Fast facts
GDPR applies to the processing of personal data of individuals in the EU and EEA, regardless of where the processing organisation is established, when the processing relates to offering goods or services to those individuals or monitoring their behaviour within the Union.
It is built on seven principles — lawfulness, fairness and transparency; purpose limitation; data minimisation; accuracy; storage limitation; integrity and confidentiality; and accountability — with the last being the operative one in enforcement. Accountability means the burden of proof sits with the organisation: you must be able to demonstrate compliance, not merely assert it.
For Indian organisations the recurring difficulties are three: identifying a valid lawful basis where consent is impractical, meeting the one-month rights response window at scale, and establishing a lawful transfer mechanism for data moving to India, which requires appropriate safeguards and a documented transfer impact assessment.
Who it applies to
Penalties
Up to €20 million or 4% of total worldwide annual turnover, whichever is higher, for breaches of the basic principles, data subject rights or transfer rules. Up to €10 million or 2% for other infringements including records, security and breach notification failures.
The commercial and regulatory argument, rather than a restatement of the text. If none of these apply to you, the honest answer is that this framework is not your priority.
Article 3(2) applies to organisations outside the EU offering goods or services to individuals in the Union or monitoring their behaviour there. Euro pricing, EU-language checkout or analytics on EU visitors are all indicators.
It is not enough to comply; you must be able to demonstrate compliance. That single principle is what turns GDPR from a policy exercise into a documentation and evidence discipline.
India has no adequacy decision, so every India-bound flow requires an Article 46 mechanism plus a transfer impact assessment considering Indian access law, and supplementary measures where residual risk remains.
Scope is the decision that sets the cost, and it is usually made in week one when the team knows least. Both columns matter equally.
In scope
Out of scope
How the boundary is decided: Over-application is as costly as under-application. Confirm territorial scope precisely before building — organisations that assume GDPR applies to their entire global estate spend heavily on obligations they do not carry.
Stated as the duty rather than the clause number, because clause numbers do not tell an engineering team what to build.
A valid Article 6 basis for every processing purpose, an Article 9 condition where special category data is involved, and layered privacy information meeting Articles 13 and 14.
Access, rectification, erasure, restriction, portability, objection and rights relating to automated decision-making, fulfilled within one month and extendable by two where justified.
Article 30 records maintained by controllers and processors, describing purposes, categories, recipients, transfers, retention and security measures.
Technical and organisational measures embedded from the design stage, with default settings that minimise processing and exposure.
Impact assessment where processing is likely to result in high risk, and consultation with the supervisory authority where residual risk remains high.
Notification to the supervisory authority within 72 hours of becoming aware, and to data subjects without undue delay where there is high risk to their rights and freedoms.
An Article 46 transfer mechanism — typically Standard Contractual Clauses — supported by a transfer impact assessment and supplementary measures where required.
The areas your teams will actually be building in, with control counts where the framework defines them.
Basis determination per purpose, consent capture meeting the GDPR standard, and withdrawal handling.
Intake, identity verification, search across systems, response drafting and evidence within statutory windows.
Article 30 records, DPIA register, legitimate interest assessments and demonstrable governance.
Transfer mapping, SCC execution, transfer impact assessments and supplementary technical measures.
Article 28 contracts, sub-processor authorisation, audit rights and assistance obligations.
Article 32 measures proportionate to risk, and a 72-hour breach assessment and notification capability.
Phases overlap deliberately. Design begins before assessment closes, so the programme does not stall waiting for a document to be signed off.
Weeks 1–3
Establish precisely which processing is caught by Article 3, and whether an Article 27 representative in the Union is required.
Weeks 3–7
Determine an Article 6 basis per purpose and an Article 9 condition where special category data is involved, with legitimate interest assessments where that basis is used.
Weeks 6–13
Article 30 records generated from the data inventory, and rights fulfilment instrumented against the one-month clock with search coverage across all systems.
Weeks 10–18
Execute Standard Contractual Clauses, complete transfer impact assessments for every India-bound flow, and bring Article 28 processor contracts up to standard.
Weeks 16–22
Rehearse the 72-hour clock including the decision to notify with incomplete information, and establish the ongoing accountability evidence rhythm.
Named artefacts, listed in the statement of work. If something is not on this list, we will tell you before you sign rather than after.
GDPR has applied since 25 May 2018. A readiness programme for an Indian organisation typically runs 14–22 weeks depending on the number of systems and transfer routes.
Scope and basis
Weeks 1–7
Establishes what is caught and on what lawful basis. Getting this wrong invalidates downstream work.
Records and rights
Weeks 6–13
Article 30 records and rights fulfilment built against the statutory clock.
Transfers and contracts
Weeks 10–18
SCCs, TIAs and processor agreements. Frequently the longest phase for Indian organisations.
Breach and assurance
Weeks 16–22
72-hour capability rehearsed and accountability evidence established.
The sequence we follow, and the parts where first-time implementations most often lose time.
Confirm territorial scope precisely — over-application is as costly as under-application.
Establish lawful basis per purpose, with legitimate interest assessments where that basis is used.
Build Article 30 records from the data inventory so they stay current automatically.
Instrument rights fulfilment against the one-month clock with search coverage across all systems.
Execute SCCs and complete transfer impact assessments for every India-bound data flow.
Rehearse the 72-hour breach clock, including the decision to notify with incomplete information.
Turn data protection law into working product behaviour.
We map where personal data actually lives, rebuild consent and rights flows into your product, and leave you with a privacy programme that survives an audit and a board question.
Explore capabilityA named, qualified DPO — accountable, available and independent.
Statutory Data Protection Officer capability delivered as a service: named point of contact, regulator liaison, DPIA sign-off and board reporting, without a full-time hire.
Explore capabilityCertification without the eighteen-month scramble.
Readiness, implementation and audit support for ISO 27001, ISO 27701, ISO 42001, SOC 2 and PCI DSS — run as a project with dates, owners and a definition of done.
Explore capabilityNot a table of statutory contrasts. The seven places where the two regimes diverge enough to change your data model, your consent screens and your engineering backlog.
A consent banner records a choice. A consent architecture enforces it. Here is the two-hour test that shows which one you have — and how to fix the gap.
Independence is not a job title. It is a reporting line, a documented advice trail, and protection from consequence. Here is what regulators look for and what fails.
Sequencing matters. Running these together off one control library costs meaningfully less than running them apart.
Including the questions where the honest answer is less convenient than the marketing one.
Ask a practitioner directly. First responses come from the person who would run your engagement, within one business day.
Ask a question
