GDPR overview

Why Indian professionals meet GDPR

India's IT services, BPO, SaaS and travel companies serve millions of people in Europe. Their clients put GDPR duties into contracts, and some Indian companies fall under GDPR directly. GDPR also shaped many newer privacy laws, including parts of India's DPDP Act, so learning it helps you understand both.

Scope

• Material scope: processing of personal data (any information relating to an identified or identifiable person). Special categories, such as health, religion, biometrics and political opinions, get extra protection.
• Territorial scope (Article 3): organisations established in the EU, AND organisations outside the EU that offer goods or services to people in the EU or monitor their behaviour there.

The seven principles (Article 5)

1. Lawfulness, fairness and transparency.
2. Purpose limitation: collect for specified purposes, do not reuse for unrelated ones.
3. Data minimisation: only what is needed.
4. Accuracy: keep it correct and up to date.
5. Storage limitation: keep it no longer than needed.
6. Integrity and confidentiality: appropriate security.
7. Accountability: the controller must be able to show it complies.

Six lawful bases (Article 6)

Every processing activity needs one of: consent, performance of a contract, legal obligation, vital interests (to protect someone's life), public task, or legitimate interests (balanced against the person's rights). Consent is only one option, and often not the best one.

Rights of individuals

• Right to be informed and right of access (get a copy of their data).
• Right to rectification and right to erasure ("right to be forgotten", with limits).
• Right to restrict processing and right to object (for example to direct marketing).
• Right to data portability (get data in a machine-readable form).
• Rights about automated decision-making and profiling.

Security and breaches

Article 32 requires appropriate technical and organisational security, such as encryption, pseudonymisation, resilience and regular testing. A personal data breach must be reported to the supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of it (Article 33), unless it is unlikely to result in a risk to people. If the risk to people is high, they must also be told without undue delay (Article 34).

Other duties

• Records of processing activities.
• Data protection impact assessments (DPIA) for high-risk processing.
• A Data Protection Officer (DPO) in certain cases, such as large-scale monitoring or special-category data.
• Contracts with processors (Article 28).
• Transfers outside the EU only with safeguards, such as an adequacy decision or standard contractual clauses (SCCs). India does not currently have an EU adequacy decision, so transfers to India commonly use SCCs.

Fines

There are two tiers. The higher tier is up to €20 million or 4% of total worldwide annual turnover of the preceding year, whichever is higher. The lower tier is up to €10 million or 2%, whichever is higher.

def max_fine_eur(turnover_eur):
    return max(20_000_000, 0.04 * turnover_eur)

print(max_fine_eur(100_000_000))      # small firm: the €20 million floor applies
print(max_fine_eur(2_000_000_000))    # large firm: 4% = €80 million

Common mistakes

• "We are in India, GDPR does not apply." It can, if you target or monitor people in the EU.
• Using consent for everything, then being stuck when people withdraw it.
• Missing the 72-hour window because the breach was not escalated quickly. SOC playbooks must flag possible personal data breaches early.