delhi, Mumbai, Bengaluru, Hyderabad, Chennai, Pune, Kolkata, Patna and every other business centre across the country build compliance programs that satisfy both European and Indian law.
This guide explains how GDPR works for Indian companies, where it overlaps with the DPDP Act, and what steps to take.
What Is the GDPR?
The General Data Protection Regulation (EU) 2016/679 is the European Union’s data protection law, in force since May 2018. It regulates how personal data of individuals in the European Economic Area (EEA) is collected, used, stored, shared and deleted. The UK has a near-identical regime in the UK GDPR and the Data Protection Act 2018.
The GDPR is built on core principles: lawfulness, fairness and transparency; purpose limitation; data minimisation; accuracy; storage limitation; integrity and confidentiality; and accountability.
Non-compliance can lead to administrative fines of up to €20 million or 4% of total worldwide annual turnover, whichever is higher, along with orders to stop processing, compensation claims from individuals, and serious reputational damage.
Does the GDPR Apply to Companies in India?
Yes, it can. Article 3 of the GDPR gives it extraterritorial reach. It applies to an Indian organization where:
- It offers goods or services to individuals in the EU/EEA, whether or not payment is involved. A website targeting European users, pricing in euros, or European-language content are typical indicators.
- It monitors the behaviour of individuals in the EU/EEA, for example through tracking cookies, analytics, profiling or behavioural advertising.
- It processes personal data on behalf of a controller established in the EU/EEA. This is the situation of most Indian IT, BPO, KPO, SaaS, cloud and support providers, who act as data processors for European clients.
Even if the GDPR does not apply directly, European clients will almost always flow its obligations down to you contractually through Data Processing Agreements (DPAs) and Standard Contractual Clauses (SCCs). In practice, GDPR compliance has become a condition of doing business with Europe.
Indian Sectors Most Exposed to the GDPR
- IT services, software development and outsourcing companies
- SaaS, cloud and AI companies with European users
- BPO, KPO and call centre operators
- E-commerce and D2C brands that ship to or market in Europe
- Fintech, insurtech and payment companies
- Healthcare, pharma, clinical research and medical tourism providers
- EdTech platforms with international learners
- Travel, hospitality and mobility businesses
- Startups preparing for European expansion or funding rounds
The DPDP Act, 2023 and the DPDP Rules, 2025: India's Own Data Protection Law
India’s Digital Personal Data Protection Act, 2023 received Presidential assent in August 2023. In November 2025, the Ministry of Electronics and Information Technology notified the Digital Personal Data Protection Rules, 2025, which put the Act into operation through a phased rollout:
- Immediately: the Data Protection Board of India and the framework provisions came into effect.
- After about 12 months: the consent manager framework begins.
- After about 18 months (around mid-May 2027): the main obligations become enforceable, including notice and consent requirements, security safeguards, breach notification, children’s data protections, data principal rights, and Significant Data Fiduciary duties.
Penalties under the DPDP Act can reach ₹250 crore for certain violations, such as failure to maintain reasonable security safeguards. The window before full enforcement is shorter than it looks, and businesses that start now will be far better positioned.
Timelines and thresholds under the DPDP framework can be refined by further government notifications, so businesses should confirm the current position with legal counsel before relying on any date.
GDPR vs DPDP Act: Key Differences Indian Businesses Must Understand
Many organizations assume that complying with one law automatically satisfies the other. It does not. Here is how they compare:
| Area | GDPR | DPDP Act, 2023 |
|---|---|---|
| Scope of data | Personal data of individuals in the EU/EEA, in any form | Digital personal data, and non-digital data that is later digitised |
| Special categories | Stricter rules for sensitive data (health, biometric, religion, etc.) | No separate sensitive-data category |
| Legal bases | Six: consent, contract, legal obligation, vital interests, public task, legitimate interests | Consent and a list of “legitimate uses” |
| Terminology | Controller / Processor / Data Subject | Data Fiduciary / Data Processor / Data Principal |
| DPO requirement | Mandatory in specified cases | Required for Significant Data Fiduciaries (India-based) |
| Breach notification | To regulator within 72 hours where risk exists | To the Data Protection Board and affected individuals |
| Data transfers | Adequacy, SCCs, BCRs | Permitted generally, subject to government restrictions |
| Maximum penalty | €20M or 4% of global turnover | Up to ₹250 crore |
| Regulator | EU Data Protection Authorities | Data Protection Board of India |
The practical takeaway: GDPR is generally broader and more prescriptive, but the DPDP Act contains Indian-specific obligations (for example, verifiable parental consent for children’s data and the consent manager ecosystem) that a GDPR-only program will not cover. A unified compliance framework is the most efficient approach.
Core GDPR Compliance Requirements for Indian Companies
1. Data Mapping and Records of Processing Activities (ROPA)
Know what personal data you hold, why you hold it, where it sits, who can access it, and where it travels. Article 30 requires documented records for most organizations.
2. Lawful Basis and Valid Consent
Every processing activity needs a lawful basis. Where you rely on consent, it must be freely given, specific, informed and unambiguous, and as easy to withdraw as to give.
3. Privacy Notices and Transparency
Individuals must be told clearly who you are, what you collect, why, who you share it with, how long you keep it, and what their rights are.
4. Data Subject Rights
You must be able to respond, generally within one month, to requests for access, rectification, erasure, restriction, portability and objection, and to challenges to automated decision-making.
5. Data Processing Agreements and Vendor Management
Article 28 requires written contracts with every processor and sub-processor. Indian service providers should expect detailed DPAs from European clients.
6. International Data Transfers
Because India does not currently have an EU adequacy decision, transferring European personal data to India typically relies on Standard Contractual Clauses, supported by transfer impact assessments and supplementary safeguards where needed.
7. Appointment of a Data Protection Officer (DPO)
A DPO is required where core activities involve large-scale systematic monitoring or large-scale processing of special category data, among other triggers. Organizations without the budget or expertise for an internal hire increasingly use DPO as a Service.
8. EU/UK Representative (Article 27)
Non-EU companies that fall under the GDPR through offering services or monitoring behaviour must generally appoint a representative in the EU or UK, unless an exemption applies.
9. Data Protection Impact Assessments (DPIAs)
High-risk processing, such as profiling, large-scale sensitive data handling or new technologies including AI, requires a documented DPIA.
10. Security and Breach Response
Implement appropriate technical and organizational measures such as encryption, access controls, logging and staff training, and maintain a tested incident response plan capable of meeting the 72-hour breach notification window.
11. Accountability and Governance
The GDPR requires you to be able to demonstrate compliance through policies, training records, audits and board-level oversight.
A Practical GDPR Compliance Roadmap for Indian Businesses
Step 1: Applicability Assessment Determine whether you act as a controller, processor or both, and which GDPR provisions apply to each activity.
Step 2: GDPR Gap Analysis Benchmark current practices against GDPR (and the DPDP Act) to identify gaps and prioritise remediation by risk.
Step 3: Data Mapping and ROPA Build a verified inventory of data flows, systems and third parties.
Step 4: Policy and Documentation Framework Prepare privacy notices, internal data protection policies, retention schedules, consent mechanisms, and DSAR and breach procedures.
Step 5: Contracts and Transfer Mechanisms Put DPAs, SCCs and transfer impact assessments in place with clients, vendors and group entities.
Step 6: Technical and Organizational Safeguards Strengthen security controls and align them with your documented policies.
Step 7: Training and Awareness Train employees, especially customer-facing, HR, IT and marketing teams.
Step 8: Ongoing Monitoring Conduct periodic audits, update records, and track legal developments in both the EU and India.
Common GDPR Compliance Mistakes Made by Indian Companies
- Assuming GDPR does not apply because the company has no EU office
- Treating the DPDP Act as a replacement for GDPR compliance
- Using generic or copied privacy policies that do not match real data practices
- Signing client DPAs without understanding the obligations they create
- Relying on cookie banners that do not obtain valid consent
- Failing to maintain Records of Processing Activities
- Having no tested breach response plan or 72-hour reporting process
- Ignoring sub-processor chains and offshore support teams
- Overlooking the need for an EU/UK representative or DPO where required
Why Choose Sam O Martin LLP for GDPR Compliance in India?
Sam O Martin LLP combines legal expertise in data protection and privacy law with a practical understanding of how Indian businesses actually operate. Our national-level GDPR practice offers:
- Pan-India service delivery: support for businesses in every major city and state, through remote and on-site engagements
- Dual-law expertise: integrated GDPR, UK GDPR and DPDP Act compliance, so you build one framework rather than two
- GDPR gap analysis and audits: clear, risk-ranked findings with actionable remediation plans
- Policy, contract and DPA drafting: privacy notices, DPAs, SCCs, transfer impact assessments and vendor agreements
- DPO as a Service: an experienced outsourced Data Protection Officer without the cost of a full-time hire
- DPIAs and AI governance review
- Breach response and regulatory support: rapid legal guidance when an incident occurs
- Training programs: tailored workshops for leadership, legal, HR, IT and operations teams
- Ongoing advisory: continuous monitoring of regulatory developments across jurisdictions
Whether you are an IT exporter responding to a client’s data protection questionnaire, a startup preparing to enter Europe, or an established enterprise aligning with the DPDP Act, our team provides practical guidance that protects both your business and your customers’ data.
Frequently Asked Questions
Is GDPR compliance mandatory for Indian companies? If your company offers goods or services to people in the EU/EEA, monitors their behaviour, or processes personal data for European clients, the GDPR applies to you directly or through your client contracts.
Does the DPDP Act replace GDPR compliance in India? No. The DPDP Act governs digital personal data in India. The GDPR operates independently wherever its territorial scope is met. Businesses serving both markets need to comply with both.
What is the penalty for GDPR non-compliance? Up to €20 million or 4% of worldwide annual turnover, whichever is higher, plus other enforcement powers and civil claims.
Does my Indian company need an EU representative? Often yes, where Article 27 applies and no exemption is available. A legal assessment can confirm whether this applies to you.
Can a small business or startup in India use a Data Protection Officer as a service? Yes. DPO as a Service gives smaller organizations access to qualified expertise on a flexible basis, where a DPO is required or where independent oversight is simply good governance.
How long does GDPR compliance take? It depends on size and complexity. A focused gap analysis can take a few weeks, while full implementation typically takes several months.
Can Sam O Martin LLP support businesses outside Delhi? Yes. We serve clients across India at a national level.
Get Started With GDPR Compliance in India
The cost of getting data protection wrong, in fines, lost contracts and lost trust, far exceeds the cost of getting it right. Partner with Sam O Martin LLP for expert GDPR compliance in India, from your first gap analysis to ongoing DPO support.
Contact Sam O Martin LLP today to book your GDPR compliance consultation.
Disclaimer: This article is for general information only and does not constitute legal advice. Data protection laws and implementation timelines change, so please obtain advice specific to your organization.
Target keywords: GDPR compliance in India, GDPR for Indian companies, GDPR consultant India, GDPR law firm India, GDPR compliance services India, GDPR vs DPDP Act, DPDP Act compliance, GDPR gap analysis India, DPO as a service India, EU GDPR representative India, data protection law firm India
