Glossary · Privacy and data protection
Europe's privacy law can reach an Indian company that never opens an office there.
The European Union's regulation on processing personal data, applied since May 2018, which also reaches firms outside the EU that target or monitor people in it.
Back to the glossary01 · In plain words
In plain words
The European Union's regulation on processing personal data, applied since May 2018, which also reaches firms outside the EU that target or monitor people in it.
The GDPR governs how personal data about people in the EU is collected and used. It applies directly in every member state. It sets principles, six lawful bases, rights for data subjects and duties for controllers and processors.
Spelled out: General Data Protection Regulation, Regulation (EU) 2016/679.
02 · Why it matters
Why it matters
Who cares about this, and what depends on it.
Article 3 reaches beyond Europe. An organisation outside the EU is covered when it offers goods or services to people in the EU or monitors their behaviour there. A Chennai SaaS company with French customers' staff in its system is very likely in scope, either as a controller or as a processor. The upper tier of fines under Article 83 is up to 20 million euros or 4 percent of worldwide annual turnover, whichever is higher. EU buyers will also ask for a data processing agreement, a transfer mechanism such as standard contractual clauses, and evidence of Article 32 security.
03 · Where you meet it
Where you will meet it
The documents, meetings and reports where it appears.
- An EU customer's vendor questionnaire
- Questions about your role, sub-processors, transfers and breach notice.
- The data processing agreement
- The contract terms Article 28 requires between controller and processor.
- Standard contractual clauses
- The European Commission's model clauses used for transfers to countries without an adequacy decision.
- An EU representative clause
- Article 27 often requires a non-EU controller or processor in scope to name a representative in the EU.
04 · An example
A worked example
An illustration, not a real client.
Illustrative: a Jaipur handicraft exporter with a German web shop
A family exporter sells rugs directly to German buyers through a site priced in euros, with German-language pages. That is offering goods to people in the EU, so the GDPR applies to the shop's customer data. The exporter checks its lawful basis for each use, adds an EU representative, signs terms with its payment and email providers, and sets up a way to answer access requests within one month.
05 · Easy to mix up
Easy to mix up with
Neighbouring terms that mean something different.
- DPDP Act
- India's law. It uses fiduciary and principal rather than controller and subject, relies on consent and listed legitimate uses, and covers only digital data.
- UK GDPR
- The UK's retained version after Brexit. It is close in content but enforced by the UK regulator under UK law.
- ISO/IEC 27701
- A certifiable privacy management standard. It can help show GDPR work but is not the law.
06 · What to do
What to do with it
Practical steps, and the guides that go deeper.
- Check Article 3: do you offer to, or monitor, people in the EU?
- Decide your role for each data flow and sign the right contract terms.
- Pick a transfer mechanism for any data leaving the EU.
- Set up the 72-hour breach notice path and a one-month rights-request process.
- GuideGDPR principles & lawful basisThe seven principles of Article 5 and the six lawful bases.
- GuideInternational data transfersAdequacy, SCCs, BCRs and transfer impact assessments.
- GuideGDPR and India's DPDP ActData fiduciaries, consent, rights and penalties, side by side with GDPR.
Sources: Regulation (EU) 2016/679, Articles 3, 6, 27, 28, 32, 33, 83 and 99; Digital Personal Data Protection Act, 2023. Not legal advice.
Questions about GDPR
Does a website visit from Europe bring us under the GDPR?
Not on its own.
Mere accessibility of a site is not enough. Signs of targeting, such as EU currencies, languages or delivery, or tracking of EU visitors' behaviour, are what bring a non-EU company into scope under Article 3.
If we comply with the DPDP Act, are we covered for the GDPR?
No. Overlap is real but partial.
The two laws share ideas, but the GDPR has more lawful bases, more rights, a DPO test, DPIAs for any high-risk processing and transfer rules. Treat each law on its own terms. Counsel should confirm how both apply to your contracts.
Want this applied to your own systems?
Our team can walk through where this term touches your scope, your contracts and your evidence.