Know your role and data
Whether you act as controller, processor or both, and a map of the EU personal data you handle.
// EU GDPR · REGULATION (EU) 2016/679Serve EU customers
Serve EU customers
without GDPR surprises.
The GDPR follows the people whose data you process, not where your company is registered. If you offer services to people in the EU, or handle EU personal data for your clients, we help you put the records, rights handling, contracts and breach process in place that the regulation expects.
GDPRControllers and processorsInternational transfers72-hour breach notification
2018GDPR applies since 25 May 2018
72 hrsTo notify the supervisory authority of a breach
4%Maximum fine: of worldwide annual turnover, or €20m
// WHY INDIAN COMPANIES ARE IN SCOPE
Territorial scope follows the data subject.
The GDPR has applied since 25 May 2018 to organisations in the EU and, under Article 3(2), to organisations outside it that offer goods or services to people in the EU or monitor their behaviour. Indian SaaS products, IT service providers and outsourcing teams are routinely in scope, either as a controller in their own right or as a processor for an EU client. Compliance is enforced by national supervisory authorities, with fines of up to 20 million euros or 4% of worldwide annual turnover, whichever is higher, for the most serious breaches.
// DELIVERY STANDARD
Built for decisions, evidence and accountable execution.
Whether this is a commercial engagement or a government program, the work is structured so technical teams can act and leadership can verify progress.
Gap assessment
Your practice compared with the GDPR principles, rights and accountability duties that apply to your role.
Records, rights and contracts
Records of processing, notices, rights handling, DPAs, transfer mechanisms and breach response put in place.
Accountability evidence
Owners, reviews and records tracked in the Bitkosh Readiness Platform, so you can show a client or regulator what you did.
// PROJECT OUTPUTS
What your team can take into the next review.
- Records of processing activities (Article 30)
- GDPR gap assessment for your role
- Privacy notices and lawful-basis register
- Data subject request procedure and log
- DPA and Standard Contractual Clauses pack with transfer risk assessment
- Personal data breach playbook
// BUILT FOR
Designed around the people who own the outcome.
- Indian SaaS companies with EU users
- IT services and outsourcing firms processing data for EU clients
- Product, legal and security teams answering EU due diligence
- Companies also preparing for India’s DPDP Act
Records of processing
The Article 30 record of what personal data you process, why, on what lawful basis, where it goes and how long you keep it, built from your real systems.
Lawful basis and notices
A lawful basis for each processing purpose, privacy notices that say what you actually do, and consent flows that meet the GDPR standard where consent is the basis.
Data subject rights
A process for access, rectification, erasure, portability and objection requests, answered within the one-month deadline, with a log that shows you did.
International transfers
Standard Contractual Clauses and transfer risk assessments for data that leaves the EU, including transfers to your own team in India.
Processor contracts and DPIAs
Article 28 data processing agreements with clients and sub-processors, and Data Protection Impact Assessments for high-risk processing.
72-hour breach notification
A breach playbook that lets a controller notify its supervisory authority within 72 hours, and lets you, as a processor, tell your client without undue delay.
// PRICING
Scoped to you, priced in writing.
Every engagement is scoped to your frameworks, your team and how much help you want — you get a written proposal before anything starts.
GDPR gap assessment
Talk to us
Role and data mapping plus a written gap report and roadmap.
Full GDPR readiness programme
Talk to us
Mapping to working processes and evidence. Legal opinions, where needed, come from your own EU counsel.
GDPR work is scoped by your role and how many products, systems and sub-processors handle EU personal data. Talk to us and we'll send a written proposal.
Frequently Asked Questions
Is there a GDPR certificate?
Not in the way ISO 27001 has one. The GDPR allows approved certification schemes, but they are few and narrow, and none is required. Compliance is judged by supervisory authorities and by your clients’ due diligence, so what you need is records, processes and evidence.
Do we need an EU representative?
Often, yes. Under Article 27, an organisation outside the EU that is in scope under Article 3(2) usually has to appoint a representative in the EU, with limited exceptions for occasional, low-risk processing. We help you work out whether it applies to you.
Do we need a Data Protection Officer?
Only in certain cases, such as large-scale monitoring of people or large-scale processing of special categories of data. Many companies appoint a privacy lead without a formal DPO. We help you decide and document the reasoning.
We are getting DPDP-ready too. How much overlaps?
A good deal: data mapping, notices, rights handling, security and breach response. The two laws differ on lawful bases, children’s data and breach reporting, so we run them together and keep the differences explicit. See our DPDP Act compliance service.
Are you a law firm?
No. We are a compliance and security team that builds the records, processes and controls. Legal interpretation and contract negotiation should come from your counsel, and we work alongside them.
Let's build together
Pass your EU client’s due diligence the first time.
Book a free 30-minute consultation with our engineering team — no obligation, just a clear, practical plan.