GDPR

GDPR: complete guide

Introduction

The General Data Protection Regulation, usually called the GDPR, is the data protection law of the European Union. It is formally Regulation (EU) 2016/679 and has applied since May 2018 across all EU member states, and in a closely matching form across the wider European Economic Area. It sets the rules for how personal data of individuals in Europe is collected, used, stored, shared and deleted, and it gives those individuals strong rights over their own information.

Many Indian businesses assume the GDPR does not concern them because they have no office in Europe. That assumption is often wrong. Under Article 3(2) of the GDPR, the regulation also applies to a business established outside the EU if it offers goods or services to individuals in the EU, whether paid or free, or if it monitors their behaviour within the EU, for example through tracking, analytics or profiling. An Indian software company with European users, an export house selling directly to European customers, an online course provider with European students, a travel company handling European tourists, or an IT or outsourcing firm processing data for European clients can all fall within its scope, either as a controller or as a processor.

GDPR compliance is not a single certificate or registration. It is a set of documents, decisions and working practices that show you handle personal data lawfully and can prove it. At the core is documentation: a privacy notice that tells people what you do with their data, a record of processing activities, data processing agreements with clients and vendors, transfer safeguards for moving data out of Europe, internal policies on retention, security and breach response, and procedures for handling requests from individuals. Regulators and European business partners expect to see these documents, and they are often asked for during vendor due diligence before a contract is signed.

Professional help matters here because the GDPR is principle-based. It does not hand you a fill-in-the-blanks form. Each document has to reflect what your business actually does with data, which lawful basis applies to each activity, which vendors receive the data and where they are located. Copying a generic privacy policy from another business can be worse than having none, because it may make statements that are untrue for you. Our team maps your data flows first and then drafts documents that fit them. We also explain how the GDPR sits alongside India's own Digital Personal Data Protection Act, 2023, so that one set of practices can serve both where possible.

Who Needs It

GDPR documentation is relevant for any Indian business that deals with personal data of people in Europe. Typical clients include:

• SaaS and app businesses with users or paying customers in the EU, including free products that collect email addresses, usage data or device identifiers.
• IT services, BPO and KPO companies that process customer, employee or patient data on behalf of European clients. These businesses usually act as processors and are asked to sign data processing agreements and answer security questionnaires.
• E-commerce and direct-to-consumer brands that ship to European customers or run marketing campaigns targeted at them.
• Education and coaching providers offering online courses, webinars or tutoring to students in Europe.
• Travel, hospitality and medical tourism businesses collecting passport details, health information or travel preferences of European visitors.
• Recruitment and staffing firms handling CVs and personal details of European candidates.
• Market research and digital marketing agencies running surveys, ad campaigns, tracking pixels or email marketing aimed at European audiences.
• Startups raising money from European investors or entering European markets, where GDPR readiness is often part of due diligence.

If your only European connection is that your website can be opened from Europe, the GDPR may not apply. Mere accessibility of a website is generally not enough. Factors such as using a European language or currency, mentioning European customers, shipping to Europe or targeting ads at European users point towards application. We help you assess this before you spend on documentation you may not need.

Key Benefits

• Access to European clients and markets. Many European businesses will not share personal data with a vendor who cannot show GDPR-compliant contracts and policies. Proper documentation shortens the procurement cycle.
• Reduced regulatory risk. The GDPR allows supervisory authorities to impose significant administrative fines and corrective orders, including orders to stop processing. Documented compliance lowers the chance of a complaint turning into enforcement.
• Clarity inside your business. Mapping data flows usually reveals unused data, unnecessary vendors and weak access controls. Fixing these makes your operations leaner and more secure.
• Customer trust. A clear, honest privacy notice and a simple way to exercise rights tell users you respect their data.
• Readiness for India's data protection law. Much of the work done for the GDPR, such as notices, consent records, breach procedures and vendor contracts, can be adapted for the Digital Personal Data Protection Act, 2023 and the rules made under it.
• Stronger negotiating position. When a European client sends its own data processing agreement, you can compare it against your own documents and push back on unfair terms.

Controller or processor: why it matters. A controller decides why and how personal data is processed. A processor handles personal data only on the instructions of a controller. An Indian SaaS company that runs its own marketing is a controller for that data, but when it hosts customer data for European business clients, it is usually a processor for that data. The documents you need differ. Controllers need privacy notices, lawful basis assessments and request-handling procedures. Processors need data processing agreements under Article 28, sub-processor lists, security documentation and assistance procedures. Most businesses are both, for different activities, and our documentation reflects that split.

How the GDPR compares with India's law. The Digital Personal Data Protection Act, 2023 also uses consent and a limited set of legitimate uses, gives individuals rights of access, correction and erasure, and requires breach reporting. However, it differs in important ways. It does not have the same list of six lawful bases, it treats children as anyone under eighteen, and its cross-border transfer approach is based on restricting transfers to notified countries rather than on adequacy decisions and standard clauses. A business serving both Indian and European users needs documents that handle both regimes.

Eligibility and Legal Requirements

There is no registration or licence to obtain under the GDPR. Instead, a business within its scope must meet a set of obligations. The main ones that drive documentation are:

• Principles of processing (Article 5). Personal data must be processed lawfully, fairly and transparently, collected for specified purposes, limited to what is necessary, kept accurate, stored no longer than needed, and kept secure. The controller must be able to demonstrate compliance, which is why documentation is central.
• Lawful basis (Article 6). Each processing activity needs one of six bases: consent, contract, legal obligation, vital interests, public task or legitimate interests. Special categories of data such as health, biometric or religious data need an additional condition under Article 9.
• Transparency (Articles 13 and 14). Individuals must be told who you are, what data you collect, why, on what basis, who receives it, whether it leaves Europe, how long it is kept and what rights they have.
• Individual rights (Articles 15 to 22). These include access, rectification, erasure, restriction, data portability, objection and rights related to automated decision-making. Requests must generally be answered within one month, extendable in some cases.
• Records of processing (Article 30). Most controllers and processors must keep a written record of their processing activities.
• Processor contracts (Article 28). Controllers must use processors only under a written contract containing specified terms.
• Security and breach notification (Articles 32 to 34). Appropriate technical and organisational measures are required. A controller must notify the supervisory authority of a personal data breach without undue delay and, where feasible, within 72 hours, unless the breach is unlikely to result in risk. Processors must inform controllers without undue delay.
• Data protection impact assessments (Article 35). Required for processing likely to result in high risk, such as large-scale monitoring or large-scale use of sensitive data.
• Data protection officer (Article 37). Required only in certain cases, such as core activities involving large-scale regular monitoring or large-scale processing of special categories of data.
• EU representative (Article 27). A business outside the EU that falls under Article 3(2) must generally appoint a representative in the EU in writing, unless an exemption for occasional, low-risk processing applies.
• International transfers (Chapter V). India does not currently have an adequacy decision from the European Commission, so transfers of personal data from Europe to India usually rely on Standard Contractual Clauses or another approved safeguard, supported by a transfer risk assessment.

In India, the Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules notified under it are being brought into force in phases. The Information Technology Act, 2000 and its rules on reasonable security practices also continue to be relevant for many businesses. European data protection law is also subject to ongoing reform proposals and regulatory guidance. Rules change, and we check the current position in both jurisdictions at the time of drafting.

Step-by-Step Guide

1. Scoping call. We discuss your business model, products, markets and the kinds of European individuals whose data you handle, such as customers, users, employees of clients or job applicants. We confirm whether, and how, the GDPR applies to you.
2. Data mapping questionnaire. You complete a structured questionnaire covering what data you collect, from whom, through which channels, for what purposes, where it is stored, who can access it and which third parties receive it.
3. Role and lawful basis analysis. For each processing activity, we identify whether you act as controller, joint controller or processor, and which lawful basis applies. Where you rely on legitimate interests, we prepare a short balancing assessment.
4. Gap review. We compare your current practices, website, forms, cookie banners and contracts against the requirements and share a gap list in plain language, with priorities.
5. Drafting the privacy notice. We draft an external privacy notice for your website or app, and where needed a separate notice for employees or candidates, written in clear language that matches what you actually do.
6. Drafting internal records and policies. We prepare the record of processing activities, a data retention schedule, an information security policy outline, a data breach response procedure and a data subject request procedure.
7. Contract documentation. We draft or review data processing agreements for your clients and vendors, prepare a sub-processor list, and prepare the transfer documentation using the appropriate Standard Contractual Clauses module along with a transfer risk assessment template.
8. Cookie and consent review. We review your cookie banner, consent wording, marketing opt-ins and withdrawal mechanisms, and suggest changes so consent is freely given, specific, informed and unambiguous.
9. Review and finalisation. You review the drafts, our team answers questions and revises the documents. Where you have an internal technical team, we brief them on what the documents commit you to.
10. Handover and implementation guidance. We deliver final editable documents and a short implementation checklist covering who owns each process, how to log requests and breaches, and when to review the documents.

Documents Checklist

For every business:

• Company or firm registration documents and a short description of the business
• List of products, services, websites and apps that collect personal data
• Current privacy policy, terms of use and cookie banner text, if any
• Sign-up forms, checkout forms, contact forms and marketing consent wording
• List of vendors and tools that receive personal data, such as hosting, email, payment, analytics, CRM and support tools, with their locations
• Details of where data is stored and backed up
• Internal security practices, such as access control, encryption and password policies

For businesses acting as processors for European clients:

• Main service agreements with clients
• Any data processing agreements or security questionnaires already received
• List of your own sub-processors and group companies with access to client data
• Details of certifications or audits you hold, if any

For businesses with European employees or candidates:

• Employment or engagement contracts
• HR policies and the systems used for payroll, attendance and recruitment

Optional but useful:

• Past incidents or breaches and how they were handled
• Any complaints or data requests already received

How Long It Takes

A typical GDPR documentation engagement takes 10 to 20 working days from the date we receive the completed questionnaire and supporting documents. The broad timeline is:

• Scoping and questionnaire: two to five working days, depending on how quickly your team gathers information about systems and vendors.
• Analysis and gap review: three to five working days.
• Drafting: five to eight working days for the full document set.
• Review and revisions: two to five working days, depending on the number of rounds and internal approvals.

Businesses with many products, group companies or complex data flows may need longer. Delays usually come from incomplete vendor lists or from technical questions that need input from developers. We share drafts in stages so you can start implementing urgent items, such as the privacy notice or a client's data processing agreement, sooner.

Pricing

Our professional fee for GDPR documentation is ₹ 4,999.

This covers:

• A scoping call to assess whether and how the GDPR applies
• Review of your data mapping questionnaire
• Controller and processor role analysis and lawful basis mapping
• An external privacy notice for one website or app
• A record of processing activities
• A data breach response procedure and a data subject request procedure
• A template data processing agreement
• One round of revisions and a closing call on implementation

There are no government fees under the GDPR for preparing documentation. Additional work, such as separate notices for multiple products, negotiating client-specific data processing agreements, transfer risk assessments for complex vendor chains, data protection impact assessments or arranging an EU representative through a third party, is quoted separately. Any charges of third-party service providers are payable at actual.

Common Mistakes to Avoid

• Copying another business's privacy policy. It will describe data uses, vendors and retention periods that do not match yours, and inaccurate notices are themselves a compliance failure.
• Relying on consent for everything. Consent must be freely given and can be withdrawn at any time. For many activities, contract or legitimate interests is the more suitable basis.
• Pre-ticked boxes and bundled consent. Consent buried in terms of use or collected through pre-ticked boxes is not valid under the GDPR.
• Ignoring the processor role. IT and outsourcing firms often focus only on their website policy and forget the data processing agreements and security commitments their clients need.
• Missing transfer safeguards. Data moving from Europe to India needs a recognised transfer mechanism. Signing a client contract without one leaves both sides exposed.
• Forgetting the EU representative. Businesses that fall under Article 3(2) often overlook the requirement to appoint a representative in the EU.
• Keeping data forever. Without a retention schedule, old records accumulate and increase the damage if a breach occurs.
• Treating documentation as a one-time task. New tools, vendors or features change your data flows. Documents must be updated when this happens.

What Happens After

Documentation is the foundation, but compliance depends on what you do every day. After the documents are ready, you should:

• Publish the privacy notice on your website and inside your app, and link to it at every point where personal data is collected.
• Fix consent flows and cookie banners in line with the recommendations.
• Sign data processing agreements with every vendor that handles personal data on your behalf, and offer your template to clients.
• Appoint an internal privacy owner responsible for requests, breaches and document updates, and appoint a data protection officer or EU representative where required.
• Train staff who handle personal data on the breach procedure and on recognising data subject requests.
• Keep logs of requests received, responses sent, breaches and decisions taken.
• Review the documents at least once a year, and whenever you add a new product, market or vendor.
• Prepare for India's law. As obligations under the Digital Personal Data Protection Act, 2023 come into force, adapt your notices, consent mechanisms and breach procedures for Indian users as well.

Our team can support you with periodic reviews, client contract negotiations and India data protection compliance.

FAQs

Does the GDPR apply to an Indian company with no office in Europe?

It can. The GDPR applies to businesses outside the EU that offer goods or services to people in the EU or monitor their behaviour there. If you actively target European customers or track European users, the regulation is likely to apply even if you have no physical presence in Europe.

Is there a GDPR certificate or registration I can obtain?

No. There is no general registration or licence under the GDPR. Compliance is shown through documentation, contracts and practices. Some approved certification schemes exist, but they are optional and specific in scope.

What is the difference between a privacy policy and a data processing agreement?

A privacy policy, or privacy notice, informs individuals about how their data is used. A data processing agreement is a contract between a controller and a processor that sets out how the processor will handle data on the controller's behalf, as required by Article 28.

Do I need a data protection officer?

Only in specific cases, such as when your core activities involve regular and systematic monitoring of individuals on a large scale, or large-scale processing of sensitive data. Many small and medium businesses do not need one, but they still need someone internally responsible for privacy.

Do I need an EU representative?

If you are outside the EU and the GDPR applies to you because you target or monitor people in the EU, you generally need to appoint a representative in the EU, unless your processing is occasional, low risk and does not involve large-scale sensitive data. We help you assess whether the exemption applies.

Can European clients transfer personal data to us in India?

Yes, but a recognised transfer mechanism is needed because India does not currently have an adequacy decision. Standard Contractual Clauses approved by the European Commission are the usual route, supported by an assessment of the legal environment and the security measures in place.

How quickly must a data breach be reported?

A controller must notify the relevant supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of a breach, unless the breach is unlikely to result in a risk to individuals. Where the risk is high, affected individuals must also be informed. A processor must inform the controller without undue delay.

Is GDPR compliance the same as complying with India's data protection law?

No. The two laws share many ideas, such as notice, consent, rights and breach reporting, but differ in definitions, lawful grounds, the treatment of children's data, and cross-border transfers. A business serving both Indian and European users should plan for both.

Can consent be included in our terms and conditions?

Consent under the GDPR must be specific and clearly separate from other matters. Burying it in terms and conditions or using a pre-ticked box does not meet the standard. Where consent is the right basis, it should be collected through a clear, separate action.

Do the GDPR rules apply to business email addresses?

Yes. A business email address that identifies a person, such as one containing their name, is personal data. B2B marketing to such addresses must still have a lawful basis and respect national rules on electronic marketing in the relevant European country.

How long should we keep personal data?

Only as long as necessary for the purpose for which it was collected, plus any period required by law. We help you draw up a retention schedule that sets periods for each category of data and explains how data is deleted or anonymised afterwards.

What happens if we do not comply?

Supervisory authorities can issue warnings, order changes, restrict or ban processing and impose administrative fines. In practice, the more immediate impact for many Indian businesses is commercial, since European clients may refuse to work with a vendor that cannot show compliance.

Will you provide editable documents?

Yes. All documents are delivered in editable form so your team can update them as your business changes. We recommend a review whenever you add a new product, vendor or market.

Do you also cover cookie consent?

Yes. We review your cookie banner, the cookies and trackers your website uses, and your consent wording, and recommend changes. Technical implementation on your website is done by your developers using our recommendations.

Related Documentation services

• Joint Venture Agreement
• Legal Notice
• Legal Notice for Recovery of Dues
• Make a Will