Governance, Risk & Compliance
A GDPR compliance consultant in India is engaged for a reason that has little to do with Europe: an EU customer will not sign until the data processing agreement is in place and the security schedule survives review. GDPR reaches you because your customers are in scope, and their accountability flows down to you contractually.
Every GDPR programme has the same foundation and the same failure point. The foundation is knowing what personal data you hold, where it came from, why you have it, who you share it with, where it physically sits and how long you keep it. The failure point is that most organisations do not know, and no amount of policy writing substitutes for finding out.
We start with the mapping, establish lawful basis for each processing activity, build the rights and impact-assessment machinery, and get the transfer mechanisms right, which is where Indian service providers most often get caught. Where you want it certifiable, ISO 27701 is the management system; Indian obligations run in parallel under the DPDP Act.
Why you need it
01 / 06Article 3 applies the regulation to organisations outside the EU that offer goods or services to people in the EU or monitor their behaviour. An Indian company with EU users, or processing EU personal data for a client, is in scope regardless of where its servers are.
Controllers are required by Article 28 to use only processors providing sufficient guarantees. That obligation reaches you as a data processing agreement, a security schedule, audit rights and sub-processor terms, and the deal does not close until you can sign them credibly.
India has no adequacy decision, so transfers rely on Standard Contractual Clauses supported by a transfer impact assessment and appropriate supplementary measures. Getting this wrong is one of the more common and more expensive findings.
The regulation provides for administrative fines up to 4% of total worldwide annual turnover of the preceding financial year, or €20 million, whichever is higher, for the most serious infringements, with a lower tier for others. Commercially, losing the account usually arrives first.
Instrument
02 / 06Toggle the regimes you are asked for. Most of the security half is shared; the privacy half is where the new work is.
What we deliver
03 / 06A complete inventory of processing activities: categories of data and data subjects, purposes, lawful basis, recipients, transfers, retention and security measures. This is the Article 30 record and it is also the artefact everything else depends on.
Establishing and documenting the basis for each activity, legitimate interest assessments where that basis is relied upon, and consent mechanisms that meet the standard: freely given, specific, informed, unambiguous, and as easy to withdraw as to give.
A DPIA methodology with clear triggers, so assessments happen before a high-risk processing activity launches rather than after a regulator asks. Includes the first assessments for your highest-risk processing.
Working procedures for access, rectification, erasure, restriction, portability and objection: identity verification, internal routing, the one-month response clock tracked, and responses evidenced.
Transfer mapping, Standard Contractual Clauses in the correct modules, transfer impact assessments, and supplementary measures where the assessment requires them. Essential for any Indian entity processing EU personal data.
Data processing agreements, sub-processor registers and flow-down terms, breach notification procedures meeting the 72-hour controller obligation, privacy notices, and the accountability documentation a customer audit will ask for.
How we run it
04 / 06Identifying and mapping all personal data collected, processed, stored and shared, across systems, spreadsheets, SaaS tools and suppliers. Interview-led, because the data flows that matter are rarely the documented ones.
Weeks 1-4The Article 32 security measures appropriate to the risk (encryption, access control, pseudonymisation where useful, resilience and tested restoration) plus data minimisation and retention actually enforced.
Months 1-3External privacy notices that meet the Article 13 and 14 transparency requirements in language people can read, and the internal policies that make them true.
Month 2Where consent is the lawful basis: capture that meets the standard, granularity per purpose, a record of what was consented to and when, and withdrawal that is as easy as the original consent and actually propagates.
Month 2-3Request intake, identity verification, search across systems, redaction, response templates and deadline tracking, designed to be run by whoever is on duty rather than by the one person who understands it.
Month 3Assessing whether Article 37 requires a DPO, and either appointing internally with the required independence or providing the role externally where that is more proportionate.
Month 3-4Key benefits
05 / 06A maintained record of processing activities, which is simultaneously the Article 30 obligation, the answer to most customer questionnaires, and the input to every other privacy decision.
A data processing agreement, sub-processor register and transfer mechanism you can produce on request, rather than negotiate from scratch for each customer.
Intake, verification, search and response on a tracked clock, so a subject access request is handled rather than escalated.
Tools we use
06 / 06No “latest tech tools”. These are the ones your report will cite, alongside the manual work that a tool cannot do for you.
Regulation and guidance
Privacy operations
Rights and consent
Transfers
Certifiable framework
Included in this service
Compliance with any single regime is a project. Governing privacy across several (GDPR, India's DPDP Act, CCPA and whatever arrives next) is an operating capability, and it is the only thing that scales for an organisation with users in more than one country.
We build the layer underneath the individual regimes: one data inventory that serves all of them, a privacy risk methodology and register, clear ownership of personal data by business function, retention and deletion enforced technically rather than by policy alone, privacy review built into product delivery rather than bolted on at launch, and vendor and sub-processor governance for everyone who touches the data.
Governed this way, a new regulation becomes a gap analysis against a known baseline rather than a fresh discovery exercise. That is the difference between a privacy function that absorbs each new law in weeks and one that runs a six-month programme every time a jurisdiction legislates.
Why Aphelion
SharedDarshap Nayak, formerly of KPMG, holds a master’s degree in cybersecurity and more than seven years in security operations. Jaimin Somani brings fifteen-plus years of academic and hands-on VAPT. Hemang Desai is an ICT network specialist from Australia. You will meet them, not a logo.
Meet the teamEvery finding arrives with the reproduction steps, the affected asset and the fix, ranked by what it actually reaches in your environment, not by a CVSS number copied from a scanner. You get the report and the raw output, not a summary of a summary.
See how we testAhmedabad and Sharjah, working the same methodology on the same tooling. Indian data-residency requirements and UAE delivery are both ordinary here, and the AphelioNYX AD Pen-Test module runs entirely inside your perimeter when regulation says it must.
The platformInvent a statistic to make a slide land. Publish your name as a client without written permission. Print an award badge nobody awarded. Founded in 2024. We say so, and we attribute experience to the people who have it.
Ask us anythingAcross the globe, and across eight industries. We name a client only with their written permission.
AphelioNYX is SOC 2, ISO and GDPR compliant; attestations are available on request under NDA. We would rather hand you the report than print a badge.
Questions
FAQNext door
RelatedA personalised walkthrough and a free readiness assessment against the frameworks you are actually being asked for. Pick a time that suits you, or write to us. We reply within one business day.