Does GDPR Apply to Your Website If You're Based in India? A 2026 Guide for Businesses With International Visitors

If your website gets visitors from Europe, or you sell to customers there, one question comes up sooner or later: does the EU's GDPR apply to a business that's based in India? The short answer is that GDPR follows the person whose data is collected, not the location of the business. That means an Indian company can be in scope without ever having set foot in Europe, and "we're too small" or "our servers are in India" doesn't settle the question.

Note: this is general information, not legal advice. Privacy law is evolving, and whether it applies to your specific business depends on facts that only your legal adviser can assess.

The Short Answer: GDPR Follows the Person, Not the Business

Under Article 3(2), GDPR applies to organizations outside the EU in two situations:

• Offering goods or services to people in the EU, even if the service is free.
• Monitoring the behaviour of people in the EU, for example through tracking and profiling of what they do online.

Most careful sources agree that simply having a website that someone in Europe can open is not enough. Regulators look for intentional targeting. Hosting your site outside the EU also doesn't take you out of scope, because the law looks at who you're offering to and watching, not where the server sits.

How to Tell Whether You're "Targeting" the EU

These are the signals regulators and legal advisers typically look at. Several together make targeting much more likely:

• EU languages. Pages in German, French, Spanish, or other EU languages, particularly with the option to buy in that language.
• EU currencies. Prices shown in euros, or a checkout that accepts them.
• Shipping to the EU or listing European countries as service areas.
• Marketing aimed at Europe, such as ads targeted at EU audiences or campaigns in a European language.
• Mentions of EU customers in testimonials, case studies, or sales copy.

A rough guide, which is not a legal determination:

The Grey Area: Analytics, Ad Pixels, and "Monitoring"

This is where guides disagree. Some say any analytics cookie that touches an EU visitor brings you into scope. The narrower legal reading is that the monitoring limb is about tracking or profiling the behaviour of people while they are in the EU, usually for a specific purpose such as behavioural advertising or detailed analysis. In practice, if you run behavioural advertising, retargeting, or detailed profiling on a site that attracts EU visitors, treat that as a real risk rather than a technicality. A practical middle path is to apply EU-standard cookie consent to visitors from the EU and UK. It's relatively cheap insurance, and it avoids having to argue about where the line sits.

What GDPR Actually Requires

• A lawful basis for processing, and valid consent for non-essential cookies and most marketing. Consent has to be freely given, informed, specific, and unambiguous.
• A clear privacy notice explaining what you collect, why, who you share it with, and how people can exercise their rights.
• Respecting individual rights, including access, correction, and erasure of personal data.
• Breach notification to the regulator within 72 hours of becoming aware of a reportable breach.
• Agreements with your vendors. Hosting providers, email platforms, and analytics tools that process personal data on your behalf should be covered by a data processing agreement.
• An EU representative, in many cases, under Article 27, for non-EU businesses that are subject to GDPR, unless a narrow exception applies.
• Safeguards for international transfers. Moving personal data to countries without an EU adequacy decision generally requires a mechanism such as Standard Contractual Clauses. Ask your adviser to confirm the current position for transfers to India.

Smaller organizations get relief from some record-keeping duties, but GDPR does not exempt small businesses or startups from the core obligations.

What's at Stake

The most serious infringements can attract fines of up to €20 million or 4% of global annual turnover, whichever is higher. Regulators have taken action against companies headquartered outside the EU, and enforcement activity has been rising. Realistically, a small Indian business isn't usually the first target, and most smaller companies feel the pressure commercially rather than through a regulator: European customers increasingly ask suppliers for a privacy notice, a data processing agreement, and proof of sensible security before they sign.

Cookie Consent in Practice

For EU and UK visitors, the general standard is opt-in. That means non-essential cookies and trackers shouldn't fire until the visitor agrees. A compliant approach usually includes:

• Blocking analytics and marketing scripts until consent is given, not just showing a banner while they load anyway.
• Equally easy accept and reject options, without design tricks that nudge people toward accepting.
• Granular choices by category, such as analytics, marketing, and preferences.
• Easy withdrawal of consent at any time.
• A record of consent, so you can show when and how it was given.

Location detection can help you deliver the right banner to the right visitor, but it isn't a legal assessment in itself, and you should plan what happens when a visitor's location can't be determined. The UK has its own regime after Brexit, with UK GDPR and the PECR cookie rules, so don't assume a decision for the EU automatically covers UK visitors. US state laws, such as California's, generally apply only above certain size or data-volume thresholds that most small businesses don't meet, but check the current thresholds with your adviser.

What's Changing: The Digital Omnibus

In November 2025 the European Commission proposed the Digital Omnibus package, which would move cookie consent rules directly into GDPR and make browser-level consent signals binding on website owners. As far as the sources I found show, this is a proposal still working through the EU legislative process, so don't treat it as law yet. It's worth watching, particularly if you rely on a consent banner. Separately, the planned ePrivacy Regulation was withdrawn in early 2025, which means today's cookie rules still come from the existing ePrivacy Directive working alongside GDPR.

How GDPR and India's DPDP Act Fit Together

If you're based in India and serve international visitors, you may be subject to both GDPR and India's Digital Personal Data Protection Act. They aren't identical, but they overlap heavily in practice: plain-language privacy notices, clear consent, 72-hour breach reporting, and accountability for your vendors. The sensible approach is one privacy program built to the stricter standard wherever the two differ, rather than two separate efforts. Our DPDP Act guide covers the Indian side in detail.

A Practical Checklist

1. Map where your visitors and customers are, using analytics and your sales records.
2. Decide honestly whether you target the EU or UK, using the signals above.
3. Audit every cookie, tracker, form, and plugin on your site to see what personal data they collect.
4. Add a consent banner that blocks non-essential scripts until EU and UK visitors opt in.
5. Update your privacy notice so it explains what you collect, why, who receives it, and how to contact you.
6. Put data processing agreements in place with your hosting, email, and analytics providers.
7. Prepare a breach response plan that can meet a 72-hour notification window. Our cybersecurity guide covers the baseline practices.
8. Ask your adviser whether you need an EU representative and how to handle international transfers.
9. Get a legal review of the end result, since this checklist is a starting point rather than a compliance certificate.

Common Mistakes to Avoid

• Assuming small size means exemption. GDPR has no general exemption for small businesses.
• Assuming Indian hosting keeps you out of scope. Server location doesn't decide it.
• Copying a privacy policy from another site. It won't match what your site actually collects, which is its own compliance risk.
• Using a banner that only looks compliant, with trackers loading before consent or a hidden reject option.
• Ignoring vendor agreements with the tools that process your visitors' data.
• Treating DPDP compliance as covering GDPR, or the reverse. They overlap but aren't the same.

5 Frequently Asked Questions About GDPR for Indian Websites

1. Does GDPR apply to my website if my business is in India?

It can. GDPR applies to non-EU organizations that offer goods or services to people in the EU or monitor their behaviour there. A website that merely happens to be reachable from Europe isn't enough on its own, but targeting signals such as EU languages, euro pricing, or EU-focused marketing make it much more likely.

2. Is a small business exempt from GDPR?

Not from the core obligations. Smaller organizations get relief from certain record-keeping duties, but there's no general small-business exemption from requirements such as consent, privacy notices, individual rights, and breach notification.

3. Does hosting my website outside the EU avoid GDPR?

No. Hosting location doesn't determine whether GDPR applies. What matters is whether you offer goods or services to people in the EU or monitor their behaviour, not where your server is located.

4. Do I need a cookie banner for every visitor?

Not necessarily every visitor, but visitors from the EU and UK are generally expected to give opt-in consent before non-essential cookies run. Many businesses use location detection to show the right banner, while planning for what happens when location can't be determined.

5. Do I need to appoint an EU representative?

Possibly. Article 27 requires many non-EU businesses that are subject to GDPR to appoint a representative in the EU, unless a narrow exception applies. Whether you need one depends on your circumstances, so confirm with a legal adviser before assuming either way.

How RS Info Solutions Can Help

The legal question of whether GDPR applies to you is one for a lawyer, but most of the work that follows is technical, and that's where we come in. We audit the cookies, trackers, forms, and plugins on your website, set up a consent banner that actually blocks scripts until visitors opt in, build privacy notices that match what your site really collects, and help you review vendor arrangements, all in coordination with your legal adviser. If you're also working to attract overseas customers, our guide to international SEO covers how to reach them, and this guide covers how to handle their data responsibly once they arrive.

Have visitors or customers in Europe? Get a free website privacy and consent audit from our team.