- Home
- Industries
- DPDP for BPOs and GCCs
Industry
DPDP for BPOs and GCCs
Indian delivery centres process data for clients abroad, for Indian clients, and about their own large workforces. DPDP treats those three very differently.
Short answer
Under s.17(1)(d), personal data of people outside India processed in India under a contract with a person outside India is exempt from Chapter II (except s.8(1) and s.8(5)), Chapter III and s.16. Responsibility for the processing (s.8(1)) and reasonable security safeguards (s.8(5)) still apply. Data of people in India, including your own employees, gets no such exemption, and core obligations for it begin on 13 May 2027.
Where personal data sits in a BPO or GCC
- Client customer data: call recordings, chat transcripts, account details and claims handled for clients abroad and in India.
- Domestic programmes: collections, support or verification work for Indian clients, about people in India.
- Employee data: PAN, Aadhaar, bank details, EPF and UAN numbers, background checks, biometric attendance and CCTV.
- Floor systems: CRM and ticketing tools, screen recordings and quality monitoring.
- Endpoints: agents' desktops and laptops with downloaded exports and screenshots.
- Parent and client systems: access into systems hosted abroad, and data pulled into India for analytics.
DPDP duties that bite hardest
| Duty | Section or rule | What it means in this sector |
|---|---|---|
| Exemption for foreign Data Principals | s.17(1)(d) | Personal data of people outside India, processed in India under a contract with a person outside India, is outside Chapter II (except s.8(1) and s.8(5)), Chapter III and s.16. |
| Security still applies | s.8(5), Rule 6 | Even for exempt processing, take reasonable security safeguards to prevent a personal data breach. |
| Processor contracts | s.8(2) | For Indian clients' data about people in India, you are usually a processor, and the client must have a valid contract with you. |
| Employee data | s.7(i) | Processing for employment, or to safeguard the employer from loss or liability, is a legitimate use. It does not cover unrelated uses. |
| Breach intimation | Rule 7 | For data of people in India, the fiduciary intimates the Board and individuals. As a processor, report to your client fast so it can meet the 72-hour report. |
| Transfers | s.16, Rule 15 | Transfers out of India are allowed unless the Central Government restricts a country by notification, and no list has been notified. Under Rule 15 it may also set requirements by order on making data available to a foreign State or its agencies. |
Roles: fiduciary or processor
For client work, a BPO usually acts on the client's instructions, so the client is the fiduciary and the BPO is a processor. A GCC serving its parent is in a similar position for the parent's data.
For its own staff, recruitment and facilities, the BPO or GCC is the fiduciary. Keep client data and your own data in separate systems and records, so you can show which rules apply to which. Expect clients to audit you, and keep access and log evidence ready.
s.17(1)(d) covers only personal data of Data Principals outside India, processed under a contract with a person outside India. A programme that mixes Indian and foreign customers needs a split. Have counsel confirm each programme, and see our cross-border checklist.
A 90-day starting plan
- 01Days 1 to 30: classify every programme
For each programme, record whose data it is, where the Data Principals are, who the contracting party is, and whether s.17(1)(d) applies.
- 02Days 31 to 60: lock down endpoints and access
Scan agent devices and shared drives for exports, close open sharing links, and review who can reach each client's data.
- 03Days 61 to 90: put your own house in order
Map employee and candidate processing to s.7(i) or consent, sign processor contracts with HR vendors, and set retention for exits and rejected candidates.
How TruePrivacy helps
- The DSPM endpoint agent scans local files on enrolled macOS, Windows and Linux devices and reports findings with masked samples, not the raw files.
- Data security posture shows the people, groups, outside domains and open links that can reach each store, with a remediation flow from request to verified change.
- Records of processing records each programme as a processing activity, synced from discovery and exportable.
- Cross-border transfers keeps a country restriction list you maintain and warns when a vendor or destination matches it.
- Multiple brands and workspaces keep clients apart, and the audit trail logs every action with before and after values, exportable as CSV.
Does DPDP apply to BPO work for foreign clients?
Much of it does not, if the data is about people outside India and processed under a contract with a person outside India (s.17(1)(d)). s.8(1) and s.8(5) still apply, so you stay responsible and must keep reasonable security safeguards.
Is a GCC a processor for its parent?
Often, where it processes the parent's data on the parent's instructions. For its own employees in India it is a Data Fiduciary.
Does the exemption cover our employees?
No. Employees in India are Data Principals in India, so their data falls under the full Act, with s.7(i) available for employment purposes.
Can we transfer data abroad to a parent company?
Yes, unless the Central Government restricts transfers to that country under s.16. Rule 15 lets it set requirements by order on making data available to a foreign State, and stricter sectoral laws still apply (s.16(2)).
Your DPDP plan, starting today
Core obligations for data fiduciaries begin on 13 May 2027.
Core obligations begin