Introduction
With the advent of Artificial Intelligence (“AI”) enabled tools, industries throughout the world are witnessing a stark shift in their operations and increasingly trying to harmonize the operations of their enterprises with AI led efficiencies. Even Global Capability Centres (“GCCs”) in India are making significant investments in AI with EY India GCC Pulse Survey 2025 estimating that 83% of GCCs already operating in India have invested in GenAI, and 58% of GCCs operating in India already investing in Agentic AI. The states are also actively supporting AI development with states such as Telangana, Karnataka, Kerala and Odisha targeting AI talent development in their GCC policies and Haryana bringing in its own state policy to incentivize AI development.
However, with this progress, comes another key piece in the puzzle: is usage of AI by your GCC unit compliant with data protection regulation, in particular, the Digital Personal Data Protection Act, 2023 (“DPDP Act”) and Digital Personal Data Protection Rules, 2025 (“DPDP Rules”). With the implementation timeline approaching, GCC units need to ensure that their AI usage is compliant with the data protection laws.
Identification as Data Fiduciary or Data Processor
A GCC should first undertake a clear assessment of whether, and to what extent, it qualifies as a Data Fiduciary or Data Processor under the DPDP Act. The determination should be based on the actual nature of the GCC’s AI usage activities and, in particular, whether the GCC independently determines the purpose and means of processing personal data through AI, rather than merely on its status as a group company or a service provider. Section 2(i) defines a ‘Data Fiduciary’ as someone who, alone or with others, determines the purpose and means of processing of personal data and Section 2(k) defines a ‘Data Processor’ as someone who processes personal data on behalf of a Data Fiduciary. Therefore, the Data Fiduciary determines the purpose and means of processing and Data Processor only acts as a service provider for the Data Fiduciary for processing of this personal data.
A global parent company may provide customer data to its Indian GCC unit for developing an AI-enabled customer service platform. Depending upon the contractual and operational arrangements, the GCC may be processing the data on behalf of the parent, therefore being a Data Processor. However, if the GCC independently determines how and why the data will be processed for developing its own AI solution, the nature of its role may require closer examination, becoming the Data Fiduciary. The legal analysis should therefore reflect the actual operational architecture rather than simply relying on the labels used in inter-company/intra-group arrangements.
For AI-led GCCs, data mapping should consequently identify not only the categories of personal data being processed, but also the entities determining the purposes and means of processing at each stage. Accordingly, the GCC should conduct a processing-activity-wise assessment, rather than adopt a single classification across all its operations. This assessment should map the categories of personal data processed, the individuals concerned, the purpose of processing, the entity determining such purpose, the systems and means used, applicable contractual arrangements and the extent of decision-making exercised by the GCC.
Can Personal Data collected by a GCC be used to train AI?
AI systems do not simply begin with the ability to perform their intended tasks. In many cases, they need to be trained using data so that they can identify patterns, understand relationships and generate outputs based on the task for which they have been developed. Depending on the type of AI system, training may involve datasets containing text, images, audio, behavioural information or other forms of data. AI models may also be subsequently fine-tuned using more specific datasets to improve their performance for a particular organisation, industry or use case.
This makes the use of personal data in developing an AI system an important legal consideration. Organisations must consider whether that personal data can lawfully be used for the proposed AI-related purpose.
Personal data collected for one business purpose may subsequently become attractive as a training dataset for an AI system. For example, employee information collected for employment administration or customer interactions collected for providing a service could potentially be used for AI development.
The legal question is whether the proposed AI processing is consistent with the purpose for which the personal data was originally collected and the applicable legal basis for processing.
Section 5(1) of the DPDP Act stipulates informing Data Principals about the purposes for which such personal data is processed. Thus, organisations should avoid treating the availability of a dataset as equivalent to permission to use that dataset for AI development.
For AI-led GCCs, this means that data inventories should increasingly be accompanied by an “AI use” analysis: whether personal data may be used for model training, fine-tuning, testing, validation or inference.
Additionally, where AI training or fine-tuning cannot be aligned with the purposes originally notified to Data Principals, de-identification may offer a practical route, since the DPDP Act applies only to personal data. GCCs should however not treat this as a shortcut. The DPDP Act and DPDP Rules do not define anonymisation, so the safer assumption is that removing direct identifiers is insufficient since pseudonymised data may still contain identifiable data towards the Data Principal, and the anonymisation step itself constitutes processing that needs a lawful basis.
Cross-border data flows and global AI infrastructure
The global nature of GCCs creates another important legal consideration. A typical AI framework of a multi-national company may involve an Indian GCC processing personal data, a global parent company located overseas, an international cloud provider and a third-party AI model provider. Data may therefore move through several entities and jurisdictions before an AI output is generated. The legal team should understand the complete data flow rather than limiting its review to the location of the GCC.
The DPDP Act and DPDP Rule’s treatment of processing outside India makes this an important area for organisations with globally integrated AI architectures. The DPDP Act and the DPDP Rules themselves do not impose a blanket restriction on transfer of personal data outside India, barring restriction on transfer of personal data to notified foreign states or as prohibited by other regulations. Section 16(1) of the DPDP Act allows the Central Government to impose restriction on transfer of personal data outside India and Rule 15 of the DPDP Rules allows personal data to be transferred outside the territory of India subject to the restriction that the Data Fiduciary shall meet such requirements as the Central Government may impose for making such personal data available to any foreign State. Additionally, it is pertinent to note that Section 16(2) of the DPDP Act requires the Data Fiduciary to abide by international data transfer restrictions provided in any other law in force at the time providing for stricter requirements.
Accordingly, while the DPDP framework does not presently prescribe a general prohibition on cross-border transfers of personal data, AI-enabled GCCs should not treat such transfers as unrestricted. The legal assessment must extend beyond the physical location of the GCC to the entire data lifecycle, including the jurisdictions in which data is accessed, hosted, processed, stored or otherwise made available. This becomes particularly relevant where AI models, cloud infrastructure and third-party service providers are hosted outside India.
Conclusion
As AI becomes increasingly embedded in GCC operations, data protection can no longer be treated as a separate or post-deployment consideration. GCCs should assess the entire AI data lifecycle, from the collection and use of personal data for training and fine-tuning AI models to processing through AI platforms and cross-border transfers.
Accordingly, GCCs should undertake an AI-specific data protection assessment, including determining their role as a Data Fiduciary or Data Processor, assessing the purposes for which personal data is used and mapping cross-border data flows.
As the DPDP Act and DPDP Rules move towards implementation, embedding these considerations into AI development and procurement processes will enable GCCs to identify and address data protection risks at an early stage.
Ultimately, as GCCs evolve from traditional service delivery centres into centres of AI development and innovation, integrating data protection into the AI lifecycle will be critical to ensuring that technological advancement is supported by appropriate legal and governance safeguards.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
