Buyer Guides · 6 MIN
Software development for German companies: GDPR, the AVV and working with India
What a German company needs when hiring a software team in India: the Article 28 AVV, SCCs for transfers, BDSG points, reverse-charge VAT and time zones.
A German company that lets a software vendor touch personal data needs a signed Auftragsverarbeitungsvertrag (AVV), the data processing agreement required by Article 28 of the GDPR. If the vendor is in India, which has no EU adequacy decision, the AVV must be paired with Standard Contractual Clauses and a transfer assessment. This guide lists what to check.
- Article 28(3) GDPR lists what the AVV must contain, and Article 28(9) requires the contract in writing, which includes electronic form.
- India has no EU adequacy decision, so transfers need a tool such as the 2021 Standard Contractual Clauses plus a documented transfer assessment.
- Breaching Article 28 can draw fines up to 10 million euros or 2 percent of worldwide turnover.
- A German company must appoint a data protection officer once 20 or more people regularly handle personal data automatically (section 38 BDSG).
- Services bought from a foreign business are usually subject to reverse-charge VAT under section 13b UStG, so the German buyer reports the tax.
- Nactore is an AI-native technology and growth company in Mumbai that can work from your AVV template and keep records you can show your auditor.
What is an AVV and when do you need one?
An AVV is the contract between a controller (you) and a processor (the vendor) that Article 28 GDPR requires whenever the processor handles personal data on your behalf. The text of the regulation is on EUR-Lex.
You need one when a developer can see, access, process or store personal data of customers, employees or users. That includes support access to a production database, hosting on the vendor's cloud account, or analytics tooling. A project that runs purely on synthetic data usually does not, but document that decision.
What must the AVV contain under Article 28(3)?
The article lists mandatory terms. A German data protection authority reviewing your contract will look for each one.
| Article 28(3) | What the contract must say |
|---|---|
| (a) | Process only on your documented instructions, including for transfers |
| (b) | Staff are bound by confidentiality |
| (c) | Security measures under Article 32 |
| (d) | Sub-processors only with your authorization, with the same obligations passed down |
| (e) | Help you answer data subject requests |
| (f) | Help you with security, breach notification and impact assessments |
| (g) | Delete or return data at the end of the services |
| (h) | Provide information and allow audits |
The vendor must also tell you if it believes one of your instructions breaks the law. Under Article 33(2), it must notify you of a breach without undue delay. The European Commission also published model controller-to-processor clauses that you can adopt instead of drafting from scratch. For a longer checklist see the GDPR DPA checklist for hiring developers.
How do you transfer personal data to an India-based team?
Chapter V of the GDPR restricts transfers to countries outside the EU and EEA. The European Commission has not issued an adequacy decision for India, so you need an "appropriate safeguard" under Article 46. The usual choice is the Standard Contractual Clauses of 2021. For a German controller using an India-based processor, that means Module Two (controller to processor).
The Court of Justice's Schrems II ruling (case C-311/18) added a duty to check whether the destination's laws undermine the clauses, often called a transfer impact assessment, with supplementary measures where needed. The EDPB's Recommendations 01/2020 describe the method. For a software project, the simplest supplementary measures are masked data, encryption with keys held in the EU, and access limited to named engineers through logged sessions.
What do German authorities add on top of the GDPR?
Germany has a federal data protection commissioner and separate supervisory authorities in the states, so which one reviews you depends on where you are established. The Federal Data Protection Act (BDSG) adds specific rules, such as the duty in section 38 to appoint a data protection officer when 20 or more people are regularly engaged in automated processing of personal data. The text is on gesetze-im-internet.de.
Two practical details come up in vendor reviews. First, many German procurement teams ask for the AVV and a list of technical and organizational measures (TOMs) as an annex, so ask the vendor early whether it has one. Second, a German-language AVV is not legally required, but your works council or legal team may prefer one. Agree on the governing language before drafting.
How does German VAT work on services from India?
When a German business buys services from an entrepreneur established abroad, the recipient usually owes the VAT under the reverse-charge rule in section 13b of the Umsatzsteuergesetz (UStG). The German buyer then reports it in its VAT return, and if fully entitled to input tax, deducts the same amount. The vendor invoices without German VAT. The statute is on gesetze-im-internet.de. Whether your purchase qualifies depends on its details, so confirm with your Steuerberater.
What time overlap will a German team get with India?
Germany uses CET (UTC+1) in winter and CEST (UTC+2) in summer. India (IST, UTC+5:30) does not change its clocks. The gap is 4.5 hours in winter and 3.5 hours in summer. With a 10:00 to 19:00 IST India team and 09:00 to 17:00 German hours, the shared window is about 5.5 hours in winter (13:30 to 19:00 IST) and 6.5 hours in summer (12:30 to 19:00 IST). The EU's summer time directive sets the changeover as the last Sunday of March and October. See Europe time zone overlap with India teams for other European cities.
Ask the vendor for its TOMs annex and sub-processor list before you open the AVV. If they exist, the contract takes days. If they do not, you have learned something important about the vendor.
Frequently asked questions
Does a German company need an AVV for a software development project?
Yes, if the vendor can access personal data on your behalf. If the work uses only synthetic data, document that choice and revisit it if access changes.
Can we rely on a vendor's standard terms for the AVV?
You can, but check every Article 28(3) item. Many vendor templates miss audit rights or sub-processor approval.
Are SCCs enough for India?
They are a valid Article 46 tool, but you must also assess whether local laws affect the clauses and add supplementary measures if needed.
Is this legal advice?
No. It is a plain-language guide with official sources. Confirm with German counsel and your Steuerberater.
A short close
German buyers get good outcomes from vendors who bring their own TOMs, name their sub-processors and sign a complete AVV without argument. Make that your first filter.
Want this built for your team? Book a free 30-minute call.
Want to apply this to your business?
Book a free 30-minute call. We will tell you what we would do first.