Privacy · Law
GDPR, EU data protection law
The EU's data protection law, which can apply to Indian firms serving or monitoring people in the EU.
- Type
- Law
- Group
- Privacy
- We help with
- ISO 27001 and GRC
- Issued by
- Not applicable
What it is.
The EU General Data Protection Regulation (GDPR) governs the processing of personal data of people in the EU. It can apply to Indian organisations that offer goods or services to, or monitor, people in the EU.
Who usually needs it
- Indian firms selling to people in the EU
- IT and ITES firms processing EU personal data for clients
- Apps and websites that monitor EU users
What it covers.
- 01
Lawful processing
A lawful basis, transparency and purpose limitation.
- 02
Individual rights
Access, correction, erasure and other rights for data subjects.
- 03
Security and breaches
Appropriate security and breach notification.
- 04
Fines
Up to €20 million or 4% of worldwide annual turnover, whichever is higher.
How we help with GDPR
For Indian companies the first question is whether GDPR applies at all: an EU establishment, offering goods or services to people in the EU, or monitoring their behaviour. If it does, we build the record of processing, lawful bases, privacy notices, data processing agreements and transfer safeguards, and align them with your DPDP work so you maintain one privacy programme.
Typical phases.
Each phase ends with something you keep. Timelines depend on scope and are agreed in the proposal.
- 1
Scope
- Applicability memo
- Data flows
- 2
Assess
- Gap report
- Action plan
- 3
Implement
- Records of processing
- Notices
- Security measures
- 4
Maintain
- Rights process
- Breach process
- Reviews
It can, if you offer goods or services to people in the EU or monitor their behaviour. If you process EU personal data for a client, GDPR duties usually reach you through that client's contract (Article 28 terms and standard contractual clauses).
Up to €20 million or 4% of worldwide annual turnover, whichever is higher.
Yes. It helps demonstrate privacy controls, though it does not by itself guarantee compliance.
Let's build what's next.
Tell us about your infrastructure, security or automation goals. We reply with questions, then a written plan with scope and next steps.
- Response
- Usually within one business day
- Location
- Worldwide
What happens next
- 01
Reply
- 02
Discovery call
- 03
Proposal
This page is general guidance, not legal advice. Last reviewed October 2026.