For GCCs
DPDP for GCCs
A GCC processes its parent's data, sometimes data about Indian customers, and always data about its own Indian workforce. Each needs a different answer under DPDP.
Short answer
Personal data of people outside India that a GCC processes in India under a contract with a person outside India falls under the s.17(1)(d) exemption, though s.8(1) and s.8(5) still apply. Data of people in India, including the GCC's own employees, is fully covered, with s.7(i) available for employment purposes. Transfers abroad are allowed unless the Central Government restricts a country under s.16, and under Rule 15 it may set requirements by order on making data available to a foreign State.
Sort your processing into three buckets
Most GCC privacy questions come down to one sort: whose data it is, where those people are, and who instructed the work.
| Bucket | Example | DPDP position |
|---|---|---|
| Data of people outside India, for the parent | Support or analytics for the parent's overseas customers | s.17(1)(d): Chapter II (except s.8(1) and s.8(5)), Chapter III and s.16 do not apply. Security and responsibility remain. |
| Data of people in India, for the parent or a client | Servicing the parent's Indian customers | Full Act. The GCC is usually a processor under contract (s.8(2)). |
| The GCC's own people | Payroll, attendance, recruitment | Full Act. The GCC is the fiduciary; s.7(i) covers employment purposes. |
s.17(1)(d) turns on where the Data Principals are and who the contract is with. A programme that mixes Indian and foreign data needs a split, and the call should be written down.
What you own as the GCC privacy lead
- The programme catalogue and the bucket for each programme.
- Rule 6 safeguards across all three buckets.
- The GCC's own employee and candidate data, as its fiduciary.
- Local breach response, and the handoff to the parent's response team.
- Evidence for parent and client audits.
What to do this quarter
- 01Catalogue programmes
For each, record whose data it is, where the Data Principals are, the contracting party, and the bucket it falls in.
- 02Secure every bucket
Apply Rule 6 safeguards everywhere, including exempt work, since s.8(5) still applies. Review access and close open sharing links.
- 03Fix employee processing
Map HR processing to s.7(i) or consent, sign contracts with HR vendors, and set retention for leavers and candidates. See employee data under DPDP.
- 04Write a transfer note
List data flows to the parent and other countries, and how you will respond if a country is restricted under s.16. Our cross-border checklist helps.
What to ask the parent and other teams
- Parent legal: the intra-group contract, and which entity instructs which processing.
- Parent security: which controls are global and which the GCC must run locally.
- IT: device inventory, access lists and log retention of at least one year (Rule 6).
- HR: the systems and vendors that hold employee and candidate data.
For data of people in India, the fiduciary must intimate the Board and each affected person under Rule 7. Agree who that is for each programme before an incident, not during one.
Evidence to keep
- The programme catalogue with the bucket and reasoning for each.
- Processor contracts for Indian data, and the intra-group agreement.
- Access reviews, logs and breach records.
- Breach drill notes showing how a local incident reaches the parent's response team.
- Employee notices or records of the s.7(i) basis.
How TruePrivacy helps
- Records of processing holds the programme catalogue, synced from discovery and exportable.
- The DSPM endpoint agent and data security posture find personal data on devices and stores, and show who can reach it.
- Cross-border transfers keeps a country restriction list you maintain and warns on matches.
- Multiple workspaces separate the parent's and clients' programmes.
Is a GCC a Data Processor for its parent?
Often, where it processes the parent's data on the parent's instructions. For its own employees in India, it is a Data Fiduciary.
Does s.17(1)(d) remove all DPDP duties for foreign data?
No. s.8(1) and s.8(5) still apply, so the GCC stays responsible for the processing and must keep reasonable security safeguards.
Can a GCC send data to its parent abroad?
Yes, unless the Central Government restricts transfers to that country under s.16. Rule 15 lets it set requirements by order on making data available to a foreign State, and stricter sectoral laws still apply (s.16(2)).
Your DPDP plan, starting today
Core obligations for data fiduciaries begin on 13 May 2027.
Core obligations begin