GDPR

Lawful Basis for Processing

Every processing activity must have a documented lawful basis — Consent, Contract, Legal Obligation, Vital Interests, Public Task, or Legitimate Interests.

Privacy Notices

Transparent, plain-language privacy notices must be provided at the point of data collection — covering purposes, legal basis, retention periods, and data subject rights.

Data Subject Rights

Implement processes to handle: Right of Access, Right to Rectification, Right to Erasure (RTBF), Right to Portability, Right to Object, and rights related to automated decision-making.

Article 28 — Data Processing Agreements

As a Processor, sign DPAs with all EU Data Controllers specifying processing purposes, sub-processor requirements, security measures, and audit rights.

Data Protection Impact Assessments (DPIA)

Conduct DPIAs before high-risk processing activities — large-scale processing of sensitive data, systematic monitoring, or use of new technologies.

International Transfers (Chapter V)

Data transfers to India require a legal transfer mechanism — Standard Contractual Clauses (SCCs), Binding Corporate Rules, or adequacy decision. India does not have EU adequacy status.

Data Breach Notification

Notify the relevant supervisory authority within 72 hours of becoming aware of a personal data breach. Notify affected individuals if high risk to their rights.

Appointment of DPO

Appoint a Data Protection Officer if processing EU citizens' data at large scale, or if core activities involve systematic monitoring. DPO must be independent.