Does GDPR apply to Indian companies? Yes, and here's when.
When GDPR applies to companies in India under Article 3(2), what you have to do, and how GDPR and India's DPDP Act differ on consent, children and breaches.
Vaishnavi Sharma · Founder, VASUIST
A lot of Indian founders treat GDPR as something to handle once they open a European entity. By then they've usually been in scope for years.
If your product has users in the EU, or you track the behaviour of people in the EU through your website or app, GDPR applies to you today, and you should treat it as seriously as DPDP. Being outside Europe changes how hard you are to fine, not whether you're obliged.
I've worked on GDPR and DPDP programs for companies that process data across both regions, and the gap I see most often is the assumption that GDPR is about where you're incorporated.
When GDPR reaches you
Article 3(2) applies GDPR to a controller or processor not established in the EU when its processing relates to either offering goods or services to people in the EU, paid or free, or monitoring their behaviour as far as it takes place in the EU.
Offering is judged by intent: a website in German or French, prices in euros, EU shipping, EU customer references. Monitoring includes behavioural tracking and profiling, which covers most analytics and advertising pixels.
A single Indian SaaS company with a few hundred EU users, a euro pricing page and a marketing pixel is very likely in scope.
What you have to do
Identify a lawful basis under Article 6 for each processing purpose, and tell people what it is. Appoint an EU representative under Article 27 unless your processing is occasional and low risk. Keep records of processing activities under Article 30. Notify the relevant supervisory authority within 72 hours of becoming aware of a breach that is likely to risk people's rights (Article 33). Honour access, erasure, portability and objection rights.
Transfers are where Indian companies get caught. India has no EU adequacy decision, so EU customers sending you personal data will usually require standard contractual clauses and a transfer impact assessment.
If you've signed a European customer's data processing agreement with SCCs attached and never opened Annex II, the security annex, you've promised measures you may not have.
GDPR and DPDP: same direction, different rules
Both laws want a data map, clear notices, consent records, rights handling, breach response and processor contracts. Build those once and you're well on the way to both.
The differences need separate handling. DPDP has no general legitimate interests basis; outside a short list of legitimate uses, you need consent. DPDP treats anyone under 18 as a child and requires verifiable parental consent, where GDPR lets member states set the age between 13 and 16. DPDP expects every personal data breach to be reported to the Board and the affected people, while GDPR only requires notification of breaches likely to create risk.
GDPR fines reach €20 million or 4% of worldwide annual turnover. DPDP penalties reach ₹250 crore per instance. Neither is a number you want to test.
Running both from one set of controls, with each law's differences tracked as its own requirements, is how we set up programs in Steppe. It's also the only approach I've seen that doesn't double the work.
If you have users in the EU, GDPR already applies to you, and the only open question is whether you find out from your own review or from a customer's lawyer.
Frequently asked questions
Does GDPR apply to companies in India?
Yes, when they offer goods or services to people in the EU or monitor their behaviour in the EU (Article 3(2)).
Do Indian companies need an EU representative?
Usually yes under Article 27, unless processing is occasional, low risk and excludes large scale special category data.
Is India adequate under GDPR?
No. Transfers from the EU to India usually rely on standard contractual clauses.