GCCs, BPOs and KPOs: A DPDP Act Impact Study

Executive summary

Overall impact: Medium-High.

This study covers captive global capability centres (GCCs) of foreign groups, third-party business process outsourcing (BPO) firms and contact centres, knowledge and legal process outsourcing (KPO and LPO), and healthcare BPO such as medical coding and billing. Trayambic's SaaS and IT services study covers software and infrastructure work; this one covers people-heavy delivery.

Most of the sector's client data concerns people outside India and arrives under contracts with foreign companies. Section 17(1)(d) of the Digital Personal Data Protection Act, 2023 (the DPDP Act) switches off most of the Act for that processing, which is why we rate the sector Medium-High rather than High. The exemption is narrower than many centres assume, and everything outside it is fully regulated.

Three changes matter most.

• The exemption depends on contract structure. It needs a contract with a person outside India and data principals outside India. In our view, branch captives, Indian subcontractors and contracts with a client's Indian affiliate can fall outside it, and security duties survive in every case.
• Indian law travels with the data. CERT-In's six-hour reporting applies to the Indian entity for any incident it notices, whoever's data is involved, and overrides contractual confidentiality. Clients' GDPR and HIPAA instructions must make room for it.
• Staff and Indian clients are fully in scope. Large workforces, night shifts, home working and Indian banking or telecom work bring the employment ground, sector rules and DPDP flow-down contracts with them.

The main DPDP obligations commence on 13 May 2027.

Background

Captive GCCs are Indian subsidiaries, occasionally branches, of foreign groups. They run finance, HR, analytics, engineering, risk and customer operations for the group, mostly inside the parent's systems and on the parent's customers and employees worldwide.

Third-party BPOs and contact centres handle inbound service, outbound sales, collections, back-office work and content moderation for many clients, foreign and Indian, often from one floor. They hold call recordings, screen captures, chat transcripts and quality scores.

KPO and LPO firms do research, analytics and legal work, including review of litigation document sets that contain whole mailboxes.

Healthcare BPO handles coding, billing, claims and transcription, mainly for US providers and insurers and increasingly for Indian hospitals.

The data principals, the people the data is about, are clients' customers, patients and employees, and the centre's own staff, applicants and visitors. A centre engages data processors of its own: contact-centre platforms, workforce-management and speech-analytics tools, background-verification firms, transport operators and specialist subcontractors.

Legal framework

The DPDP Act and Rules

• Section 17(1)(d). Chapter II except ss.8(1) and 8(5), Chapter III and s.16 do not apply where "personal data of Data Principals not within the territory of India is processed pursuant to any contract entered into with any person outside the territory of India by any person based in India". Notice, consent, breach intimation, erasure, rights and transfer rules fall away; accountability and security safeguards remain.
• Roles (ss.2(i), 2(k), 8(1), 8(2)). For Indian clients' data the centre is a processor engaged under contract, and the client, as data fiduciary, answers for it. For its own staff the centre is the fiduciary.
• Employment (s.7(i)). Employee data may be processed without consent for employment and to safeguard the employer from loss or liability.
• Security and breach (ss.8(5), 8(6); Rules 6, 7). Encryption, access control, logs kept for a year and processor contract terms; breach notice to the Board and each affected person, with a 72-hour report.
• Transfers (s.16; Rule 15). Transfers abroad are allowed unless the Centre restricts a country, and none is restricted. Section 16(2) preserves stricter sector rules.
• Reach (s.3). The Act covers processing in India, and processing abroad connected with offering goods or services to people in India.

Other instruments

The European Commission has not recognised India as providing adequate protection, so EU clients typically send data to Indian centres under standard contractual clauses (SCCs).

How the layers fit

Section 38 keeps other Indian laws running alongside the DPDP Act. For exempt foreign data, the privacy rules come mostly from the client's contract, but Indian public law, from CERT-In to labour codes, applies regardless. For Indian clients, RBI, IRDAI and TRAI rules reach the centre through outsourcing contracts, and s.16(2) preserves their location requirements.

Analysis

The Trayambic DPDP Impact Scorecard

Overall impact: Medium-High

Section 17(1)(d): five conditions, one surviving duty

In our view, the exemption has five elements, and each can fail.

1. 1.A contract. A captive subsidiary with an intra-group services agreement satisfies this, because its foreign parent is "a person outside the territory of India". In our view, a captive run as a branch of the foreign company does not: a company cannot contract with itself, so the branch has no contract to rely on. Branch-structured centres should take advice before relying on the exemption.
2. 2.With a person outside India. A contract with the client's Indian affiliate does not qualify, even for foreign data, as Trayambic's SaaS and IT services study notes. More often missed is the subcontracting chain. An Indian BPO that passes work to an Indian coding or transcription specialist gives that specialist a contract with a person in India, so in our view, on the literal text, the second-tier vendor is not exempt. A direct or tripartite contract with the foreign client closes the gap.
3. 3.By a person based in India. The centre must itself be the contracting party.
4. 4.Data principals not within India. In our view the test is location, not nationality. A London customer of a UK bank is outside India even if she is an Indian citizen; a US bank's customer living in Bengaluru is not. Centres should use the client's address data as a proxy, record the method, and route India-resident records to fully compliant handling.
5. 5.Pursuant to the contract. Uses the contract does not cover, such as training the centre's own AI tools on client data or building cross-client benchmarks, fall outside the exemption and outside the client's authority.

What survives is ss.8(1) and 8(5): accountability and reasonable security safeguards, with penalties up to ₹250 crore. Breach intimation under s.8(6) does not apply to exempt data, but CERT-In reporting does. Trayambic's vendor contracts checklist shows how a GCC with mixed data should separate datasets; this study does not repeat it.

Indian law versus the client's instructions

Foreign clients flow down their own law. Under Article 28(3)(a) of the GDPR, a processor acts only on documented instructions "unless required to do so by Union or Member State law". Indian law is neither. Yet under CERT-In's FAQ Q13 any entity that notices an incident must report within six hours, and under Q22 that duty overrides contractual confidentiality. A centre that waits for its client's approval risks breaching Indian law; one that reports without telling the client risks breaching its contract.

The answer is drafting. Contracts should carve out disclosures required by applicable law, naming Indian law, and commit the centre to tell the client when it reports. A CERT-In direction to produce logs under s.70B(6) of the IT Act is, in our view, a legally binding request from a public authority under Clause 15 of the SCCs, so the centre must promptly notify the EU exporter and review the request's legality. HIPAA allows a business associate up to 60 days to notify a covered entity, so a healthcare BPO may report to CERT-In long before HIPAA requires it to tell the client; most clients contract for faster notice anyway.

Mixed floors: Indian client lines

An agent may handle a UK insurer's claims in the morning and an Indian NBFC's collections at night. The Indian line is fully within the Act, with the client as fiduciary and the centre as processor. Three issues recur.

• Call recordings. "This call may be recorded" is a notice, not consent by clear affirmative action. In our view recording for dispute handling and quality can be tied to the service the caller sought, but speech analytics or model training is a new purpose the client must authorise and usually seek consent for. From 1 January 2027, NBFCs must keep recovery-call recordings for six months and, unless the borrower asks otherwise, limit recovery contact to 8 a.m. to 7 p.m.
• Outbound calling. TRAI's number series and the DPDP Act run separately: the client needs a DPDP basis for using the number, and the centre must dial from the right series.
• Location. Banking clients' outsourcing terms keep original records in India and data in India where applicable, so a disaster-recovery site abroad needs the client's regulatory sign-off.

Indian clients will also flow down Rule 6 security terms, short incident windows for their 72-hour Board report, and erasure at contract end under s.8(7)(b). Trayambic's vendor contracts checklist sets out the clauses.

Healthcare work for Indian hospitals and insurers deserves care. The DPDP Act creates no special category for health data, so protection comes from the client's own duties and health-sector rules, which Trayambic's hospitals study covers. Coders and billers should work inside the client's systems rather than keep local copies of records. LPO teams face the same contract question as everyone else: reviewing UK custodians' mailboxes under a contract with a London law firm can be exempt, while the same review subcontracted through an Indian law firm, in our view, is not.

The workforce

For staff data the centre is the fiduciary, and s.7(i) is the main ground. Trayambic's article on employee monitoring and its HR tech and staffing study cover recruitment and monitoring in depth; four features are specific to this sector.

• Clean desks and phone-free floors. CCTV on the floor, phone lockers and screen recording protect client data and fit s.7(i) if confined to the floor and the shift.
• Home working. The 2020 and 2021 OSP reforms removed telecom barriers to home working, so controls now come from contracts and Rule 6. Monitoring of home agents should not reach webcams or household activity without a specific security reason.
• Personal devices. Where authenticator or messaging apps run on agents' own phones, device management should be confined to a work profile.
• Night shifts. Section 43 of the OSH Code lets women work before 6 a.m. and after 7 p.m. with their consent, subject to prescribed conditions. The consent records, rosters and cab-trip data this generates have a statutory purpose and should not be mined for performance.

Group HR is the other trap. When a captive shares staff data with the parent's global HR system, the parent usually sets its own purposes and is, in our view, a fiduciary in its own right. Section 3(b) reaches processing abroad only where it is connected with offering goods or services to people in India, which employment arguably is not. The captive should not assume the parent is bound by the Act, and should contract for equivalent protection.

Worked example: a contact centre in Kochi

A Kochi BPO with about 1,500 agents (illustrative) serves a UK motor insurer under a contract with the UK company, a US hospital group's billing office under a business associate agreement, and an Indian NBFC's collections. It subcontracts transcription to a Coimbatore firm. Its plan for May 2027:

1. 1.Exemption register. UK and US work is logged as s.17(1)(d) processing, with the contracting entity and residence test recorded. The transcription subcontract becomes a tripartite agreement with the US client.
2. 2.One security baseline. Because s.8(5) survives the exemption, every line gets the same Rule 6 controls: access control, one-year logs, encryption and a phone-free floor.
3. 3.Incidents. One playbook: CERT-In within six hours, every affected client within two hours, and a structured pack for the NBFC's 72-hour Board report. UK and US contracts carve out Indian legal reporting.
4. 4.NBFC line. Recovery calls only in permitted hours; recordings kept six months, then deleted; speech analytics paused until the NBFC authorises it.
5. 5.Staff. A monitoring policy under s.7(i), OSH consent records for night shifts, and a data-sharing agreement with group HR.

Compliance framework

Phased roadmap

• Now to December 2026: exemption register; residence test; inventory of subcontractors and recordings.
• January to March 2027: restructure contracts; Indian-law carve-outs; security baseline; rehearse the incident playbook with one foreign and one Indian client.
• April to May 2027: staff notices and monitoring policy; purge stale recordings; group-HR agreement.
• Ongoing: test each new contract against the five conditions; track DoT authorisation rules, Board guidance and RBI, IRDAI and TRAI changes.

Recommendations

1. 1.Test every client line against all five elements of s.17(1)(d), and record the answer.
2. 2.Restructure branch captives and subcontract chains where the exemption matters.
3. 3.Run one security standard: the exemption never removes s.8(5).
4. 4.Write Indian legal reporting into foreign contracts, so CERT-In and the client hear of an incident within hours of each other.
5. 5.Treat Indian client lines as fully regulated, with their sector rules.
6. 6.Tie staff monitoring to security, and keep night-shift and transport data to its statutory purpose.
7. 7.Do not assume a foreign parent is bound by the Act; contract for it.

Key takeaways

• On our reading, s.17(1)(d) needs five things: a contract, with a person outside India, by a person in India, about people outside India, for processing the contract covers; branch captives and Indian subcontractors can fail the test.
• Security safeguards (s.8(5)) and fiduciary accountability (s.8(1)) survive the exemption, with penalties up to ₹250 crore.
• CERT-In's six-hour reporting applies to the Indian entity for any incident it notices and overrides confidentiality clauses, so GDPR and HIPAA contracts need an Indian-law carve-out.
• Indian client lines are fully regulated: call recordings, outbound calling and data location follow the client's DPDP and sector duties.
• Staff data rests on s.7(i); clean-desk, home-working, device and night-shift data should stay within their security or statutory purpose.