GDPR Applies to You — Regardless of Where You Are Based
Article 3 of GDPR contains its "extraterritorial scope." In plain language, it means GDPR applies to any organization that processes personal data of people in the European Union — regardless of where that organization is located.
If you are an Indian SaaS company and any of the following is true, GDPR applies to you fully:
- You have customers or users in the EU
- Your product is available to EU residents
- You run marketing campaigns targeting EU users
- You use analytics tools that track EU visitors to your website
- You have EU residents' personal data in your database for any reason
This is not a technicality or a grey area. It is the law. EU data protection authorities have demonstrated repeatedly that they will pursue non-EU companies for violations.
What Does GDPR Actually Require?
At its core, GDPR requires you to do six things well.
Lawful basis for processing: You must have a documented legal reason for processing every category of personal data you collect. There are six options — consent, contract, legal obligation, vital interests, public task, and legitimate interests. You must choose one before processing begins, not after.
Transparency: You must be clear with users about what data you collect, why you collect it, how long you keep it, and who you share it with. Your privacy notice must be written in plain language that ordinary users can understand.
Individual rights: Users have eight specific rights over their data — including the right to access, correct, erase, and port their data. You must have processes to respond to these requests within one month, free of charge.
Data breach notification: If a breach occurs, you must notify your supervisory authority within 72 hours of becoming aware of it. If the breach poses high risk to individuals, you must also notify them directly.
Data Processing Agreements: You must have a signed DPA with every third-party vendor who handles personal data on your behalf — your cloud provider, analytics tool, email service, CRM, and so on.
Impact assessments: For high-risk processing activities, you must conduct a Data Protection Impact Assessment before beginning.
The WhatsApp fine of €225 million in 2021 was not for a data breach or hacking. It was purely for failing to be transparent about how user data was shared with Facebook. Transparency alone is a compliance obligation under GDPR.
The Most Common Gaps I See in Indian SaaS Products
After reviewing compliance programs across multiple technology companies, these gaps appear most consistently:
Privacy notices that fail the standard: Copied from another company's website, written in language users cannot understand, or missing required information like the legal basis for processing, data retention periods, or how to exercise rights.
Non-compliant consent mechanisms: Pre-ticked boxes, bundled consent for multiple purposes, or no genuine way to withdraw consent as easily as it was given. Cookie banners with only "Accept All" and no "Reject All" option are non-compliant.
No Data Processing Agreements: Most Indian SaaS companies use AWS, Google Cloud or Azure, Mixpanel, HubSpot, Mailchimp, and several other third-party services. Every single one of them is a data processor requiring a signed DPA. Most companies have signed none of them.
No Subject Access Request process: When a EU user emails asking for all data you hold on them, you have one month to respond, free of charge. If you have no documented process for this, you have a compliance gap.
No data breach response plan: The 72-hour notification window is short. If something goes wrong at 9am on a Monday, you must notify the relevant data protection authority by 9am Thursday. Most startups have no incident response plan.
The GDPR + DPDP Act + CCPA Triple Challenge
Indian SaaS companies face a compliance complexity that European companies do not. You must simultaneously satisfy GDPR for EU customers, India's DPDP Act 2023 for Indian users, and potentially CCPA if you have California-based customers.
The good news is that all three frameworks share a common foundation — consent, transparency, data minimization, individual rights, accountability, and security run through all of them. A well-designed compliance program can satisfy all three simultaneously rather than treating them as separate projects.
What to Do Right Now — Practical Steps
Step 1: Conduct a data audit. Map every type of personal data you collect, why you collect it, where it is stored, who has access, and how long you keep it. This is the foundation of every compliance program.
Step 2: Document your legal basis. For every data processing activity, decide which of the six GDPR legal bases applies and write it down. Consent is not always the right choice — contract or legitimate interests may be more appropriate for some processing.
Step 3: Review and rewrite your privacy notice. Use ICO's guidance at ico.org.uk as your benchmark. It must be specific, plain-language, and cover all required information.
Step 4: Audit your vendors. List every third-party service that touches personal data and check whether you have a DPA with them. Most major providers (AWS, Google, Microsoft) have standard DPAs available online that you simply need to accept.
Step 5: Build a breach response plan. Know who is responsible for declaring a breach, who notifies the authority, how you identify what was affected, and how you communicate with users if required.
The time to address this is before an enterprise customer's security team sends you a compliance questionnaire, before an investor conducts due diligence, and before a user in the EU files a complaint with their national data protection authority.