GDPR Compliance for Indian Companies Serving European Customers

GDPR reaches organisations outside the EU in two situations, and binds processors through contracts in a third.

A controller decides why and how personal data is processed. A processor acts on a controller's instructions. A B2B SaaS company is usually a processor for its customers' end-user data and a controller for its own customer contacts and website visitors. The distinction decides which duties apply.

The European Commission has not issued an adequacy decision for India, so sending EU personal data to India needs a transfer mechanism. In practice this means the Commission's Standard Contractual Clauses, plus a transfer impact assessment that considers Indian law and any supplementary safeguards.

For an Indian vendor, the SCCs and a credible transfer assessment are the price of entry to EU deals.

GDPR's principles become product features.

Companies outside the EU that fall under GDPR by offering services or monitoring must appoint a representative in the EU unless processing is occasional and low risk. A Data Protection Officer is required where core activities involve large-scale monitoring or special category data. High-risk processing needs a data protection impact assessment. Fines can reach €20 million or four per cent of worldwide annual turnover, whichever is higher.

Building for both at once is efficient, because GDPR is broadly the stricter regime, with some exceptions.