International and cross-border work
Selling abroad · Entering India · Data transfers
In short
If you sell from India to customers abroad, bring a product into India, or move data between the two, we work out which rules apply on each side and put the contracts in place.
Where problems usually start
An Indian software company signs its first European customer's DPA and standard contractual clauses without checking whether it can meet them. A foreign company launches in India assuming its global privacy policy and terms will do, and misses the DPDP Act, the IT Act and sector storage rules. In between, data leaves India through ordinary engineering choices, such as a backup region or a support desk with global access, none of them recorded as a transfer.
How we approach it
For Indian businesses selling abroad, we cover what EU and UK customers will ask for: GDPR and UK GDPR obligations, whether the EU AI Act reaches their AI features, data processing agreements and standard contractual clauses. For foreign businesses coming into India, we cover the DPDP Act, the IT Act, consumer and sector rules, data localisation, and the terms between the Indian subsidiary and its parent. Under the DPDP Act, transfers outside India are permitted unless the government restricts transfers to a particular country, so sector rules and contract terms are usually what limit a transfer.
What our work involves
- A review of the DPAs, standard contractual clauses and security terms that overseas customers send, with the obligations the Indian entity cannot perform identified and negotiated.
- A view of where the GDPR, UK GDPR and EU AI Act apply to products sold from India.
- An India launch check for foreign products, covering DPDP notices and consent, IT Act duties, consumer and sector rules, and local terms of use.
- Intra-group transfer and access agreements between the Indian entity and its affiliates, including what a foreign parent can and cannot require of it.
- A map of where data sits and who can reach it, including backups, logs, analytics and support tools, checked against sector storage rules.
For startups and in-house teams
An Indian startup signing its first overseas customer and an established group bringing a product into India both need to know which country's rules apply to which data, and contracts that each side can perform.
Sectors where this comes up
- SaaS and software products
- Fintech and payments
- Insurance and insurtech
- Manufacturing and industrial
- Logistics and mobility
- Travel and hospitality