Does the GDPR apply to a business in India?
The General Data Protection Regulation does not apply to every business in India. It applies to a business outside the European Union when that business offers goods or services to people in the Union, or monitors their behaviour in the Union. A business that only deals with people in India is outside that rule.
When does it reach India?
Article 3 is the test. Offering goods or services to people in the Union is more than having a website that someone in Europe can open. Monitoring behaviour is tracking people in the Union. Where the test is met, the business deals with the rights the regulation gives those people. Where it is not met, the regulation is not the statute that governs the Indian customers.
What is the Indian law?
Personal data of people in India is the subject of the Digital Personal Data Protection Act, 2023. That Act is not the GDPR under another name. A business can be under one, the other, or both, depending on whose data it holds and where it offers its goods. This site’s own privacy note is on the privacy page. It is not a GDPR policy for every reader.
What does the regulation not do?
It does not incorporate a company, register a trademark, or file a tax return. Its administrative fines are fines of the Union. This page does not restate them as an Indian penalty, and it does not quote a rupee figure for the Indian Act.
Frequently asked questions
Four questions cover every Indian company, Indian law, a public website, and the fine.
Does every Indian company have to comply?
No. The regulation applies where the business offers goods or services to people in the European Union, or monitors their behaviour. A business that does neither is outside it.
Does the regulation replace Indian law?
No. The Digital Personal Data Protection Act, 2023 is the Indian statute. Complying with one does not automatically satisfy the other.
Is a website that can be viewed in Europe enough?
No. Accessibility of a site is not, by itself, offering goods or services to people in the Union. The regulation looks at whether the business envisages those people as customers, or monitors them.
Is the EU fine an Indian penalty?
No. The regulation sets administrative fines of the Union. This page does not treat those figures as a penalty under Indian law.
Sources
The General Data Protection Regulation is Regulation (EU) 2016/679. Its reach outside the Union is Article 3. The Indian statute is the Digital Personal Data Protection Act, 2023.