A German company that sends personal data to its Indian subsidiary makes a restricted transfer under the GDPR. India has no EU adequacy decision, so the usual tools are the standard contractual clauses with a transfer impact assessment, or binding corporate rules for larger groups. For employee data, German law adds a works council co-determination right over many HR and monitoring systems. The Indian subsidiary must meet India's Digital Personal Data Protection Act as its duties take effect: the Rules were notified on 13 November 2025 and the main duties start on 13 May 2027.
← Back to the complete guide: How to Set Up a Subsidiary in India from Germany
Key facts
| German and EU law | GDPR and the Federal Data Protection Act (BDSG); supervised by the state data protection authorities |
|---|---|
| Transfer rule | Chapter V GDPR: no adequacy decision for India, so use standard contractual clauses (2021 version), binding corporate rules or another Article 49 basis, plus a transfer impact assessment |
| Employee data | Section 26 BDSG and the works council's co-determination right over technical systems that can monitor staff |
| Data protection officer | Required in Germany where 20 or more people are constantly engaged in automated processing, and in other cases by risk |
| Breach notice | Notify the authority within 72 hours where there is a risk to individuals |
| Penalty (EU) | Up to EUR 20 million or 4% of worldwide annual turnover, whichever is higher |
| Indian law | Digital Personal Data Protection Act, 2023; Rules notified 13 November 2025; main duties from 13 May 2027 |
| Indian penalty | Up to INR 250 crore for serious failures such as security safeguards |
GDPR: sending data from Germany to India
Personal data may leave the EU only if the transfer has a lawful basis under Chapter V of the GDPR. There is no adequacy decision for India, so a German company that gives an Indian subsidiary access to customer, supplier or employee data must put safeguards in place and check that they work in practice.
- Standard contractual clauses: the 2021 EU clauses, signed between the German exporter and the Indian importer, in the right module for controller-to-processor or controller-to-controller transfers.
- Transfer impact assessment: a written assessment of Indian law and practice on government access to data, with extra safeguards where needed, such as encryption with keys held in the EU.
- Binding corporate rules: an option for larger groups that want one approved regime, but approval takes time.
- Records and notices: update the record of processing and the privacy notices to show India as a recipient country.
- Remote access counts: viewing data from India on a German server is a transfer.
Employee data and the works council
- Section 26 of the Federal Data Protection Act sets the rules for processing employee data for employment purposes, and the works council has a co-determination right over technical systems that can monitor behaviour or performance.
- Introducing a group HR system, a time tracker or a collaboration tool that Indian staff and German staff both use can need a works council agreement in Germany.
- Where an Indian team handles German employee data, for example as a payroll or HR service centre, the works council usually expects safeguards and a clear scope.
- Indian employee data is also personal data under the DPDP Act once the main duties apply.
India: the DPDP Act and Rules
- Who is covered: processing of digital personal data within India, and outside India if connected to offering goods or services in India.
- Notice and consent: clear notice and free, specific consent for most processing, with allowed 'legitimate uses' such as employment purposes.
- Data fiduciary duties: security safeguards, breach notice to the Data Protection Board and to affected people, erasure when the purpose ends.
- Significant data fiduciaries: larger or riskier processors face extra duties, including an audit and an impact assessment.
- Cross-border: transfers out of India are allowed except to countries the government restricts by notification.
- Timeline: the Rules were notified on 13 November 2025 and the main obligations take effect on 13 May 2027.
A comparison
| Topic | GDPR (Germany) | DPDP Act (India) |
|---|---|---|
| Scope | Personal data of individuals in the EU context | Digital personal data and non-digital data that is digitised |
| Grounds | Consent, contract, legal duty, legitimate interests and others | Consent and listed legitimate uses |
| Cross-border | Restricted without adequacy or safeguards | Allowed unless the destination is restricted by notification |
| Breach notice | Authority within 72 hours; individuals if high risk | Board and individuals, under the Rules |
| Officer | Data protection officer by threshold or risk | Data Protection Officer for significant fiduciaries |
| Maximum penalty | Up to EUR 20 million or 4% of worldwide turnover | Up to INR 250 crore per breach category |
A build plan for one privacy programme
- Map what personal data moves between Germany and India and why: employee, customer, supplier and marketing data.
- Sign the standard contractual clauses and write the transfer impact assessment before data starts to flow.
- Agree any works council arrangements for HR and monitoring systems.
- Choose a single breach response procedure with clocks that satisfy both regulators.
- Update notices and consent flows for Indian individuals before 13 May 2027.
- Train the Indian team and run a tabletop breach exercise.
Official sources
Check the rules at the primary sources: Income Tax Department (India), Reserve Bank of India, Ministry of Corporate Affairs, Federal Central Tax Office (BZSt), Handelsregister and the Deutsche Bundesbank.
Frequently asked questions
Can a German company send personal data to its Indian subsidiary?
Yes, with a transfer mechanism such as the 2021 standard contractual clauses and a transfer impact assessment, because India has no EU adequacy decision.
Does the GDPR apply when Indian staff only view data remotely?
Yes. Remote access from India to data held in Germany is a transfer, so it needs a mechanism.
Do I need to involve the works council before giving Indian staff access to an HR system?
Often yes. A technical system that can monitor behaviour or performance is subject to co-determination, so check with the works council before rollout.
When do India's DPDP duties start?
The Rules were notified on 13 November 2025 and the main duties take effect on 13 May 2027.
What is the penalty under the GDPR and the DPDP Act?
The GDPR allows up to EUR 20 million or 4% of worldwide turnover. The DPDP Act allows up to INR 250 crore for serious failures.
How quickly must a data breach be reported in Germany?
To the data protection authority within 72 hours of becoming aware, where there is a risk to individuals.
Do I need a data protection officer in Germany?
Yes if 20 or more people are constantly engaged in automated processing of personal data, and in some other cases by risk. Many groups appoint one anyway.
Related guides
Hiring in India as a German Employer: What Changes from German Practice
A comparison for German HR teams hiring in India: employment contracts, provident fund, ESI, gratuity, labour codes, notice and dismissal, no works council, payroll tax and share plans, set against German practice.
Read the guide →Setting Up a Global Capability Centre in India: A Guide for German Mittelstand and Large Groups
How German companies set up captive engineering, IT and shared service centres in India: entity choice, cost-plus transfer pricing, export of services, the works council on offshoring, data and build-operate-transfer.
Read the guide →Contracts, Courts and Arbitration: Choosing Law and Seat, and Enforcing in India and Germany
How a German parent protects its Indian subsidiary contracts: choice of law, DIS and other arbitration, why German court judgments need a fresh suit in India, enforcing awards, stamping and the investment protection gap.
Read the guide →Common Mistakes German Companies Make in India and How to Avoid Them
The most frequent mistakes German companies make when setting up in India: late FEMA filings, missing forms for treaty relief, works council surprises, apostille errors, PE creation and transfer pricing gaps.
Read the guide →Sources
Last updated 26 October 2026. General information only, not legal or tax advice. Indian and German rules change often; confirm current requirements before acting.