Amongst the various sectors which FDPPI is targetting for development of DGPSI sectoral frameworks, “Global Capability Centers” or GCCs present a specific challnge.
DGPSI already have a framework DGPSI-HR for HR operations and DGPSI-DP for Processor platforms which have some connection with the requirements of GCC. But there are reasons to think of a new framework DGPSI-GCC which is more suitable for the GCCs.
Global Capability Centers (GCCs) are fully owned, internal corporate offices set up by multi national companies in foreign countries to hadle core business operations, technology and innovation. Unlike traditional outsourcing where a third-party vendor is hired to complete repetitive tasks, a GCC is an organic extension of the parent company itself. It operates with the same company culture, protects the same intellectual property, and directly executes strategic goals.
If a GCC has created a local Indian company and conducts the operations by the Indian Company, the employees may all be employees of the Indian Company while the data processed may actually be of foreigners.
In such cases the Indian Company will be a Data Fiduciary for the employee data while they are Joint Data Fiduciaries for the client data processed by them on behalf of the foreign entity which may be a parent company or subsidiaries of the parent company in other countries.
In case the Indian operations are conducted directly under the MNC, the DPDPA will still be applicable since the processing of personal data occurs in India. There is an exemption clause under Section 17(1)(d) . This section states as follows:
17: Exemptions:
(1) The provisions of Chapter II, except sub-sections (1) and (5) of section 8, and those of Chapter III and section 16 shall not apply where—
(d) personal data of Data Principals not within the territory of India is processed pursuant to any contract entered into with any person outside the territory of India by any person based in India;
A close observation of this means that the employees data of a GCC even under a direct operation will come under the jurisdiction of DPDPA and the MNC will become a Data Fiduciary.
Further since the personal data is processed by the MNC directly, there is no contract with any person based in India. Hence the exemption cannot apply even to the personal data of other customers which is processed by the GCC.
It is strategicall imperative that the GCC is established under the name of an Indian company only so that the exemption of Section 17(1)(d) would be available to data other than that of the employees.
DGPSI-GCC will therefore consider this as almost a mandatory suggestion.
In this context the local company will be a Data Fiduciary which will be liable for the employee data processing with all the obligations of DPDPA and limited obligation such as Section 8(1) and 8(5) in respect of other data.
The employee data will be liable for Chapter II, Chapter III as well as Section 16 of the Act which may otherwise be exempted for customer data.
This modified version of DGPSI is the DGPSI-GCC.
Naavi
