Quick Answer
Global Capability Centres (GCCs) in India process personal data of parent company employees and customers under contracts with their overseas headquarters. Under the DPDP Act 2023, GCCs acting as Data Processors must sign DPAs with the parent entity and implement DPDP-compliant security safeguards. Cross-border data transfers from India to the parent company require a contractual basis and monitoring of the government's restricted country list.
Quick AnswerGCCs must implement DPDP compliance for all Indian employee data, clarify data fiduciary vs processor roles with the parent organisation, and ensure cross-border data transfers comply with DPDP restrictions.
DPDP Compliance Checklist
- Clarify data fiduciary vs processor roles with parent organisation — document in operating agreement
- Map all personal data processed in India: employee data, customer data processed for parent, vendor data
- Implement DPDP-compliant employee privacy notice for all India-based employees
- Review cross-border data transfers to parent company — ensure DPDP-compliant transfer mechanism
- Implement role-based access controls for personal data — restrict to need-to-know basis
- Ensure HRMS and payroll vendors used in India are DPDP compliant
- Train GCC staff on DPDP obligations — India-based teams are on the front line
- Implement breach notification process — 72-hour notification to Data Protection Board for India-origin breaches
- Review BPO-type services provided to global group for DPDP processor obligations
- Conduct annual DPDP compliance assessment for India operations
Download Full Compliance Guide (Free)
Get the complete sector-specific checklist, risk areas, and 30-day action plan — delivered to your inbox.
Frequently Asked Questions
Is the GCC or the parent company the data fiduciary?+
This depends on who determines the purpose and means of processing. Typically the parent is the fiduciary; the GCC is the processor. Document this clearly in your agreement.
Do GCCs need to comply with both DPDP and GDPR?+
If the GCC processes data of EU residents, GDPR applies. If it processes data of Indian residents, DPDP applies. Many GCCs face both — implement the more stringent standard.
Can a GCC transfer employee data to the parent for HR purposes?+
Yes, with appropriate safeguards. Employee data transfers for legitimate HR administration are generally permissible. Ensure DPDP-compliant transfer agreements are in place.
Every Sunday
The Sunday DPDP Brief
One real DPDP development explained in plain English, one practical how-to, one number from our own assessment data. Nothing else — no daily noise, no sales pitch.
No spam. Unsubscribe with one click, anytime.
