Setting up a GCC in India: Managing employment and IPR risks

India has become the preferred jurisdiction for Global Capability Centres (‘GCCs’) across technology, financial services, pharmaceuticals, retail, manufacturing, consulting and digital businesses. What began as a cost-efficient offshore delivery model has evolved into a strategic platform for global innovation, product engineering, analytics, cybersecurity, finance, legal operations and AI-led transformation. India is home to more than 1,700 GCCs generating revenue of USD 64.6 billion and directly employ more than 1.9 million people.

For foreign business owners, general counsel, investors, advisers and foreign lawyers advising on India entry or expansion, this evolution has an important legal consequence: the GCC model is no longer just a corporate structuring or tax question. It is equally an employment, compliance, data governance and intellectual property (‘IP’) risk-management exercise. In the absence of appropriate legal compliance and contractual protections, an Indian GCC may successfully hire talent and deliver services, but leave the global enterprise significantly exposed to legal and financial risk due to employee claims, contractor misclassification risks, unclear IP ownership, data protection breaches, unenforceable restrictive covenants and regulatory non-compliance.

This article highlights the principal legal and practical considerations that foreign stakeholders should keep in mind when establishing or scaling a GCC in India.

Employment law in India is local, layered and operationally intensive

A common misconception among foreign businesses is that Indian employment law is relevant primarily to factories, blue-collar establishments or unionized workforces. This is incorrect, as GCCs, even when staffed entirely by highly skilled engineers, analysts, finance professionals or technology specialists, are subject to a wide range of central and state-level employment laws.

Depending on the State in which the GCC operates, employers must consider shops and establishments legislation, social security rules, labour welfare fund contributions, maternity benefits, sexual harassment prevention obligations, working hours, leave and holiday rules, wage-payment requirements and employee-record maintenance.

India has also moved into a new phase of labour law consolidation through the four Labour Codes covering wages, industrial relations, social security, and occupational safety, health and working conditions. The Codes came into force on 21 November 2025, with central rules notified in May 2026, while State-level implementation continues in a phased manner. For GCCs, this means employment contracts, wage structures, payroll practices, working-hour policies, social security contributions, contractor arrangements and HR processes now need to be re-assessed through the lens of the labour codes. Indian employment documentation must be localized to ensure enforceability, statutory compliance, practical administration and legal risk mitigation.

Workforce structuring: Employees, contractors, vendors and BOT models

Most GCCs use a combination of direct employees, consultants, vendor personnel, secondees and outsourced service providers. Each category carries different legal consequences.

The highest risk often arises where personnel are formally employed by a contractor or vendor but are functionally controlled by the GCC. If the GCC supervises day-to-day work, controls attendance, assigns tasks directly, provides tools and integrates vendor personnel into its internal teams, Indian authorities or courts may examine whether the arrangement is a genuine outsourcing model or a disguised employment relationship.

Build-operate-transfer (‘BOT’) models require particular care. During the ‘build’ phase, employees may be hired by an Indian service provider, with the intention that they later transition to the foreign company’s captive entity. Unless this transition is carefully navigated and documented, disputes may arise regarding continuity of service, accrued benefits, confidentiality, IP ownership, employee consent, non-solicitation obligations and liability allocation between the vendor and the GCC.

Do’s

·                Conduct a legal review before deciding between direct hiring, outsourcing, BOT, professional employer organisation or consultant models.

·                Ensure vendor contracts contain labour-law compliance obligations, indemnities, audit rights and access-control obligations.

·                Maintain a clear distinction between vendor employees and GCC employees in reporting lines, email domains, system access and HR processes.

·                Plan employee transfers under BOT structures through properly documented tripartite or transfer arrangements.

Don’ts

·                Do not allow vendor employees to be managed exactly like direct employees without analyzing deemed employment risk.

·                Do not transfer employees from vendor to captive entity without dealing with continuity, benefits, confidentiality and IP assignment.

Operation of Restrictive Covenants

Foreign employers often seek to protect their GCC investment through non-compete clauses. However, post-employment non-compete restrictions are not enforceable in India, particularly where they prevent an individual from pursuing their profession after employment ends.

The more effective Indian strategy is to focus on enforceable and evidence-backed protections, such as confidentiality, non-solicitation, garden leave where suitable, return of property, invention assignment, data-access restrictions and trade-secret protection. The contract should be supported by operational controls such as role-based access, clean exit processes, device return, source-code repository logs and internal confidentiality protocols.

For senior level employees, product architects, AI engineers, cybersecurity personnel and finance or legal leadership, a generic offer letter is inadequate. Employment contracts should be tailored to the employee’s role and information access.

Do’s

·                Use strong confidentiality and trade-secret clauses.

·                Include invention disclosure and IP assignment obligations.

·                Implement exit checklists covering devices, credentials, repositories, documents and client materials.

·                Use narrowly drafted non-solicitation clauses rather than broad post-employment non-competes.

Don’ts

·                Do not assume non-compete will be enforceable in India.

·                Do not rely on contractual language alone without technical access controls.

·                Do not delay exit audits for employees with access to critical code, customer data or product strategy.

IP ownership: The central legal issue in high-value GCCs

One of the most significant legal issues in the modern GCC model is ownership of the work product. Indian GCCs routinely create software code, AI models, product documentation, patentable inventions, technical designs, databases, trade secrets, process improvements and know-how. If ownership of IP and work product is not properly documented, the foreign parent may not have a clean title chain to assets created in India.

For foreign businesses, this affects valuation and ownership. If Indian employees are developing patentable technologies, AI systems, engineering solutions, algorithms, fintech architecture, product features or platform innovations, the employment contract must clearly and presently assign the relevant rights to the appropriate group entity.

Development by consultants and independent contractors are at an even higher risk. Payment for work does not automatically mean ownership of IP. Written assignment provisions are essential.

Do’s

·                Include assignment language in employment and consultancy agreements.

·                Cover inventions, improvements, software, source code, object code, documentation, designs, databases, models, trade secrets and know-how.

·                Require employees and consultants to assist with patent filings, record-keeping and future documentation.

·                Maintain an internal IP register mapping key assets to creators, contracts and assignment documents.

·                Review open-source software usage and repository governance.

Don’t s

·                Do not assume that all IP automatically belongs to the employer.

·                Do not use generic confidentiality clauses as a substitute for assignment language.

·                Do not allow consultants to develop core IP without signed assignment agreements.

·                Do not ignore moral rights, further-assurance obligations and post-exit cooperation clauses.

Data protection, AI governance and employee monitoring

GCCs typically process large volumes of personal data, employee data, customer data, vendor data and sometimes sensitive operational or regulated data from foreign markets. India’s digital personal data protection regime creates a comprehensive framework for digital personal data processing, including obligations around notice, consent, rights of individuals, security safeguards and breach-related responsibilities.

For GCCs, data protection issues arise in multiple contexts: HR systems, background verification, workplace monitoring, internal investigations, global HR analytics, whistle-blower platforms, productivity tools and cross-border data flows within multinational groups.

AI use adds another layer of risk. GCCs increasingly use or develop AI tools for coding, customer analytics, compliance review, recruitment, finance processes and internal productivity. Therefore, the following questions become pertinent - what data is being used to train or test AI systems? are open-source components being used? are employees uploading confidential code or client data into external AI tools? who owns AI-assisted outputs? are logs and audit trails maintained?

Building a defensible GCC legal framework

A well-structured GCC should ensure that its legal framework includes:

·         localized employment contracts;

·         state-wise employment law compliance mapping;

·         payroll and wage-structure review;

·         contractor and vendor governance;

·         POSH compliance and internal complaints committee constitution;

·         social security registrations and filings;

·         data protection notices and internal privacy policies;

·         IP assignment and invention disclosure procedures;

·         open-source software and AI-use policies;

·         exit management protocols; and

·         periodic legal audits.

Conclusion

India offers foreign businesses a compelling GCC proposition: deep talent, scale, innovation capability, English-language proficiency and mature professional infrastructure. However, the legal environment is sophisticated and cannot be navigated through generic global templates.

Foreign businesses need to be mindful that employment compliance and IP ownership are not back-office legal issues. They are directly linked to enterprise value, risk allocation and operational continuity. The assets of a GCC must be protected through clear contracts, compliant workforce structures, robust data governance, and a well-documented IP chain.

In the next phase of India’s GCC growth, legal preparedness will distinguish resilient global businesses from those that discover risks only at the point of dispute, audit, transaction or exit.

[The authors are Partner and Principal Associate, respectively, in Corporate and M&A practice at Lakshmikumaran & Sridharan Attorneys]