Introduction
The General Data Protection Regulation (GDPR) applies to Indian companies that offer goods or services to individuals in the EU, or monitor their behaviour. This guide provides practical steps for Indian businesses to achieve GDPR compliance.
Key Obligations
- Lawful processing of personal data
- Privacy by design and default
- Data protection impact assessments
- Appointment of Data Protection Officer (DPO)
- Maintaining records of processing
- Data subject rights
Data Transfer Mechanisms
Indian companies must use one of the following mechanisms to transfer data from the EU:
To understand how India's local law handles this, read our GDPR vs DPDPA Comparative Analysis.
- Adequacy Decision: EU has not yet issued an adequacy decision for India
- Standard Contractual Clauses (SCCs): Most common mechanism
- Binding Corporate Rules (BCRs): Suitable for multinational groups
- Derogations: Limited exceptions
Conclusion
GDPR compliance is a journey, not a destination. Indian companies must adopt a proactive approach to data protection to build trust with EU customers and avoid significant penalties.
Related Reading
- DPDPA vs GDPR — Full comparison
- GDPR vs DPDPA Guide — Detailed guide
- Cross-Border Transfers — For Indian companies with EU operations