GDPR for Indian D2C brands that sell to Europe

Selling to customers in Europe brings the EU's General Data Protection Regulation (GDPR) into play, even if your company is in India. This is general information, not legal advice.

Does it apply to you?

GDPR applies to organisations outside the EU when they offer goods or services to people in the EU or monitor their behaviour. Clues that you are targeting EU customers: shipping to EU countries, prices in euros, European languages, or marketing aimed at them. Simply having a website that an EU visitor can open is generally not enough.

The main principles

• Lawfulness, fairness and transparency. Tell people what you do with their data.
• Purpose limitation. Use data only for the stated purposes.
• Data minimisation. Collect only what you need.
• Accuracy and storage limitation. Keep it right and delete it when you no longer need it.
• Integrity and confidentiality. Secure it.
• Accountability. Be able to show how you comply.

Choose a lawful basis

For each use of data, pick a lawful basis. Common ones for stores: contract (taking and delivering an order), legal obligation (tax records), legitimate interests (fraud prevention) and consent (marketing emails and non-essential cookies). Consent must be freely given, specific and as easy to withdraw as to give.

Rights you must honour

Access to their data, correction, erasure, restriction, portability and objection, including objecting to direct marketing. You normally have one month to respond. Keep a simple process: a contact address, identity checks and a log.

Processors and transfers

• Sign data processing agreements with vendors that handle EU customers' data: your platform, email tool, analytics and logistics partners.
• Sending personal data from the EU to India is an international transfer, and needs a legal mechanism, such as standard contractual clauses, unless an adequacy decision applies. Your vendors usually help with this.

Other obligations that may apply

• An EU representative in some cases when you are outside the EU.
• A record of processing activities for larger or higher-risk operations.
• Breach notification: report to the supervisory authority within 72 hours where required, and to individuals if there is a high risk.
• Cookie rules under the ePrivacy rules, which need consent for non-essential cookies (guide).

Penalties

Serious infringements can attract fines of up to €20 million or 4% of worldwide annual turnover, whichever is higher. Regulators usually consider the size of the business and the effort made to comply.

A practical starter plan

1. Decide whether you are really targeting EU customers.
2. Publish a privacy notice that covers the points above.
3. Add a cookie banner that follows the rules.
4. Keep a list of vendors and check their data agreements.
5. Set up a way to receive and answer rights requests.
6. Write a short breach response plan (security checklist).

If you already follow India's rules, you have a head start: see DPDP for online stores. Also read accepting international payments.

What to do next

List which EU countries you ship to and which vendors touch their data. That list is the first thing any adviser will ask for.