We work for consulting company in India, call it Z. Z has a partnership with a European cards & transactions processing company Y.
So the Indian consulting company Z does offshore production support for European Company Y. And as part of live production support Indian consultants have read access to sensitive data.
Per new GDPR rules: Can consultants in India view European data outside the EU?