Scenario 1: If your business relationship is directly with the EU citizens as private individuals, then your Indian company is the Data Controller in this arrangement and the EU citizens are Data Subjects.
At the present time, Indian laws apply in this scenario for your company and there is no question of illegality. To ensure your customer is aware it is wise to be clear about where your business is based and specify in the terms of business that the laws of India apply.
Scenario 2: If your business relationship is with a company/business based (including self-employed individuals) within the EU then your customer is the Data Controller in this arrangement and your Indian company is a Data Processor.
Similarly, at the present time this would also be legal and Indian laws would apply to you. The current EU Data Protection directives as implemented in European countries place legal obligations on the Data Controller only and not on the Data Processor, therefore it is the data controller's responsibility to ensure they comply with their country's national data protection legislation (which will be an implementation of the EU data protection directive). While this shifts the liability from you, it does mean that if you want to accept European companies as customers and the services you provide involve the processing of personal data, then it makes sense to help make sure that it is legal for them to use your Indian company to process their personal data. They will be required by law to ensure they only use data processors that:
(a) are located in a country included in the EU's pre-approved countries list of countries where the EU has made Adequacy Decisions recognising that these countries offer adequate protection and compatible legislation. India is not currently on this list (included in this answer to help other users that may not be based in India):
"The Commission has so far recognized Andorra, Argentina, Canada (commercial organisations), Faeroe Islands, Guernsey, Israel, Isle of Man, Jersey, New Zealand, Switzerland and Uruguay as providing adequate protection." (Source: http://ec.europa.eu/justice/data-protection/international-transfers/adequacy/index_en.htm)
(b) have opted-in to an EU-recognised scheme which places binding rules on the their data processing practices and promises equivalent data protection controls, such as the E.U.-U.S. Privacy Shield (which doesn't apply to you because your company is not based in the U.S., but included in this answer to help other users that may not be based in India):
"The Commission adopted on 12 July 2016 its decision on the EU-U.S. Privacy Shield.
This new framework protects the fundamental rights of anyone in the EU whose personal data is transferred to the United States as well as bringing legal clarity for businesses relying on transatlantic data transfers. The new arrangement includes:
strong data protection obligations on companies receiving personal data from the EU
safeguards on U.S. government access to data;
effective protection and redress for individuals;
annual joint review to monitor the implementation.
The new arrangement lives up to the requirements of the European Court of Justice. On 6 October 2015, the Court of Justice of the European Union had declared the Commission’s 2000 Decision on EU-US Safe Harbour invalid." (Source: http://ec.europa.eu/justice/data-protection/international-transfers/eu-us-privacy-shield/index_en.htm)
(c) have incorporated the Standard Contractual Clauses as specified by the EU (either Set I or Set II, but you can't modify or combine these) into their contracts to ensure they can be held legally liable and accountable for the protection of personal data and any breaches when/if applicable:
"The Council and the European Parliament have given the Commission the power to decide, on the basis of Article 26 (4) of directive 95/46/EC that certain standard contractual clauses offer sufficient safeguards as required by Article 26 (2), that is, they provide adequate safeguards with respect to the protection of the privacy and fundamental rights and freedoms of individuals and as regards the exercise of the corresponding rights.
The Commission has so far issued two sets of standard contractual clauses for transfers from data controllers to data controllers established outside the EU/EEA and one set for the transfer to processors established outside the EU/EEA." (Source: http://ec.europa.eu/justice/data-protection/international-transfers/transfer/index_en.htm)
This will change however from May 2018 with the introduction of the EU General Data Protection Regulations (GDPR) which additionally require Data Processors to comply and Data Controllers located outside the EU but processing data on behalf of European citizens to comply:
"EU rules for non-EU companies — companies based outside the EU must apply the same rules when offering services or goods, or monitoring behaviour of individuals within the EU" (Source: http://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=LEGISSUM:310401_2&from=EN&isLegissum=true)
See http://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016R0679&from=EN for full GDPR text. Article 3(2a) is where it states "This Regulation applies to the processing of personal data of data subjects who are in the Union by a controller or processor not established in the Union, where the processing activities are related to the offering of goods or services, irrespective of whether a payment of the data subject is required, to such data subjects in the Union".