Data transfers from the EU to India

The European Commission has not issued an adequacy decision for India, so personal data cannot be sent from the EU to India on that basis. The route available is the appropriate safeguards in Chapter V, which in practice means the Commission's Standard Contractual Clauses backed by a transfer impact assessment. This applies to Indian IT services firms, BPOs, GCCs and SaaS vendors alike, whether or not they have an EU office.

• Sign the Commission's Standard Contractual Clauses and select the module that matches the real roles: controller to processor for most IT services and BPO work, controller to controller where the Indian entity decides purposes of its own.
• Complete a transfer impact assessment covering Indian government access powers, including the Information Technology Act section 69 interception route and the Telecommunications Act, and record what you concluded.
• Document supplementary measures concretely: encryption in transit and at rest, keys held in the EU, field minimisation, pseudonymisation of production data used in development, and a documented process for handling government access requests.
• Record the transfer in the record of processing activities and name India as the recipient country in the privacy notice.
• Map the Indian side in parallel: the Digital Personal Data Protection Act 2023 imposes its own obligations on the same processing, and satisfying one does not satisfy the other.

• GDPR Article 44: general principle for transfersArticle nodeOfficial text
• GDPR Article 45: transfers on an adequacy decisionArticle nodeOfficial text
• GDPR Article 46: transfers subject to appropriate safeguardsArticle nodeOfficial text
• GDPR Article 47: binding corporate rulesArticle nodeOfficial text
• GDPR Article 48: transfers not authorised by Union lawArticle nodeOfficial text
• GDPR Article 49: derogations for specific situationsArticle nodeOfficial text
• GDPR Article 28: processor obligationsArticle nodeOfficial text

• How do you transfer personal data between India and the EU under GDPR Chapter V?
• Can the EU Standard Contractual Clauses be modified?
• Does complying with the DPDP Act mean we comply with the GDPR?

• EU representative and responsible person
• Indian software and SaaS handling EU data
• AI Act: provider obligations
• All requirements
• Indian law against EU law

The same requirement is published for Chinese exporters in simplified Chinese: 个人信息出境：GDPR 第五章

Sector

IT services, SaaS, BPO, GCC

Read date

2026-08-26

Register version

in-export-v1.0.0

Address

/in/export/gdpr-chapter-v