GDPR for Indian Companies (with DPDP Crosswalk) Practitioner

The six lawful bases under Article 6 and why Indian practitioners default too easily to consent. The three-part legitimate-interests test post EDPB Guidelines 1/2024. Article 7 conditions for valid consent.

Article 9 special-category processing gateways. DPDP Section 4-7 crosswalk (consent-plus-legitimate-uses vs GDPR six-basis architecture). Adtech legal basis after IAB Europe (C-604/22) and Meta v Bundeskartellamt (C-252/21).

1. 1. The six Article 6 lawful bases and why consent is overused 10 min
2. 2. Legitimate interests: the three-part test (Guidelines 1/2024) 11 min
3. 3. Article 7 consent standards and Guidelines 05/2020 10 min
4. 4. Article 9 special categories and the ten Art 9(2) gateways 9 min

Chapter III rights inventory. Access (Art 15) playbook. Erasure (Art 17) six triggers and ten exceptions.

Portability (Art 20) machine-readable format. Objection (Art 21) and automated-decision rights (Art 22). DPDP Sec 11-14 union of rights plus the Sec 13 nomination extension unique to DPDP.

Building one DSR workflow that satisfies both regimes.

1. 1. The rights inventory and the one-month response clock 8 min
2. 2. Article 15 access requests: the practitioner playbook 9 min
3. 3. Article 17 erasure: six triggers, ten exceptions 10 min
4. 4. Articles 20, 21, 22: portability, objection, automated decisions 9 min

Determining the role is factual, not what the contract calls it (EDPB Guidelines 07/2020). Article 28 processor contract eight mandatory clauses. Joint controllership Article 26 and the transparency arrangement.

Subprocessor onboarding and flow-down. Article 30 records of processing and what an Indian processor's ROPA must show. Practical: an Indian IT services firm on Module 2 SCCs plus a signed DPA.

1. 1. Determining the role: factually, not contractually 9 min
2. 2. Article 28 processor contract: the eight mandatory clauses 10 min
3. 3. Joint controllership under Article 26 and the transparency obligation 8 min
4. 4. Article 30 records of processing: what an Indian processor's ROPA must show 8 min

When Article 37 requires a DPO. How Articles 38-39 protect DPO independence and set the tasks. Article 35 DPIA when and how, using WP248 nine criteria.

Prior consultation Article 36. Records under Article 30. DPDP Section 10 SDF trigger and Rule 12 DPIA-plus obligations including the algorithmic-fairness audit.

One DPO office that satisfies both regimes.

1. 1. Article 37 DPO trigger: when a DPO must be appointed 8 min
2. 2. Articles 38-39: DPO independence, resources, tasks 9 min
3. 3. Article 35 DPIA: when and how 10 min
4. 4. One DPO office serving GDPR and DPDP in parallel 7 min

Article 33 notification to DPA within 72 hours: when the clock actually starts (EDPB Guidelines 9/2022 v2.0). Article 34 notification to data subjects, the high-risk test. DPDP Rule 7 breach notification (Data Principal notice without delay, DPB report in 72 hours).

CERT-In 6-hour reporting under the 28 April 2022 Directions. Triple-clock worked scenario: a ransomware incident at an Indian SaaS with EU customers.

1. 1. Article 33: when the 72-hour clock actually starts 10 min
2. 2. Article 34 data-subject notification: the high-risk test 8 min
3. 3. The triple clock: CERT-In 6h, DPDP 72h, GDPR 72h 9 min
4. 4. Worked scenario: ransomware at an Indian SaaS with EU customers 10 min

Chapter V architecture: adequacy first (Art 45), then Article 46 mechanisms, then Article 49 derogations. Current adequacy list as of Aug 2026 (Brazil mutual adopted 26 Jan 2026, UK renewed 19 Dec 2025). Why India is not on the list and what that means.

Commission SCCs 2021/914 four modules walkthrough. Schrems II Transfer Impact Assessment obligation. EU-US Data Privacy Framework current status and the Latombe appeal (C-703/25 P) pending at CJEU.

DPDP Section 16 plus Rule 15 negative-list architecture as the mirror of GDPR positive-list adequacy.

1. 1. Chapter V architecture: adequacy, Article 46, Article 49 derogations 8 min
2. 2. Commission SCCs 2021/914: four modules walkthrough 10 min
3. 3. Schrems II TIA obligation: the practitioner working reference 10 min
4. 4. EU-US Data Privacy Framework: read as fragile additional layer 8 min
5. 5. DPDP Section 16 + Rule 15: the negative-list mirror 7 min

The adjacent EU instruments that reach Indian entities: DSA (Reg 2022/2065), DMA (Reg 2022/1925), Data Act (Reg 2023/2854), AI Act (Reg 2024/1689) as amended by Digital Omnibus on AI (Reg 2026/1744, in force 27 July 2026 with high-risk AI postponed to 2 Dec 2027 and 2 Aug 2028), NIS2 (Directive 2022/2555). Top-15 GDPR fines 2018-2026 with practitioner lesson each. 2024-2026 enforcement pattern: coverage-gap transfers, adtech legal-basis failures, plaintext-password Art 32 breaches, third-country transfer enforcement.

Capstone: design an end-to-end dual-regime compliance programme for an Indian IT services firm processing EU customer personal data.

1. 1. DSA, DMA, Data Act, AI Act, NIS2: what reaches an Indian entity 11 min
2. 2. Top-15 GDPR fines 2018-2026: practitioner lessons 11 min
3. 3. Reading the 2024-2026 enforcement pattern 8 min
4. 4. AI Act plus GDPR for Indian AI providers: DPIA plus FRIA overlap 8 min
5. 5. Capstone: dual-regime compliance programme for an Indian IT services firm 13 min

Final certification exam covering all eight content modules. Every question is anchored to a specific GDPR Article, Recital, EDPB Guideline, CJEU judgment, DPA enforcement order, DPDP Section or Rule, or CERT-In Direction cited in the course. Randomised order, shuffled options, explanations shown after each question cite the source.

Lessons coming soon.