Indian software and SaaS handling EU data

Selling software into the EU pulls in four separate regimes at once: the GDPR as a processor or controller, the Chapter V transfer rules for the data that lands in India, the Cyber Resilience Act where software is placed on the market as a product, and the accessibility requirements for consumer-facing services. Add the AI Act on top where the product embeds a model.

• Establish your role per processing activity: processor for customer data, controller for your own account and telemetry data, and paper each one correctly.
• Sign a data processing agreement that meets Article 28, including the sub-processor list, the audit right and the assistance duties.
• Handle the transfer separately from the contract: Standard Contractual Clauses plus a transfer impact assessment for the India leg.
• Meet the security requirements: breach notification within 72 hours to the customer's authority route, and the CRA vulnerability handling duties where software ships as a product.
• Check the accessibility requirements for e-commerce, banking and consumer services; they apply to the interface, not only to the back end.

• GDPR Article 28: processorArticle nodeOfficial text
• GDPR Article 32: security of processingArticle nodeOfficial text
• GDPR Article 33: notification of a personal data breachArticle nodeOfficial text
• Directive (EU) 2019/882 on accessibility requirementsArticle node
• Cyber Resilience Act (EU) 2024/2847: software placed on the marketArticle node

• Do Indian SaaS companies need an EU representative?
• Do Indian IT services firms need GDPR compliance without an EU office?
• What EU requirements apply to Indian SaaS companies selling services in the EU?
• What EU requirements apply to Indian software companies handling EU data?

• Data transfers from the EU to India
• Cyber Resilience Act
• AI Act: provider obligations
• All requirements
• Indian law against EU law

Sector

SaaS, software products, IT services

Read date

2026-08-26

Register version

in-export-v1.0.0

Address

/in/export/software-eu-data