Short answer: yes, a UK or EU business can outsource software development to India, including work that touches personal data. India has no EU adequacy decision and no UK transfer approval, so the transfer needs safeguards: in the UK, the ICO's International Data Transfer Agreement (IDTA) or the UK Addendum to the EU clauses; in the EU, the European Commission's standard contractual clauses (SCCs). Add a data processing agreement and a transfer risk assessment. Better still, give developers test data and keep production data at home.
This is general information, not legal advice. Your DPO or lawyer decides what applies to you.
First question: does the developer need personal data at all?
Most development does not. Developers can build and test on anonymised or synthetic data, with production databases hosted in your UK or EU cloud region under your accounts. If no personal data leaves your control, most of what follows does not apply. Support and maintenance of a live system is where access to real data usually becomes necessary.
UK: what changed in 2026
- The UK GDPR and the Data Protection Act 2018 still apply.
- The Data (Use and Access) Act 2025 replaced adequacy decisions with transfer regulations; the transfer provisions came into force in February 2026.
- India has not been approved under the new regime, so transfers to an Indian vendor still need appropriate safeguards: the IDTA, or the UK Addendum attached to the EU SCCs.
EU: the standard contractual clauses
- Use the European Commission's 2021 SCCs; for a vendor processing data on your instructions, the controller-to-processor module.
- Do a transfer impact assessment: what data, how sensitive, what access, and what Indian law might require.
- Sign a data processing agreement under Article 28 GDPR.
The paperwork checklist
| Document | UK | EU |
|---|---|---|
| Mutual NDA | Yes | Yes |
| Services contract with IP assignment | Yes | Yes |
| Data processing agreement | Yes (UK GDPR Article 28) | Yes (GDPR Article 28) |
| Transfer mechanism | IDTA or UK Addendum | SCCs (controller-to-processor) |
| Risk assessment | Transfer risk assessment | Transfer impact assessment |
Technical safeguards that make the assessment easy
- Production data stays in your UK or EU region; developers work on test data.
- Access to live systems only through your accounts, with two-step sign-in, per-person logins and logs.
- No customer data on laptops; support done through screen-share where possible.
- Access removed the day the engagement ends.
How Infovion works with UK and EU clients
We sign the IDTA or UK Addendum, or the EU SCCs, with a data processing agreement, and work on test data wherever we can. Our team's working day covers the whole UK and Central European working day. See for UK businesses and for European companies.
Sources: UK Data (Use and Access) Act 2025, Schedule 7; European Commission: standard contractual clauses.
