Setting up a GCC in India

Building an enduring and compliant global capability centre architecture

India today hosts the world’s largest concentration of Global Capability Centres (GCCs). As per the Nasscom-Zinnov GCC Landscape Report 2026, India now has 2,117 GCCs, employing about 2.3 million professionals and generating market revenue of nearly USD98.4 billion by FY2026.

The questions that determine whether a GCC becomes a durable strategic asset or a continuing source of friction are almost always the same: what entity vehicle is used; where the centre is located; how employment is structured; how personal data is handled; and how the inter-company pricing arrangement will hold up under scrutiny. These questions are front-end design decisions, and getting them wrong is expensive to undo.

Choice of entry vehicle: BOT or EOR

A foreign group setting up a GCC in India has three practical options, each with a distinct legal and commercial profile.

Wholly owned subsidiary. A wholly owned Indian private limited company remains the preferred vehicle. The structure offers ring-fenced legal personality, limited liability, and a framework that integrates well with inter-company services contracts, transfer pricing benchmarking, employee stock ownership plan (ESOP) issuance to Indian employees, and participation in incentive schemes.

Build-operate-transfer (BOT): BOT arrangements have become increasingly common where the foreign group wants speed of setup without taking immediate operational risk. The legal stress points in BOT arrangements are predictable. First, employees must transfer cleanly at the end of the BOT term, which typically requires a structured novation that complies with the Industrial Relations Code, 2020, and applicable state legislation.

Second, intellectual property created must be assigned, not merely licensed, to the foreign group or to the Indian transferee entity. Third, the price paid for the transfer of the operating entity must align with the arm’s length principle.

Employer of record (EOR): EOR arrangements allow a foreign group to engage a small Indian team without incorporating in India. The legal difficulty is that Indian tax and labour authorities look to substance, not form. Where the foreign entity directly supervises individuals on an EOR’s rolls, there is a real risk that the arrangement is characterised as de facto employment. The consequences can be material.

India’s shifting GCC location logic

The first wave of GCCs in India was driven by labour cost arbitrage. Today, location choices reflect access to specialist talent, ecosystem maturity and the availability of state-specific incentives.

Bengaluru and Hyderabad. These two cities remain the gravitational centres for AI, product engineering, platform engineering and deep-tech GCCs, with accumulated experience, deep pools of senior leadership talent, established vendor and infrastructure markets, and a workforce that understands how global operating models function.

Pune. The city’s foundation in automotive and manufacturing has produced an engineering talent pool that translates well into product engineering and applied R&D work. Proximity to Mumbai gives access to financial markets and senior corporate functions, while Pune offers the physical infrastructure required for centres at scale.

GIFT City, Gujarat. For financial services GCCs, GIFT City offers a specialised regulatory framework administered under the International Financial Services Centres Authority Act, 2019, combined with materially enhanced tax incentives that are particularly useful for groups with Indian financial operations that need to operate at arm’s length from onshore Indian regulatory perimeters.

Uttar Pradesh. The Uttar Pradesh Global Capability Centres Policy, 2024 (read with the Implementation Rules, 2025, and the SOP-2025, notified in January 2026) provides a particularly aggressive incentive package. Eligible units may avail of front-end land subsidies of up to 50%, 100% stamp duty exemption or reimbursement, and capital subsidy at 25% of the eligible investment.

What we increasingly see is a hub-and-spoke model, with the primary hub located in a deep talent market and supporting centres located in cost-advantaged or incentive-heavy jurisdictions.

Impact of India labour codes

By way of notifications dated 21 November 2025, the Code on Wages, 2019; the Industrial Relations Code, 2020; the Code on Social Security, 2020; and the Occupational Safety, Health and Working Conditions Code, 2020 have been brought into force in their entirety.

For GCCs, three practical consequences are particularly important.

Wider coverage of non-traditional workers. The codes extend statutory protection beyond permanent employees to fixed-term employees, contract labour and, through the Social Security Code, to gig and platform workers as well. For GCCs that rely on layered staffing models, this expansion in statutory coverage means that contractual labels alone will no longer determine the legal classification of the working relationship.

Digital enforcement. Both the Occupational Safety Code and the Social Security Code are designed around electronic registration, electronic filing and data-driven supervision. For GCCs, this means that compliance lapses are more likely to be detected through system reconciliation than through site inspection, and the practical importance of clean payroll and statutory filing records has correspondingly increased.

Social security as a statutory floor. The Social Security Code emphasises the universalisation of employees’ provident fund (EPF), employees’ state insurance (ESI), gratuity and maternity benefits across formal and informal employment categories. For GCCs operating fractional or hybrid workforce models, the question of who qualifies as an employee for social security purposes is no longer answered by the payroll ledger alone.

DPDPA compliance for India GCCs

The Digital Personal Data Protection Act, 2023, has now moved from legislative intent to staged implementation. Even before full commencement, GCCs need a more disciplined vocabulary for how they collect, process, retain and transfer personal data.

Dual role as data fiduciary and data processor. A typical GCC acts as a data processor when it handles customer data of the foreign group’s overseas customers under instructions from the foreign parent. It acts as a data fiduciary when it processes data of its own Indian employees, candidates, vendors and, where applicable, Indian customers. Each role has a different compliance profile.

Outsourcing exemption under section 17(1)(d). Section 17(1)(d) of the DPDPA provides an important exemption where personal data of data principals not within India is processed in India pursuant to a contract with a person outside India. For the classic GCC offshore delivery model, where Indian operations handle data of the foreign group’s overseas customers, this provision is significant. It supports the processing of overseas customer data in India, within the terms and boundaries of the exemption.

The exemption, however, does not extend to data principals in India, which means that data of Indian employees, job applicants, local vendors and any Indian customers must be processed under the full compliance framework as and when the relevant operative obligations take effect on 13 May 2027.

Transfer pricing certainty for GCCs

Most GCCs are structured as captive service providers, compensated by the foreign group on a cost-plus basis. The central transfer pricing question in India is whether the Indian entity earns an arm’s length operating margin.

The Transactional Net Margin Method (TNMM) is the most commonly used method for IT/ITeS and knowledge-based captives, with the Indian entity’s operating margin benchmarked against companies performing comparable functions. Master file, local file and country-by-country reporting requirements apply to larger multinational groups, and these reports must align with the way the Indian GCC is characterised.

Advance pricing agreements (APAs) continue to be a useful tool for IT/ITeS and R&D captives that need multi-year certainty on the cost-plus margin, and want to reduce transfer pricing controversy with Indian authorities. The Central Board of Direct Taxes has signed an increasing number of bilateral and unilateral APAs in the IT/ITeS and R&D captive space, and the programme is now mature enough that timelines have improved meaningfully.

Indian states roll out GCCs

Several Indian states have moved beyond generic IT/ITeS policies to dedicated GCC policies. Three illustrate the emerging pattern.

Maharashtra GCC Policy, 2025. Valid until FY 2029-30, the policy targets the establishment of 400 new GCCs and the creation of about 400,000 high-skilled jobs, against a stated investment target of INR506 billion (USD5.3 billion). The policy emphasises Mumbai, Pune and emerging tier-2 and tier-3 hubs such as Nagpur, Nashik and Chhatrapati Sambhajinagar.

Karnataka GCC Policy, 2024-29. Karnataka, which already hosts the largest concentration of GCCs in India, has set a target of 500 new GCCs (taking the total to 1,000 GCCs in the state) by 2029, creating 350,000 new jobs and generating USD50 billion in economic output. The incentive design emphasises expanding GCC activity beyond Bengaluru, through the Beyond Bengaluru package, targeting Mysuru, Mangaluru, Hubballi-Dharwad-Belagavi and other cluster cities.

Uttar Pradesh GCC Policy, 2024. As described, the UP policy offers one of the most aggressive incentive packages currently available. The Implementation Rules, 2025 and the SOP-2025, approved in January 2026, operationalised the framework with Invest UP serving as the nodal agency.

Integrated compliance design for GCCs

The regulatory environment in which GCCs operate in India is now clearer, more integrated and increasingly system-enforced, rather than inspection-dependent. GCCs that design around this reality from the outset – through the right entity vehicle, the right location, well-structured employment arrangements, a clear data architecture, an arm’s-length tax model, and a robust set of intercompany contracts – are more likely to find regulatory compliance manageable and predictable.