GDPR Essentials for Indian Companies
How EU data protection rules affect Indian businesses. Comprehensive guide to GDPR applicability, key principles, lawful bases, data subject rights, and compliance strategies for Indian IT and BPO companies.
Quick Overview
Key Takeaways
Why Indian Companies Must Care About GDPR
The General Data Protection Regulation (GDPR) applies to Indian companies that offer goods or services to EU residents or monitor their behaviour — physical presence in Europe is not required.
When GDPR Applies to Indian Businesses
Article 3 of the GDPR establishes territorial scope. Two limbs are particularly relevant to Indian companies: establishment in the EU, and targeting or monitoring EU data subjects.
Key GDPR Principles
- Lawfulness, fairness, and transparency
- Purpose limitation
- Data minimisation
- Accuracy
- Storage limitation
- Integrity and confidentiality
- Accountability
Six Lawful Bases for Processing
Every act of processing must rest on one of six lawful bases: consent, contract, legal obligation, vital interests, public task, or legitimate interests.
Data Subject Rights
The GDPR grants individuals comprehensive rights: access, rectification, erasure, restriction, data portability, and objection.
DPO Requirements
A DPO must be appointed where core activities involve regular and systematic monitoring of data subjects on a large scale, or processing of special categories of data.
Need help implementing this?
Talk to our data privacy team for practical guidance on policies, assessments, controls and compliance workflows.