Personal data about people in Spain can go to an Indian subsidiary only under one of the GDPR's transfer tools. India has no EU adequacy decision, so the usual tool is the Commission's standard contractual clauses, with a transfer impact assessment and supplementary measures where needed. In Spain the supervisory authority is the Agencia Española de Protección de Datos, and the Spanish organic law on data protection adds national rules, for example on employee monitoring. India's Digital Personal Data Protection Act, 2023 and the Rules notified on 13 November 2025 apply to the Indian company that processes personal data, with the main duties starting on 13 May 2027 and penalties of up to INR 250 crore for a serious breach. A group needs one data map, two sets of notices and a transfer contract that works under both.
← Back to the complete guide: How to Set Up a Subsidiary in India from Spain
Key facts
| EU rule | GDPR applies to personal data of people in the EU and to Spanish controllers; transfers to India need a transfer tool |
|---|---|
| Adequacy | No EU adequacy decision for India |
| Usual tool | Standard contractual clauses plus a transfer impact assessment |
| Spanish regulator | Agencia Española de Protección de Datos; the Spanish organic law adds local rules |
| Indian law | Digital Personal Data Protection Act, 2023; Rules notified 13 November 2025 |
| Indian timeline | Main duties from 13 May 2027, in stages |
| Indian penalty | Up to INR 250 crore for the most serious breaches |
| Employee data | Needs a lawful basis in both systems and a clear notice |
Start with a data map
Before you choose a legal tool, map what data moves, in which direction, for what purpose and under whose control. A Spanish parent usually sends employee and recruitment data to India for payroll, performance and group reporting, and customer or user data for support and software development. An Indian subsidiary sends back operational data and sometimes data about Indian customers. Each flow has a controller, a processor or a joint controller, and a purpose, and each one needs a contract. A written data map is also the first document the Spanish regulator or an Indian customer will ask to see.
GDPR transfers to India
Under Chapter V of the GDPR a transfer to a country without an adequacy decision needs an appropriate safeguard. For a group the main choices are standard contractual clauses and binding corporate rules. Standard contractual clauses are the faster option, and the module depends on the roles: controller to controller, controller to processor, or processor to processor. The exporter must also assess whether the law and practice of India would undermine the protection the clauses give, for example because of government access powers, and add technical and organisational measures such as encryption and access controls. The result is documented as a transfer impact assessment. The derogations in Article 49, for example explicit consent, are for occasional transfers and not for regular group flows.
The GDPR applies to the Indian subsidiary directly if it offers goods or services to people in the EU or monitors their behaviour. In that case it may also need an EU representative. Keep records of processing, a breach procedure that meets the 72-hour notice and a data protection officer where the Spanish rules require one.
The Spanish layer
Spain's organic law on the protection of personal data and the guarantee of digital rights adds rules on children's data, on the right to digital disconnection, on video surveillance and on the use of digital devices by employees. A Spanish parent that monitors Indian staff or shares Spanish employee data with India should check these rules. The Agencia Española de Protección de Datos publishes guidance and handles complaints and enforcement, and fines under the GDPR can reach EUR 20 million or 4% of worldwide turnover, whichever is higher.
India: the DPDP Act and Rules
The Digital Personal Data Protection Act, 2023 regulates digital personal data processed in India and, in some cases, outside India for offering goods or services to people in India. The Rules, notified on 13 November 2025, bring the Act into operation in stages, with the main obligations of data fiduciaries applying from 13 May 2027. A data fiduciary must give a clear notice, obtain consent or rely on a listed legitimate use, keep data accurate, secure it, delete it when the purpose ends, report breaches to the Data Protection Board and to affected people, and respond to requests from individuals. Significant data fiduciaries have extra duties such as audits and a data protection officer in India. The Act permits cross-border transfers except to countries the government restricts, so the main constraint on moving data from India to Spain is contractual and sectoral, not a blanket ban.
Penalties are set in a schedule and reach up to INR 250 crore for a failure to take reasonable security safeguards. Because the Rules phase in, a group has until May 2027 to prepare, and should use the time to align notices, consent flows and retention rules.
GDPR and DPDP side by side
| Topic | GDPR (Spain) | DPDP Act and Rules (India) |
|---|---|---|
| Scope | Personal data of people in the EU and processing by EU establishments | Digital personal data processed in India, and abroad for offering goods or services to people in India |
| Legal basis | Consent, contract, legal obligation, vital interests, public task, legitimate interests | Consent, or listed legitimate uses |
| Notice | Detailed privacy notice | Itemised notice in clear language and, on request, in listed Indian languages |
| Breach notice | Authority within 72 hours where required | Board and affected individuals; timing set in the Rules |
| Rights | Access, rectification, erasure, restriction, portability, objection | Access, correction, erasure, grievance redress and nomination |
| Transfers | Adequacy, standard clauses, binding corporate rules or derogations | Allowed except to restricted countries and subject to sector laws |
| Regulator | Agencia Española de Protección de Datos | Data Protection Board of India |
| Maximum penalty | EUR 20 million or 4% of worldwide turnover | Up to INR 250 crore |
Employee and recruitment data
- Use an employee notice that explains that data goes to the Indian company and, where relevant, back to Spain, and for what purpose.
- Do not rely on consent alone for staff data in Spain, because consent in employment is rarely free; use contract or legitimate interests where available.
- Restrict access to sensitive data such as health and union membership.
- Agree retention periods that satisfy both systems, and delete on schedule.
- Keep background checks proportionate and compliant with local law in both countries.
- Record which Indian staff may see data about Spanish employees.
A practical data transfer package
- A data map and records of processing for both companies.
- An intra-group data transfer agreement incorporating the standard contractual clauses, with annexes for the real flows.
- A transfer impact assessment and a list of supplementary measures.
- Aligned privacy notices for Spanish employees, Indian employees and customers.
- An incident response plan that meets the 72-hour GDPR notice and the DPDP breach rules.
- A vendor list and processor contracts for cloud and software providers.
- A DPDP readiness plan for the period to May 2027.
Official sources
Check the rules at the primary sources: Income Tax Department (India), Reserve Bank of India, Ministry of Corporate Affairs, Agencia Tributaria (Spain), Spanish Ministry of Economy, Trade and Business and the Ministry of External Affairs (India).
Frequently asked questions
Can a Spanish company send personal data to India?
Yes, using a GDPR transfer tool. India has no adequacy decision, so standard contractual clauses with a transfer impact assessment are the usual choice.
Is there an EU adequacy decision for India?
No, as far as we know. Check the European Commission's list before relying on this.
Who regulates data protection in Spain?
The Agencia Española de Protección de Datos, under the GDPR and the Spanish organic law.
What is the DPDP Act?
India's Digital Personal Data Protection Act, 2023, with Rules notified on 13 November 2025.
When do the main DPDP duties start?
On 13 May 2027, in stages under the Rules.
What is the DPDP penalty?
Up to INR 250 crore for the most serious breaches, as set in the Act's schedule.
Does DPDP block transfers to Spain?
No blanket ban. The Act permits transfers except to countries the government restricts, subject to sector laws.
Do standard contractual clauses cover staff data?
Yes, if the module and annexes describe the real flows. A transfer impact assessment is also needed.
Does GDPR apply to the Indian subsidiary?
Directly, only if it offers goods or services to people in the EU or monitors their behaviour. Otherwise the clauses carry the obligations.
Related guides
Hiring Staff in India from Spain: Employment Contracts, Provident Fund, State Insurance, the Four Labour Codes, Notice Periods and the Employer-of-Record Option
How a Spanish company hires in India: the entity or employer-of-record choice, offer letters and contracts, salary structure, payroll deductions, the labour codes reported in force from 21 November 2025, notice and termination, share awards and the differences that surprise Spanish managers.
Read the guide →Contracts and Disputes in India for Spanish Companies: Governing Law, Arbitration Seat, the New York Convention, Enforcing Spanish Judgments and Investment Protection
How to draft and enforce contracts with Indian counterparties from Spain: governing law, the choice of arbitration seat (Madrid, Singapore, London or Paris), enforcement of awards under the New York Convention, why Spanish court judgments are hard to enforce in India, interim relief, mediation, stamping and the status of investment treaty protection.
Read the guide →Two-Country Compliance Calendar: Indian Company Filings, Tax, Payroll and RBI Returns, Plus the Spanish Parent's D-8, Tax and Documentation Dates
One calendar for the whole year showing what the Indian subsidiary files with Indian authorities and what the Spanish parent files in Spain, with the Indian financial year of April to March set against the Spanish calendar year and the points where they collide.
Read the guide →What a Spanish Parent Must Do at Home: Registro de Inversiones Exteriores Filings, Participation Exemption, CFC Rules and Corporate Records
The Spanish-side steps for a parent investing in India: declarations to the Registro de Inversiones Exteriores (forms D-5A and D-8), board and notarial formalities, the participation exemption, CFC rules, related-party documentation and the beneficial ownership register.
Read the guide →Sources
Last updated 2 November 2026. General information only, not legal or tax advice. Indian and Spanish rules change often; confirm current requirements before acting.