How to Meet GDPR and India's Data Protection Law When Outsourcing to Pune

How to Meet GDPR and India's Data Protection Law When Outsourcing to Pune

You must comply with both the EU General Data Protection Regulation (GDPR) and India’s Digital Personal Data Protection Act (DPDP Act, 2023) when outsourcing software development to Pune, as these laws have extraterritorial reach and distinct requirements for data controllers and processors. The core challenge is ensuring that your Pune-based development partner acts as a lawful processor under GDPR while adhering to Indian consent and breach notification mandates.

Govindani Infotech Pvt. Ltd. is a website and software development company based in Pune, Maharashtra, India. Many founders assume that hiring local talent in Pune automatically aligns with their compliance needs, but legal jurisdiction is determined by where your users are located, not just where your code is written. If your platform serves EU residents, GDPR applies to your Indian vendor if they process personal data on your behalf. Simultaneously, if your platform serves Indian users, the DPDP Act governs how you and your vendor handle that data. This article outlines the specific technical and legal steps required to bridge these two regulatory frameworks.

Understanding the Legal Scope: Who Is a Controller and Who Is a Processor?

The first step in any compliance checklist is defining roles, because the obligations differ fundamentally between the entity collecting data (the controller) and the entity processing it on behalf of the controller (the processor). Under GDPR, you, the client, are the data controller, and your Pune development agency is typically the data processor. Under the Indian DPDP Act, you are the Data Fiduciary, and the agency is the Data Processor.

A critical misunderstanding is that outsourcing development transfers liability. It does not. In both GDPR and Indian law, the primary liability for data breaches, unlawful processing, or lack of consent remains with the controller or data fiduciary. Your Pune vendor is liable to you for contractual breaches, but regulatory fines from the European Data Protection Board (EDPB) or the Data Protection Board of India (DPBI) will initially target your organization. Therefore, your compliance strategy must treat the vendor relationship as an extension of your own compliance infrastructure, not a way to outsource risk.

When engaging in software development in Pune, you must clarify whether the vendor will access personal data during development, testing, and deployment. If they use production data, they are processing personal data. If they use only synthetic or anonymized data, their obligations are lighter, but you must verify the effectiveness of the anonymization. The DPDP Act introduces a specific definition of "significant data fiduciaries," which may trigger additional reporting requirements if you process large volumes of sensitive data. You need to assess if your venture falls into this category early in the project lifecycle to avoid retrofitting compliance later.

Contractual Safeguards: Drafting the Data Processing Agreement

A standard software service agreement is insufficient for data protection compliance. You need a specific Data Processing Agreement (DPA) that addresses both GDPR and DPDP Act requirements. This document must be signed before any personal data is transferred to the vendor.

Under GDPR, Article 28 mandates specific clauses in processor contracts. These include:

1. Instructions: The processor must only act on documented instructions from the controller.
2. Confidentiality: Personnel accessing data must be bound by confidentiality obligations.
3. Security: Appropriate technical and organizational measures must be implemented.
4. Sub-processors: The processor cannot engage sub-processors without prior specific or general written authorization.
5. Assistance: The processor must assist the controller in responding to data subject requests and handling breaches.
6. Deletion/Return: The processor must delete or return all personal data after the end of the service.

The DPDP Act has similar but distinct requirements. Section 8 mandates a contract between the Data Fiduciary and the Data Processor. This contract must ensure that the processor:

1. Processes data only for the purposes specified by the Data Fiduciary.
2. Takes reasonable security safeguards.
3. Notifies the Data Fiduciary of any data breach.
4. Deletes or returns data upon termination.
5. Cooperates with the Data Protection Board of India.

When working with a Pune-based firm, ensure the DPA explicitly mentions both regimes. A common gap is that Indian vendors often only reference Indian IT Act provisions. You must explicitly cite GDPR Article 28 and DPDP Act Section 8. If your Pune vendor uses third-party tools (e.g., cloud hosting in AWS Mumbai or Singapore, Jira, GitHub), these constitute sub-processors. You must maintain a list of these sub-processors and ensure that flow-down clauses are in place, binding the sub-processors to the same level of protection.

Technical Security Measures for Cross-Border Data Flow

Compliance is not just legal paperwork; it is technical implementation. The method of data transfer between your organization and the Pune development team must be secure and verifiable.

Encryption and Key Management

All personal data in transit must be encrypted using TLS 1.2 or higher. Data at rest must be encrypted using AES-256. Crucially, for GDPR compliance, the encryption keys should ideally be managed by the controller (you) or by a trusted third party, not exclusively by the processor (the vendor). If the Pune team holds the only keys to decrypt production data, they effectively have unrestricted access. For high-sensitivity projects, consider a key management service (KMS) where the vendor has access to encrypted data but not the keys, or where key rotation is controlled by you.

Access Control and Least Privilege

The development team in Pune should not have direct access to production databases containing live personal data. Instead, use segregated environments:

1. Development Environment: Uses synthetic or masked data.
2. Staging Environment: Uses anonymized production data.
3. Production Environment: Access is restricted to operations personnel, not general developers, and requires multi-factor authentication (MFA).

Role-Based Access Control (RBAC) must be implemented. A junior developer working on a UI component should not have database read access. Audit logs must record every access event, including who accessed what data and when. These logs should be retained and made available to you for audit purposes.

Data Minimization in the Codebase

During the software development phase, the architecture must support data minimization. This means the system should only collect and store the data strictly necessary for the specified purpose. If the Pune team builds a feature that collects email addresses but only needs them for password resets, the architecture must prevent the storage of other unnecessary fields. This is a technical decision made during the design phase, not a legal afterthought.

Consent Management and User Rights

Both GDPR and the DPDP Act are centered on user consent, but the mechanics differ. GDPR requires "freely given, specific, informed, and unambiguous" consent. The DPDP Act requires consent to be "informed, specific, and unambiguous," with a strong emphasis on the right to withdraw consent.

Implementing Consent Banners

If your platform collects data from users in the EU and India, your consent management platform (CMP) must be capable of geo-detecting the user's location. For EU users, you need a compliant CMP that logs the timestamp, IP address, and version of the consent form. For Indian users, the DPDP Act allows for implied consent in certain contexts, but explicit consent is required for sensitive personal data.

The Pune development team must integrate this CMP correctly. Common errors include:

• Pre-ticked boxes (invalid under GDPR).
• "Dark patterns" that make rejecting consent difficult.
• Failing to distinguish between essential cookies (which do not require consent) and tracking cookies (which do).

Fulfilling Data Subject Requests

Users have the right to access, rectify, erase, and restrict processing of their data. Your software must have an automated workflow to handle these requests. When a user submits a request, the system should:

1. Verify the user's identity.
2. Retrieve all relevant data from all connected systems.
3. Provide a downloadable copy (for access requests) or delete the data (for erasure requests).

The vendor must build these APIs into the core application. If you rely on manual database queries to fulfill requests, you are unlikely to meet the statutory timelines (usually 30 days under GDPR, and "reasonable" time under DPDP, which is often interpreted similarly). The code must support granular deletion, meaning that if a user deletes their account, their data is removed from primary databases, backups (with a retention policy), and third-party analytics tools.

Data Breach Notification Protocols

Data breaches are inevitable in large-scale operations, but the speed and accuracy of your response determine regulatory consequences. Both GDPR and the DPDP Act mandate breach notification, but the timelines are strict.

• GDPR: You must notify the relevant supervisory authority within 72 hours of becoming aware of a breach, unless the breach is unlikely to result in a risk to individuals. If there is a high risk, you must also inform the data subjects without undue delay.
• DPDP Act: The Data Fiduciary must notify the Data Protection Board of India without undue delay, providing details of the breach, data involved, and remedial actions. The Data Processor must notify the Data Fiduciary immediately upon becoming aware of the breach.

Your Pune vendor must have a defined incident response plan. They cannot wait for you to ask if something is wrong. The DPA should specify that the vendor notifies you within a defined short window (e.g., 24 hours) of detecting a security incident. This allows you to start the clock for your own regulatory notifications.

Coordinate with your vendor on what constitutes a "breach." Is it a lost laptop? A SQL injection attempt? An unauthorized API call? Define these scenarios in your security playbook. Ensure that the vendor's monitoring tools (SIEM, IDS) are configured to alert on these events and that these alerts are routed to a shared communication channel with your team, not just internal to the vendor.

Cross-Border Data Transfer Mechanisms

Transferring personal data from the EU to India, or from India to other jurisdictions, is a complex legal area.

GDPR: Standard Contractual Clauses (SCCs)

Since the EU-US Data Privacy Framework does not cover India, you cannot rely on adequacy decisions for transfers from the EU to India. You must use Standard Contractual Clauses (SCCs) approved by the European Commission. These are a set of pre-formulated contractual terms that protect personal data when transferred outside the EU. You must sign the relevant module of the SCCs (Module 2: Controller to Processor) with your Pune vendor.

Additionally, you should conduct a Transfer Impact Assessment (TIA). This is a documented analysis of whether the laws of the destination country (India) undermine the level of protection provided by the SCCs. While India has the DPDP Act, which is a positive factor, you should document this assessment to show regulators that you have considered the legal environment.

DPDP Act: Data Localization

The DPDP Act does not have a strict data localization mandate for all data. It allows data to be stored outside India, provided that the Data Fiduciary ensures adequate protection. However, the Act does require that a Data Fiduciary designated as a "Significant Data Fiduciary" may be required to keep certain data within India, as notified by the Central Government. As of now, the specific rules regarding significant data fiduciaries are still being finalized. You should monitor these updates. For most small and mid-sized businesses, cross-border transfer is permitted, but you must ensure that the foreign jurisdiction offers comparable protection. If you transfer data from India to the EU (e.g., for EU user support), GDPR applies to that transfer, requiring SCCs or an adequacy decision (which exists for the EU, so it is straightforward).

Vendor Due Diligence and Audits

You cannot outsource compliance without due diligence. Before signing a contract, assess the Pune vendor's security posture.

Key Questions for Due Diligence

1. Certifications: Do they hold ISO 27001 certification? While not mandatory, it provides a baseline for security management.
2. Previous Experience: Have they delivered projects for clients subject to GDPR or HIPAA? Request references (where allowed by confidentiality).
3. Infrastructure: Where is their development environment hosted? If it is in a region with weaker data protection laws, consider the risk. Pune-based firms often use AWS Mumbai or Azure Southeast Asia, which are generally acceptable, but verify.
4. Staff Background Checks: Do they conduct background checks on employees who will access sensitive data?
5. Physical Security: If they have an office in Pune, what are the physical access controls to the server rooms or office areas where developer laptops are stored?

Right to Audit

Your DPA must include a right to audit the vendor. This means you (or a third-party auditor appointed by you) can inspect their security controls, access logs, and compliance procedures. While full audits can be disruptive, you should specify that you can request evidence of compliance (e.g., penetration test reports, ISO certificates, employee training records) annually. If you suspect a breach, you should have the contractual right to conduct a more detailed audit.

Frequently Asked Questions

Does GDPR apply to an Indian company if the end user is in Europe?

Yes, GDPR has extraterritorial application. If your software offers goods or services to individuals in the EU, or monitors their behavior within the EU, GDPR applies to your organization and your processors, regardless of where they are located. If your Pune vendor processes EU personal data on your behalf, they are subject to GDPR as a processor, and you must ensure compliance through your contract and technical measures.

Do I need to transfer data from the EU to India to develop the software?

Not necessarily. You can use synthetic data (fake but realistic data) or anonymized data for development and testing in Pune. Personal data should only be transferred to India for production support or specific testing scenarios where real data is required. If you do transfer real data, you must use Standard Contractual Clauses (SCCs) and ensure encryption in transit and at rest.

What is the penalty for non-compliance under India's DPDP Act?

The DPDP Act proposes penalties of up to ₹250 crore (approximately $30 million USD) for failure to comply with obligations around sensitive personal data, and up to ₹200 crore for other violations. While these are maximum caps, the actual fine depends on the nature, gravity, and duration of the violation. For businesses, the reputational damage and legal costs often exceed the fine itself.

Can I use a free open-source consent management platform?

You can, but you must verify its compliance. The platform must support GDPR requirements such as granular consent, logging, and data export. Many free tools lack the necessary audit trails or cannot handle the complexity of cross-border consent. It is often safer to use a commercial CMP that offers compliance reports and integration with your Pune development team’s stack.

Who is liable if the Pune vendor suffers a data breach?

Regulatorily, the Data Controller (you) is primarily liable to the data subjects and regulators. You will face inquiries and potential fines. Contractually, you can seek indemnification from the vendor under your DPA. Therefore, having a robust DPA with clear liability clauses and insurance requirements is your primary financial protection. The vendor is liable to you for their negligence, but they are not liable to the EU or Indian regulator directly in the same way you are.

Is data localization mandatory in India under the DPDP Act?

Currently, there is no blanket data localization mandate for all businesses. The DPDP Act allows data to be stored outside India. However, the Central Government can declare certain data as "localizable," requiring it to be stored within India. This is likely to apply to "Significant Data Fiduciaries." Most small and medium businesses can transfer data abroad, provided they ensure adequate safeguards. You should monitor government notifications for updates on this.

Where to Start

Begin by mapping your data flows. Create a simple document listing every type of personal data you collect, where it is stored, and who can access it. Identify which flows involve your Pune development partner. Next, draft or review your Data Processing Agreement with a lawyer who understands both GDPR and Indian law. Ensure the DPA includes SCCs for GDPR and specific DPDP Act clauses.

Technically, work with your development team to implement role-based access control and restrict production access. If you are not already using a consent management platform, implement one that supports geo-targeting and logging. Finally, establish a breach notification protocol with clear timelines and communication channels.

If you are looking for a partner who understands the intersection of development and compliance, you can talk to the team at Govindani Infotech on WhatsApp to discuss how to structure your project for regulatory alignment.