EU-to-India SaaS transfers, a US analytics region and RBI payment-data localisation
Ledgerly is an Indian accounting SaaS. Its EU customers' data, including 1,400 Dublin-based employees' HR records, is hosted in Mumbai and replicated to Virginia. Support staff in Pune access all regions. The EU controller insists on 'GDPR-compliant transfers' and will not sign without a transfer mechanism. Ledgerly's Indian payments feature stores card and UPI data; the CTO wants to move analytics to the US region for cost reasons. Ledgerly has no EU establishment but markets to EU customers and has a German sales representative. A customer questionnaire asks which transfer mechanism applies for EU-to-India and EU-to-US, whether India restricts outbound transfers, and whether RBI rules allow the US analytics.
1. What is Ledgerly's GDPR status and which transfer mechanisms apply for EU data going to India and the US?
Read the worked answer
Ledgerly is likely a processor for customer data and a controller for its own account, marketing and HR data. Article 3(2) can apply because it markets to EU customers even without an EU establishment; a German sales representative does not by itself create an establishment but supports the targeting analysis. That triggers an Article 27 EU representative and Article 30 records.
For EU-to-India, India has no EU adequacy decision. Use the 2021 SCCs, Module 2 for controller-to-processor or Module 3 for processor-to-processor, plus a transfer impact assessment and supplementary measures such as encryption, access controls and a government-access-request policy. A bare 'GDPR-compliant' warranty is not a transfer mechanism.
For EU-to-US, if the importer is certified under the EU-US Data Privacy Framework, rely on that; otherwise SCCs plus a TIA. Map each flow, sign Article 28 DPAs, document the TIA, flow obligations to sub-processors, and give the controller audit, deletion and breach-notice rights. Do not treat the Mumbai and Virginia regions as interchangeable until each flow is documented.
2. Does Indian law prohibit sending the data to Virginia? Explain DPDP cross-border rules and the RBI payment-data constraint.
Read the worked answer
DPDP does not impose general localisation. Section 16 permits transfers unless the Central Government notifies restrictions on transfers to specified countries or territories. So Indian law alone does not bar replication to Virginia, but the contract, the consent notice and sectoral rules may.
RBI is the binding constraint for payment data. The RBI payment-system directive requires payment system data to be stored only in India. Processing abroad is permitted within the RBI framework only if the data is brought back to India within 24 hours and deleted abroad. Moving card and UPI analytics to the US region therefore needs a design that satisfies both DPDP and RBI; the safer option is to keep payment data in Mumbai and send only aggregated, non-payment metrics to the US.
Different legs, different laws. The Dublin employees' HR data is EU-origin, so GDPR transfer rules govern the outbound leg even though the servers are in India. Indian customer data is governed by DPDP. Do not apply one answer to the whole estate: classify each dataset by origin, sector and contract before approving the US analytics.
3. What contractual and technical controls would make the Pune support model defensible for both EU and Indian data?
Read the worked answer
Treat Pune support as a high-risk access path, not a location problem.
- Least privilege and role-based access, with separate queues for EU and Indian customers, just-in-time elevation and no bulk export.
- Masking and pseudonymisation in the support console, so agents see policy numbers and claim status but not full identifiers unless a case requires it.
- Logging and monitoring: session recording, access reviews, anomaly alerts and retention of logs for investigation.
- Key management: encryption with keys controlled by the controller or held outside the support region where feasible.
- Contractual flow-down: SCC annexes, Article 28 terms, sub-processor lists, audit rights, breach notification timelines, government-access transparency and deletion obligations.
- People controls: background checks, privacy training, confidentiality undertakings and a clear escalation route for suspected incidents.
- Transfer impact assessment documenting the legal exposure of Indian staff accessing EU data and the supplementary measures adopted. Revisit if the US region is used for analytics.