It is estimated that India is home to more than 1,800 Global
Capability Centres (“GCCs”) that employ over 1.8
million professionals. In addition to providing technology-related
services, GCCs increasingly serve as global centres of excellence
across finance, legal, and HR functions, enabling their foreign
parent entity (“Foreign Entity”) to centralize these
critical functions in a single location.
This article examines the implications of India's new data
privacy law regime- the Digital Personal Data Protection Act, 2023,
together with the Digital Personal Data Protection Rules, 2025
(collectively, the “DPDP Framework”)—for GCCs in
India. The DPDP Framework is being rolled out in phases, with its
core obligations and compliance requirements scheduled to take
effect on May 13, 2027.
