What is GDPR?

The General Data Protection Regulation is the European Union’s data protection law, in force since May 2018. It governs how organisations handle the personal data of people in the EU. Crucially for Indian businesses, it can apply to organisations outside the EU when they offer goods or services to people in the EU or monitor their behaviour, so an Indian online store that ships to Germany and emails its German customers is likely covered for that data.

Every use of personal data needs a lawful basis under the GDPR. For marketing email, that is usually consent, which must be freely given, specific, informed and unambiguous, shown by a clear affirmative action; pre-ticked boxes don’t count. In practice, the rules for sending marketing email also come from separate EU and national e-privacy laws, which generally require consent for marketing email to individuals, with some exceptions for existing customers in certain countries.

People have strong rights under the GDPR. They can access their data, correct it, have it erased in many circumstances, and object to direct marketing at any time, an objection that must always be honoured. Organisations normally have one month to respond to these requests. They must also keep data secure, limit it to what is needed, and report certain breaches to the authorities within 72 hours.

Fines can reach €20 million or 4% of worldwide annual turnover, whichever is higher, for the most serious breaches. For Indian businesses, the good news is that the practices the DPDP Act expects (clear notices, recorded consent, easy withdrawal, prompt handling of requests) go a long way towards GDPR compliance too, though the two laws differ in detail.