Chartered Accountants◆Practising since 2016

Germany to India · Data

Personal data between Germany and India

CA Utsav Dogra, Chartered Accountant, ICAI M. No. 542375 · Updated

In brief

There is no EU adequacy decision for India, so personal data sent from the EU to the Indian company needs standard contractual clauses or binding corporate rules, backed by a transfer impact assessment. In India, the subsidiary's own processing falls under the Digital Personal Data Protection Act, 2023, with Rules notified in November 2025, most duties applying from 13 May 2027 and penalties up to ₹250 crore.

What is specific to German companies

Group HR and collaboration tools used in India can need a works council agreement in Germany, in addition to GDPR transfer clauses.

Our services

How SU and Company helps

We cover the Indian tax, FEMA and governance side and work alongside the group's legal counsel.

  • Tax and FEMA review of contract terms
  • Internal controls and documentation in the Indian company
  • Coordination with counsel on data protection

Questions

Does the DPDP Act apply to data of people outside India?

Some duties are relaxed where Indian entities process non-residents' data under a contract with a foreign party, but security duties remain.

General information as at 5 November 2026, not advice for a particular case. Indian and German rules change often; confirm the current position before acting. German law points should be confirmed with a German adviser.

Queries

Send the firm a query

Tell us briefly what you need. A member of the team will get back to you.

We use your details only to respond to your query. See our privacy policy.

Call