General Data Protection Regulation (EU) 2016/679

Regulation (EU) 2016/679, the General Data Protection Regulation, entered into force on 24 May 2016 and has applied since 25 May 2018. It is a regulation, not a directive, so it applies directly in every EU member state without national legislation, and it has been taken into the EEA Agreement, which brings in Iceland, Liechtenstein and Norway as well.

Each member state has a supervisory authority that handles complaints, investigates and fines. The authorities sit together in the European Data Protection Board, which publishes the guidelines they follow, such as Guidelines 9/2022 on personal data breach notification. Police and prosecutors do not work under the GDPR at all. Their processing for criminal law enforcement comes under the Law Enforcement Directive (EU) 2016/680, which each state had to transpose into national law by 6 May 2018. A private laboratory in the EU examining a device for a company works under the GDPR; the police unit examining the same kind of device works under its national law enforcement act.

No single privacy rule applies everywhere. The GDPR is one jurisdiction's answer, and it sits beside the UK GDPR, California's CCPA and India's Digital Personal Data Protection Act, 2023, each with its own reach, thresholds and timelines. Reading this page, or the regulation itself, makes nobody compliant with any of them.

Article 3 sets two tests. The establishment test catches processing done in the context of the activities of an establishment in the EU, whoever actually does the work and wherever the servers sit. The targeting test catches an organisation with no EU presence at all if it offers goods or services to people in the EU or monitors their behaviour there. The European Data Protection Board's Guidelines 3/2018 on territorial scope work through both tests with examples, and the European Commission puts the other side plainly: a company that does not target people in the EU is not subject to the regulation just because someone from the EU happens to use it.

For an Indian laboratory, training institute or incident response provider there are three common routes in. The first and most frequent is contractual. An EU company engages you as its processor to image employee laptops, parse mailboxes or triage a ransomware incident. The client stays the controller, and your contract must carry the processor terms the regulation requires, including processing only on documented instructions, security measures and help with rights requests and breach notices.

The second route is direct. If you sell a remote data recovery or examination service to individuals in Germany or France, priced in euro and delivered there, you are offering services to people in the EU and the regulation applies to that processing in its own right. The third is monitoring, which rarely applies to a laboratory but can catch a training institute that tracks the online behaviour of EU learners. A device sent to you from within India that happens to hold contacts in Paris does not, on its own, put the examination under the GDPR.

Personal data can leave the EU only on one of three footings: an adequacy decision for the destination, appropriate safeguards such as standard contractual clauses or binding corporate rules, or a narrow derogation. The Commission's list of adequate countries runs from Andorra to Uruguay and includes the United Kingdom, Japan and the Republic of Korea. India is not on it. An EU client that wants to send a disk image or a mailbox export to a laboratory in India therefore signs standard contractual clauses with the laboratory and must be satisfied that the clauses can be honoured in practice.

This shapes the engagement. The laboratory inherits obligations under the clauses: process only on instruction, keep the data secure, tell the client about sub-processors and about any government request for access, help with rights requests and return or delete the data at the end. Many clients avoid the transfer altogether by keeping the image on a server in the EU and letting the examiner work on it remotely, or by having a local partner acquire and hash the media and sending only the findings. A training institute that receives real case data from an EU partner for teaching is in the same position and should expect to sign the same paperwork.

The GDPR does not authorise an investigation and does not forbid one. Authority comes from the client's lawful basis, employment contracts, policies and, where needed, a court. The regulation also does not prevent disclosure to police or courts where EU or national law requires it; a legal obligation is a lawful basis in itself. There is no such thing as a GDPR certificate, and a vendor that claims one is selling a word. Reading the regulation, or following a standard, is not compliance. Compliance is what the organisation actually did and recorded.

A forensic report under the GDPR follows data minimisation. It names the authorisation and the scope, records hashes, tools and methods, and reports the facts that answer the question asked. It does not reproduce whole mailboxes, address books or photo libraries. Third parties who are not the subject of the inquiry are pseudonymised in the body and identified, if at all, in a restricted annex. Special category data appears only where it is the finding. Raw extractions stay in the evidence store, with a retention date agreed with the client, not in a report that will be copied to HR, counsel and perhaps the other side.