Introduction
Setting up a Global Capability Center in India means running a real, regulated business entity, not just a delivery team. Three areas trip up foreign parents more than any others: data protection under the DPDP Act, labor and employment law, and the foreign investment (FDI) rules that govern how money and ownership flow in. Get these right, and your GCC runs clean. Get them wrong, and you face penalties, filing delays, or a structure you have to unwind later.
One important note up front: Indian regulation in these areas has been changing quickly, and rules, thresholds, and enforcement dates shift. Treat this as orientation, and confirm every specific detail with a qualified Indian legal and tax advisor before you act.
FDI rules: can you own a GCC in India outright?
The good news for most technology companies: India's IT and software services sector has long permitted 100 percent foreign direct investment under the automatic route, meaning you generally do not need prior government approval to own your Indian entity fully. It is a large part of why India is such a natural home for owned capability centers.
That said, the automatic route is not a free pass. You still have reporting obligations to the Reserve Bank of India; you must follow pricing and valuation rules when capital comes in, and certain sectors carry conditions or approval requirements. If your GCC touches a restricted or sensitive sector, the picture changes. Confirm three things with an advisor: whether your specific activity qualifies for the automatic route, current RBI reporting requirements and timelines, and the valuation rules for the capital you inject. Because these rules can be updated, verify the current position for your sector rather than assuming the general IT-services rule applies.
Labor and employment law: the ongoing obligations
Employing people in India brings statutory obligations that continue for the life of the center. Every GCC carries these:
- Provident Fund (EPF): A retirement contribution, split between employer and employee, above defined thresholds.
- Employees' State Insurance (ESI): A social security and health contribution for employees below a wage threshold.
- Gratuity: A statutory payment to employees who complete qualifying service.
- Professional Tax: A state-level tax on employment, where applicable.
- Shops and Establishments registration: State-level registration governing working conditions, hours, and leave.
Together, these contributions typically add roughly 15 to 22 percent on top of base salary, which is why budgeting off headline salaries alone understates your true people cost.
| Statutory Requirement | Regulatory Authority | Contribution & Financial Impact | Compliance Governance |
|---|---|---|---|
| Employees' Provident Fund (EPF) | EPFO (Central Govt) | 12% of basic salary matched by employee | Monthly statutory filings and electronic remittance |
| Employees' State Insurance (ESI) | ESIC (Central Govt) | 3.25% employer + 0.75% employee (wages ≤ ₹21,000/mo) | Health and medical coverage for qualifying threshold |
| Gratuity | Ministry of Labour & Employment | 15 days wages per completed year of service | Payable after 5 years continuous tenure; insurance trust funding |
| Professional Tax | State Governments | Nominal monthly deduction (~₹200/mo depending on state) | State-level employee taxation remittance |
| Shops & Establishments | State Labour Departments | Annual license fees & leave encashment provisions | Governs working hours, shift timings, overtime, and holidays |
India has also moved to consolidate its many older labor laws into a smaller set of Labor Codes covering wages, social security, industrial relations, and occupational safety. Their rollout has been phased, and the timeline has shifted more than once, so the exact rules in force can depend on when and where you operate. Confirm the current status of the Labor Codes and applicable state rules with a local employment specialist before finalizing contracts and payroll.
Getting employment right from day one
The practical risk is not knowing a rule exists; it is applying an outdated version. Employment contracts, payroll, benefits, and terminations all have to match current law. A GCC that runs payroll and HR to local compliance from the first hire avoids the expensive cleanup of fixing contracts and back-paying contributions later.
The DPDP Act: data protection for your GCC
The Digital Personal Data Protection Act is India's framework for how organizations handle personal data. For a GCC, it matters on two fronts: your own employees' personal data, and any personal data your center processes as part of its work.
At a high level, the framework introduces obligations that will feel familiar from modern privacy law elsewhere: process personal data for lawful purposes, obtain consent where required, keep data secure, and respect individuals' rights over their data. It also contemplates significant penalties for breaches, which is why data protection cannot be bolted on later.
The important caveat: the DPDP Act and its supporting rules have been moving through stages of implementation, and the operational requirements and enforcement timing have been evolving. What is in force, and what it requires in practice, may have changed since this was written, so confirm current DPDP obligations with a qualified data protection advisor rather than building governance off a general summary.
Expert Solutions for Enterprise Software
Need help with Enterprise Software? Our engineering team builds production-ready solutions tailored to your enterprise workflows.
What good data compliance looks like in a GCC
Regardless of the exact statutory detail, the controls that keep a GCC defensible are consistent:
- Strong access management, so people only reach the data they need.
- Security practices aligned to recognized standards such as ISO 27001 and SOC 2.
- Clear handling of employee personal data through HR and payroll.
- Documented processes for how client or product data is stored, moved, and deleted.
Build these in at setup. Retrofitting security and data governance onto a running center is harder and riskier than designing it in from the start.
Why compliance is a reason to choose your setup model carefully
Here is the strategic point. All of this (FDI reporting, statutory contributions, labor codes, data protection) is ongoing work that has to be right every month, not just at launch, and a company new to India often underestimates how much operating muscle it takes.
This is where the setup model matters, and it is the most underestimated part of GCC setup in India. If you stand up a full captive GCC on day one, you own every compliance obligation immediately, before you have built any local operating capability. A Build-Operate-Transfer route changes that: a partner runs the entity and its compliance while the center matures, then transfers a working, compliant operation to you. You inherit a running compliance function rather than assembling one from scratch. Whichever model you choose, coordinate with local legal and tax specialists for the areas that need it (transfer pricing, sector-specific FDI conditions, detailed DPDP obligations), and keep compliance a living function rather than a one-time checklist.
Conclusion and next step
FDI, labor law, and the DPDP Act are the three regulatory pillars of a GCC in India. The rules are navigable, but they are detailed, and they change, so the worst approach is to assume last year's summary still holds. Build compliance in from the first hire, keep it running, and lean on specialists for the parts that carry real risk.
MetaDesign Solutions sets up and operates GCCs end to end, handling entity, HR, payroll, and data-security compliance and coordinating with legal and tax partners where needed, backed by ISO 27001 and SOC 2 practices. Book a consultation to map your compliance and setup path, including the phased Build Operate Transfer Services route.
