An Indian SaaS company with no office in Europe can still fall under the GDPR the moment it offers its product to people in the EU. The stakes are set out in Article 83: the most serious breaches can draw fines of up to €20 million or 4% of worldwide annual turnover, whichever is higher. This guide explains when the law applies, what EU customers will ask you to sign, and how to move data to India lawfully.
When the GDPR applies to a company in India
Article 3(2) extends the regulation to controllers and processors that are not established in the EU when their processing relates to offering goods or services to people in the Union, or to monitoring their behaviour there. For a SaaS business, signs of targeting include EU pricing in euros, EU-specific marketing or support in European languages. Product analytics that track the behaviour of users in the EU can count as monitoring.
Many Indian SaaS firms meet the law a second way: as processors for EU customers. Even when the GDPR does not apply to you directly, your EU client is bound by it and will pass its obligations down to you through contract. The regulation was adopted on 27 April 2016 and published on 4 May 2016, according to its EUR-Lex record, so enterprise buyers in Europe treat these clauses as routine.
Controller or processor: work out your role first
Your duties depend on whether you decide why and how personal data is processed (controller) or process it on a customer's documented instructions (processor). A CRM vendor is usually a processor for the contact data its customers upload, and a controller for its own billing and marketing data. Most SaaS companies are both, for different data sets.
Map each data flow and label it. This one exercise drives your privacy notice, your contract templates, your breach plan and your answers to every security questionnaire that follows. It also tells you which sub-processors, such as cloud hosting and email delivery, you must disclose to customers.
| Duty | Article | What it means for an Indian SaaS vendor |
|---|---|---|
| Territorial scope | Art. 3(2) | Applies if you offer services to, or monitor, people in the EU |
| EU representative | Art. 27 | Appoint one in writing unless processing is occasional and low risk |
| Processor contract | Art. 28(3) | Process only on documented instructions; terms set out in a binding contract |
| Records of processing | Art. 30 | Required; relaxed under 250 employees only in narrow cases |
| Breach notice | Art. 33 | Controller tells the authority within 72 hours where feasible; processor tells controller without undue delay |
| Transfers | Arts. 45 to 49 | Adequacy decision, appropriate safeguards such as SCCs, or narrow derogations |
Appointing an EU representative
If Article 3(2) applies, Article 27 requires you to designate a representative in the Union in writing. The representative is a point of contact for regulators and individuals. The exemption is narrow: it covers processing that is occasional, does not involve large-scale special category or criminal data, and is unlikely to create a risk to people. A SaaS product with steady EU users rarely qualifies.
Representative services are offered by law firms and specialist providers in member states. Name the representative in your privacy notice and keep the appointment letter on file, because enterprise buyers and auditors often ask to see it. Brief the representative on your products and give it a named contact, since it may receive requests from users or regulators before you do.
What the processor contract must contain
Article 28(3) says processing by a processor must be governed by a binding contract that sets out the subject matter, duration, nature and purpose of processing, the types of data and categories of people, and the controller's rights. Among its stipulations, the processor must act only on documented instructions from the controller.
In practice EU customers send their own data processing agreement. Build a standard version you are happy to sign, covering sub-processor approval, deletion or return of data at contract end, help with data subject requests, audit rights and breach notice. A prepared template shortens sales cycles more than almost any other compliance document.
Moving EU data to India: adequacy and SCCs
Article 45 lets data flow freely to countries the Commission has found adequate. India was not on the list in a June 2024 summary that covered countries such as Japan, the United Kingdom, the Republic of Korea and, through the Data Privacy Framework, certified US companies. Check the Commission's current list before relying on it, because decisions can be added or withdrawn.
Without adequacy, Article 46 allows transfers under appropriate safeguards, including standard contractual clauses adopted by the Commission. The modernised SCCs were adopted on 4 June 2021 and replaced the three older sets made under Directive 95/46. Article 49 derogations, such as explicit consent, are meant for limited situations and are not a basis for routine SaaS hosting.
Breach notification and security
Under Article 33 a controller must report a personal data breach to its supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of it, unless the breach is unlikely to put people at risk. A processor must tell the controller without undue delay. Your contracts will usually set a tighter internal deadline.
Threats to vendors are real. Verizon's 2025 Data Breach Investigations Report found third-party involvement in 30% of breaches, roughly double the previous year. Build a written incident plan, log access to customer data, and run a tabletop exercise so your team can meet the clock when it starts.
Fines and a practical first-90-days plan
Article 83 sets two ceilings. Breaches of obligations such as security and records can reach €10 million or 2% of worldwide turnover. Breaches of core principles, data subject rights and transfer rules can reach €20 million or 4%. In each case the higher figure applies to an undertaking.
A workable plan for a small team: map data and roles, publish a clear privacy notice, appoint a representative if needed, adopt a standard DPA with SCCs attached, list sub-processors, and write the breach plan. XDQ Labs builds SaaS products and AI security reviews for teams preparing for EU enterprise sales.
- Record which data you control and which you process
- Sign SCCs for every EU to India data flow
- Keep a public sub-processor list
- Test the 72-hour breach workflow once a year
Frequently asked questions
Does GDPR apply to an Indian company with no office in the EU?
Yes, if it offers goods or services to people in the EU or monitors their behaviour there, under Article 3(2). It also reaches Indian firms indirectly when they process data for EU customers, because those customers must bind their processors to GDPR terms by contract.
Is India an adequate country under GDPR?
India did not appear on the Commission's adequacy list in a June 2024 summary. Without adequacy, Indian SaaS firms normally rely on the Commission's standard contractual clauses, adopted on 4 June 2021, signed with each EU customer that exports personal data to them.
What is the maximum GDPR fine?
The highest tier is €20 million or 4% of total worldwide annual turnover for the preceding financial year, whichever is higher. A lower tier of €10 million or 2% covers breaches of obligations such as security, records and breach notification. Regulators set the actual amount case by case.
Do Indian SaaS companies need an EU representative?
Usually, if Article 3(2) applies. Article 27 requires a written appointment of a representative in the Union. The exemption covers only occasional processing that avoids large-scale sensitive data and is unlikely to create risk, which most SaaS products with regular EU users do not meet.
Sources
- Regulation (EU) 2016/679 (General Data Protection Regulation), English text, Personal Data Protection Office (UODO), Poland, 2016
- Regulation (EU) 2016/679, Article 3: Territorial scope, EUR-Lex, 2016
- Standard contractual clauses (SCC), European Commission, 2021
- The list of countries deemed adequate for GDPR transfers, Dastra, 2024
- Verizon's 2025 Data Breach Investigations Report: System intrusion breaches double in EMEA, Verizon, 2025
- IBM Report: 13% of organizations reported breaches of AI models or applications, 97% of which reported lacking proper AI access controls, IBM Newsroom, 2025
