An Indian subsidiary that handles personal data of UK customers or staff makes that data a restricted transfer under UK GDPR, because India does not have UK adequacy. The UK group needs a transfer mechanism, a risk assessment and security terms. India's Digital Personal Data Protection Act applies on top, with the main obligations starting on 13 May 2027. Processing only for a foreign controller under contract is largely exempt from the Indian notice and consent duties, but not from the security safeguards.
← Back to the complete guide: How to Set Up a Subsidiary in India from the UK
Key facts
| UK to India transfers | Restricted transfers under UK GDPR; no UK adequacy for India; use the International Data Transfer Agreement or the UK Addendum to the EU standard clauses, with a transfer risk assessment |
|---|---|
| Indian law | Digital Personal Data Protection Act, 2023 and Rules, notified 13 November 2025 |
| Phasing of the Rules | Board and procedural provisions from 13 November 2025; consent manager provisions from 13 November 2026; main duties and penalties from 13 May 2027 |
| Breach reporting | To the Data Protection Board of India without delay, with a detailed report within 72 hours, in addition to UK reporting duties where UK GDPR applies |
| Penalties | Up to ₹250 crore under the Act for failure to take security safeguards |
| Cross-border transfer from India | Permitted unless to a country restricted by notification; sector rules and specified data may be restricted |
| Regulators | Information Commissioner's Office (UK) and Data Protection Board of India |
Two regimes that meet in one subsidiary
UK GDPR applies to personal data the UK group controls, wherever the processing happens. The DPDP Act applies to digital personal data processed in India, and to processing outside India for offering goods or services to people in India. An Indian captive centre working for the UK parent will therefore usually sit under both: the UK parent as the controller under UK GDPR, the Indian company as its processor, and the Indian company as a data fiduciary for its own employees and Indian customers.
Sending UK personal data to India
- Map the data flows: what personal data goes to India, whose data it is, why and who has access.
- Choose the transfer mechanism. India does not have a UK adequacy regulation, so use the International Data Transfer Agreement, or the UK Addendum to the EU standard contractual clauses, or binding corporate rules for a large group.
- Complete a transfer risk assessment covering Indian law on government access and the safeguards in place.
- Put the processor terms in the intercompany services agreement: purposes, security, sub-processors, audit rights, breach notice and return or deletion.
- Update privacy notices for UK individuals so that they name India as a destination and the safeguard.
- Re-test the position whenever the Data (Use and Access) Act reforms and UK guidance change the transfer test.
India's DPDP Act: what applies and when
| Date | What starts |
|---|---|
| 13 November 2025 | The Rules are notified; the Data Protection Board of India and procedural provisions begin |
| 13 November 2026 | Rules for consent managers, including registration requirements |
| 13 May 2027 | Main duties: notice and consent, security, retention, breach notification, children's data, rights of data principals, cross-border rules, and the Board's full penalty powers |
- Notice and consent: clear, itemised notice and a way to withdraw consent. Employment has some legitimate-use grounds.
- Security: reasonable safeguards such as encryption, access controls, logging and backups, and processor contract terms. Logs must be kept for a year.
- Breaches: notify the Board and affected individuals without delay and report in detail within 72 hours.
- Significant data fiduciaries: larger or riskier processors can be designated, with impact assessments, audits and possible localisation requirements.
The processor exemption that helps captive centres
The Act exempts most notice and consent duties for processing personal data of people outside India under a contract with a foreign party. A captive centre handling UK customer data for its UK parent can often rely on this, but the exemption does not remove the duty to keep the data secure, and it does not cover the Indian company's own employee or Indian customer data. Do not assume it covers everything: document which data sets fall under it.
Setting up governance in the Indian subsidiary
- Name a privacy lead in India who reports to the UK data protection officer or privacy team.
- Align the group's information-security standards with the Indian entity's controls, because the security duty applies under both laws.
- Include data protection in employee contracts and onboarding. See hiring in India.
- Treat data localisation as a live possibility for regulated sectors such as financial services, payments and telecoms.
- Review the position each year, because the Indian Rules phase in and UK law is still being updated.
Official sources
Check the rules at the primary sources: Income Tax Department (India), Reserve Bank of India, Ministry of Corporate Affairs, HMRC, Companies House and the UK legalisation service for apostilles.
Frequently asked questions
Is India adequate for UK GDPR transfers?
No. India does not currently have a UK adequacy regulation, so a UK controller sending personal data to an Indian subsidiary needs a transfer mechanism such as the International Data Transfer Agreement or the UK Addendum, plus a transfer risk assessment.
What is India's DPDP Act?
India's Digital Personal Data Protection Act, 2023, which the Digital Personal Data Protection Rules, 2025 bring into effect in phases. The main duties and penalties begin on 13 May 2027.
Does the DPDP Act apply to an Indian captive centre working for a UK company?
Yes, to processing in India, but processing personal data of people outside India under a contract with a foreign party is largely exempt from the notice and consent duties. The security safeguards still apply.
How fast must a data breach be reported in India?
Without delay to the Data Protection Board and affected individuals, with a detailed report to the Board within 72 hours, once the main provisions apply on 13 May 2027. UK GDPR reporting duties can apply in parallel.
Can personal data be transferred out of India?
Generally yes, unless the destination is restricted by government notification. Sector regulators and specified data sets can have stricter local storage rules.
Who is the controller and who is the processor between a UK parent and an Indian subsidiary?
For UK customer data the UK parent is normally the controller and the Indian subsidiary its processor, with the terms set out in the intercompany services agreement. For the subsidiary's own employees, the Indian company is the data fiduciary.
Related guides
Hiring in India as a UK Employer: How Indian Employment Differs, and What to Put in the Contract
How a UK company should hire in India through its subsidiary: contracts, provident fund, ESI, gratuity, the labour codes, payroll, and how to extend share plans to Indian employees.
Read the guide →Building a Global Capability Centre in India as a UK Company: Models, Staging, Regulation and Pricing
How a UK company can build a captive Global Capability Centre (GCC) in India: models, stages, regulated-firm outsourcing rules, transfer pricing, PE risk, talent and governance.
Read the guide →Contracts, Courts and Arbitration in India for UK Companies: Enforcing English Judgments and Awards
How a UK company should draft contracts with its Indian subsidiary and customers, choose governing law and seat, and enforce English court judgments and arbitral awards in India.
Read the guide →What a UK Parent Must Handle on Its Own Side When It Owns an Indian Subsidiary
The UK-side tax and compliance duties of a parent with an Indian subsidiary: dividend exemption, CFC rules, foreign tax credit, UK transfer pricing, Pillar Two, and the UK bribery and failure-to-prevent-fraud laws.
Read the guide →Sources
Last updated 19 October 2026. General information only, not legal or tax advice. Indian and UK rules change often; confirm current requirements before acting.