Data Analytics & AI GCC in India: DPDP Compliance, Talent & Infrastructure

India's AI and Data Analytics GCC Boom

Building a data analytics and AI GCC in India means confronting three hard constraints from day one: under the Digital Personal Data Protection (DPDP) Act, the Schedule sets penalties of up to INR 250 crore for a failure to take reasonable security safeguards; engineers with production-grade AI and ML experience are scarce relative to demand; and domestic data centre and GPU capacity, while expanding quickly, is still being built out. This guide provides the practical framework for getting it right.

The shift toward AI-native enterprises has changed what a new Indian GCC is set up to do: AI/ML and data analytics are now core mandates rather than the back-office and IT support work that defined the first wave of Indian captive operations. India offers a deep pool of data scientists, ML engineers and GenAI specialists at a substantial discount to US salary levels, and the Union Budget 2025-26 announced a national framework to guide states in promoting GCCs in emerging tier-2 cities.

DPDP Act Compliance for AI and Data GCCs

The Digital Personal Data Protection Act 2023, operationalised through DPDP Rules notified on November 13, 2025, is India's comprehensive data protection law. For AI and analytics GCCs that process large volumes of personal data, compliance is not optional — the Schedule to the Act sets a maximum penalty of INR 250 crore for a failure to take reasonable security safeguards.

Key Compliance Obligations

The DPDP Act establishes a layered compliance framework that GCCs must implement:

• Consent management: Every instance of personal data processing requires explicit, informed consent. Consent requests must be accompanied by a standalone, plain-language notice detailing what data is collected and the precise purpose of processing
• Purpose limitation: Data collected for analytics or model training can only be used for the specified purpose communicated in the consent notice. Using customer service data to train an AI model without separate consent is a violation
• Data breach notification: Upon detecting a personal data breach, the GCC must notify the Data Protection Board with an initial report without delay, followed by a detailed report within 72 hours, and notify each affected data principal without delay
• Retention limits: Personal data must be deleted once the purpose of processing is fulfilled. GCCs cannot retain training data indefinitely
• Security safeguards: Rule 6 mandates encryption, masking, obfuscation, and strict access controls as "reasonable security safeguards"

Significant Data Fiduciary Obligations

AI GCCs processing substantial volumes of personal data may be classified as Significant Data Fiduciaries (SDFs), triggering enhanced obligations:

• Annual Data Protection Impact Assessments (DPIAs)
• Regular third-party audits of data handling practices
• Algorithmic fairness assessments for AI systems
• Appointment of a Data Protection Officer (DPO) based in India
• Stricter technical due diligence requirements

Implementation Timeline

Compliance is phased across three stages:

GCCs should not wait for Stage 3. Building privacy-by-design into data architectures and AI pipelines now avoids costly retrofitting later.

Cross-Border Data Transfers and FEMA Compliance

AI and analytics GCCs inherently process data that crosses borders — training datasets from the parent company, model outputs sent to global business units, and real-time analytics dashboards accessed from multiple jurisdictions. Both data protection law and foreign exchange regulations govern these flows.

DPDP Act Cross-Border Rules

Section 16(1) of the DPDP Act operates as a negative list, not a whitelist: the Central Government may, by notification, restrict transfer of personal data to a notified country or territory. No country has been notified, so the DPDP Act does not itself block outbound transfers. Section 16(2) preserves any other law in force that imposes a higher degree of protection or restriction, so sectoral localisation mandates (for example the RBI's payment-system data directive) bind independently. GCCs should:

• Map which datasets are caught by sector-specific localisation mandates (payments, insurance, health, government data) — those, not section 16, are the binding constraint today
• Implement data anonymisation and aggregation before transferring analytics outputs internationally
• Use synthetic data for AI model training where possible to avoid cross-border personal data transfers

FEMA and Financial Compliance

The financial structure of the GCC must comply with FEMA regulations:

• Entity structure: Most AI GCCs incorporate as a wholly-owned subsidiary (100% FDI via automatic route)
• Share allotment: File FC-GPR within 30 days of issuing shares to the foreign parent
• Transfer pricing: Transfer pricing documentation is mandatory for inter-company service charges. The GCC's analytics or AI services billed to the parent must be at arm's length pricing, supported by benchmarking studies
• Annual filings: FLA Return due by July 15 annually; Form 145 (formerly Form 15CA) for outward remittances, with Form 146 (formerly Form 15CB) needed only where the remittance is taxable and exceeds ₹5 lakh without an assessing officer's certificate
• Withholding tax: Applicable on cross-border payments for dividends, royalties, and technical service fees, with rates varying by DTAA treaty

For a detailed comparison of entity structures, see our branch office vs subsidiary comparison.

Building the AI and Data Science Talent Pipeline

India's AI talent market is simultaneously abundant and scarce. The graduate engineering pipeline is very large, but only a small fraction of those graduates arrive with production-grade machine-learning experience, and retention — not headcount — is the constraint most GCC leaders report.

How AI and Analytics Roles Are Priced

An AI GCC staffs across a recognisable ladder: data analysts at the entry rung, data scientists and ML engineers in the middle, senior data scientists, senior ML engineers, GenAI and LLM specialists and data engineering leads above them, and a head of AI or chief data officer at the top. Compensation climbs steeply across that ladder, and climbs again for the specialisms in shortest supply.

We do not print salary bands for these roles. There is no published Indian survey of AI and data-science compensation that we would stand behind, the figures in circulation are largely recycled between recruiter reports, and the real spread moves quickly with city, specialism and the candidate's demonstrated production experience. Get live compensation data for your target cities and seniority bands before modelling headcount cost. Three things hold generally: production-grade experience with modern ML and GenAI tooling is priced well above nominal years of experience, GenAI and LLM specialists carry the sharpest premium of any specialism, and a GCC has to pay above Indian IT services firms for the same role to win lateral hires. Measure each of those gaps in your own target market rather than applying a fixed percentage.

Talent Acquisition Strategy

AI upskilling is now a standing budget line at most GCCs rather than a one-off programme. A sustainable pipeline requires:

• Premium campus hiring: Target IITs, IISc Bangalore, IIIT Hyderabad, ISI Kolkata, and CMI Chennai for data science and ML graduates. These institutions produce research-ready candidates who can contribute to AI R&D from day one
• Reskilling programmes: Convert existing software engineers into data scientists through structured 6-12 month programmes with mentorship and certification
• Kaggle and open-source hiring: India has a very large Kaggle and open-source community. Screen candidates through Kaggle competition rankings and GitHub contributions for practical ML skills
• Industry lateral moves: Target data teams at Indian e-commerce (Flipkart, Myntra), fintech (Razorpay, PhonePe), and SaaS companies (Zoho, Freshworks) where analytics maturity is high

Retention and Attrition Management

Attrition among AI and data talent runs materially higher than in general engineering roles. Effective retention strategies include:

• Competitive ESOP programmes vesting over 3-4 years
• Research paper publication opportunities and conference attendance budgets
• Rotation programmes to the parent company's global offices
• Investment in GPU infrastructure that enables state-of-the-art research (talent is attracted to cutting-edge tooling)

GPU Infrastructure and Data Centre Ecosystem

AI and ML workloads require substantial compute infrastructure. India's data centre ecosystem is scaling rapidly to meet this demand, with large capacity additions under construction in Mumbai, Chennai and Hyderabad.

GPU Compute Options in India

Data Centre Hub Development

Major infrastructure developments that benefit AI GCCs include:

• Sovereign GPU capacity: Yotta's NVIDIA partnership and the IndiaAI Mission's empanelment of GPU providers have made large accelerator clusters available domestically rather than only through offshore regions
• Hyderabad expansion: A substantial pipeline of new campuses is under construction, adding to Mumbai's established base
• Chennai and Mumbai: New AI-ready capacity is being commissioned in Chennai and in Mumbai
• Tier 2 city expansion: A growing minority of GCC units now sit in tier-2 and tier-3 cities such as Pune, Coimbatore and Visakhapatnam, where real estate and salary costs are lower than in the metros

For GCCs running production AI workloads, a hybrid approach — cloud-based GPUs for experimentation and burst workloads combined with co-located on-premises clusters for production inference — typically provides the best cost-performance balance.

Entity Structure and Tax Optimisation

The standard entity structure for an AI GCC is a private limited company registered under the Companies Act 2013, with 100% FDI under the automatic route. IT and data analytics services permit 100% foreign ownership without government approval.

Tax Considerations

• Corporate tax: New manufacturing companies incorporated after October 1, 2019 that commenced manufacturing on or before 31 March 2024 can avail the concessional rate of 15% under section 201 (Table, Sl. No. 1) read with section 205(2) of the Income-tax Act, 2025 (section 115BAB of the Income-tax Act, 1961) — the window for new applicants has since closed. A services GCC's realistic option is the concessional regime under section 200 read with section 205(1) of the Income-tax Act, 2025 (section 115BAA of the Income-tax Act, 1961) — a 22% base rate, an effective 25.17% with the 10% surcharge and 4% cess, in exchange for giving up most incentive deductions
• Transfer pricing: Critical for AI GCCs — the pricing of analytics and AI services provided to the parent company must be benchmarked against comparable transactions. Safe Harbour Rules for IT-enabled services may apply — for tax year 2026-27 onward, rule 89(2) of the Income-tax Rules, 2026 sets a single margin of not less than 15.5% of operating expense for information technology services (software development, ITeS, KPO and related contract R&D) where aggregate operating revenue does not exceed ₹2,000 crore — often above benchmarked arm's length margins. Rule 89(2) also carries a new row for the provision of data centre services at a margin of not less than 15%
• R&D deductions: Expenditure on in-house scientific research is deductible in full under section 45 of the Income-tax Act, 2025 (section 35 of the Income-tax Act, 1961) — a 100% deduction; the enhanced 150%/200% weighted deductions were withdrawn with effect from 1 April 2021. AI research conducted by the GCC may qualify if the in-house R&D facility is approved by the DSIR
• SEZ benefits: The section 10AA income-tax holiday (100% of export profits for five years, 50% for the next five, and 50% again where the profit is credited to a reserve) is closed — only units that began manufacturing or providing services on or before 31 March 2020 qualify, and section 144 of the Income-tax Act, 2025 is a grandfathering shell for those units. A GCC set up today cannot claim it; SEZ status still matters for customs and GST treatment of exports

Startup India Benefits

If the GCC qualifies as a DPIIT-recognised startup (not formed by splitting up or reconstructing an existing business), it can apply for a 100% deduction of profits for three consecutive tax years out of its first ten under section 140 of the Income-tax Act, 2025 (section 80-IAC of the Income-tax Act, 1961). Two conditions are routinely missed: the deduction needs a certificate of eligible business from the Inter-Ministerial Board, and turnover must not exceed INR 300 crore (the cap set by the Finance Act, 2026) in the tax year of the claim. DPIIT recognition also brings simplified annual compliance procedures, and self-certification for labour and environmental law compliance.

Operational Compliance Checklist for AI GCCs

Beyond DPDP and FEMA compliance, AI GCCs must manage the standard Indian regulatory stack:

• GST registration and monthly returns (GSTR-1 by the 11th, GSTR-3B by the 20th)
• Appointment of a resident director — at least one director must have stayed in India for 182+ days in the financial year
• Statutory audit by an independent Chartered Accountant (mandatory from year one, regardless of revenue)
• Annual ROC filings — Form MGT-7 (annual return) and Form AOC-4 (financial statements)
• EPF and ESI registration for employees earning below the threshold
• CERT-In compliance — 6-hour incident reporting and annual cybersecurity audits apply to all IT companies

For a complete compliance overview, refer to our compliance calendar and compliance deadlines guide.

Data Governance Architecture for AI GCCs

Building a compliant data governance architecture from day one is critical for AI GCCs. Retrofitting governance onto an existing data lake or ML pipeline is substantially more expensive than building it correctly from the start.

Recommended Architecture Layers

• Data ingestion layer: Implement consent capture and purpose tagging at the point of data collection. Every data record entering the system should carry metadata specifying the consent scope and processing purpose
• Data catalogue and lineage: Maintain a searchable catalogue of all datasets with lineage tracking from source to model output. This is essential for DPDP Act compliance — you must be able to demonstrate what personal data was used, for what purpose, and where it was processed
• Anonymisation pipeline: Build automated anonymisation and pseudonymisation pipelines that process personal data before it enters ML training environments. Techniques include k-anonymity, differential privacy, and synthetic data generation
• Access control: Implement role-based access control (RBAC) with the principle of least privilege. Data scientists should only access the data subsets required for their specific models, not the entire data lake
• Audit logging: Maintain comprehensive audit logs of all data access, processing, and model training activities. The DPDP Act and CERT-In both require detailed audit trails — integrate these into a unified logging framework
• Data deletion workflows: Automate data deletion when the processing purpose is fulfilled. Under the DPDP Act, retention beyond the stated purpose is a violation, so build time-to-live (TTL) policies into your data infrastructure

For GCCs handling sensitive financial or health data, consider engaging a specialised data governance consultancy alongside your tax and compliance advisory to ensure the governance architecture meets both Indian regulatory requirements and global standards like ISO 27001 and SOC 2.

Key Takeaways

• New Indian GCCs are being set up AI-first — the shift from back-office to AI-native operations is accelerating, driven by India's data science and ML talent pool and its cost arbitrage against US salaries
• DPDP Act compliance is phased but preparation should start now — full obligations including breach notification and SDF duties become binding by 13 May 2027, with penalties of up to INR 250 crore under the Schedule to the Act
• Compensation is the largest and least predictable line in the build — there is no citable Indian salary survey for AI and data-science roles, so price your target seniority bands from live recruiter data rather than from a published range
• India's GPU infrastructure is scaling rapidly — domestic NVIDIA-class clusters and IndiaAI Mission empanelment mean A100/H100 capacity no longer has to be rented offshore
• Structure as a wholly-owned subsidiary under automatic route FDI — 100% ownership permitted, with potential tax benefits through concessional corporate tax rates and R&D deductions

For assistance with setting up your AI GCC as a foreign subsidiary in India, navigating FEMA compliance, or structuring transfer pricing for inter-company service arrangements, contact our advisory team.