Running IT · Guide
GCC setup in Bengaluru: one IT baseline for two rulebooks.
A new GCC floor in Bengaluru answers to its parent’s security standard and to Indian law: the CERT-In Directions from opening day1, the DPDP Act’s duties from 13 May 202723. Build it once, from a one-page crosswalk, so the floor’s systems produce the evidence both will ask for.
- Written by
- NetScale IT Services
- Published
- Sources checked
- Read
- 10 minutes
- Sources
- 13, listed below
On this page
The facts
What does a new GCC floor answer to?
A new global capability centre (GCC) floor opens on the date in the lease. By then its network, Wi-Fi, security, collaboration and devices have to satisfy two rulebooks: the parent’s global standard and Indian law.
The CERT-In Directions of 28 April 2022 require a named Point of Contact, and a report within 6 hours of noticing a listed incident1. They also require logs of all information and communication technology (ICT) systems, kept for a rolling 180 days in India1. Where the parent is the Data Fiduciary, the DPDP Act will hold it responsible for processing done on its behalf2. That duty, in section 8, comes into force on 13 May 20273.
One design can serve both. Map each parent control to the Indian duty it meets, on one page, and build the floor from that map.
Where the new centres are opening
The nasscom and Zinnov report of 2 July 2026 counts 2,117 GCCs in India across 3,728 units in FY26, employing about 2.36 million people4. It puts total market revenue at US$98.4 billion4. Of the centres set up after FY2021, 96% launched with a product or portfolio mandate4. The release states no method.
GCCs leased about 16.5 million sq ft of office space in the first half of 2026, Cushman & Wakefield reported5. That was up about 38% on a year earlier5. It was also 38% of India’s office leasing5. Bengaluru remained the largest GCC market, at 5.36 million sq ft5.
Karnataka’s GCC policy for 2024 to 2029, released on 19 November 2024, aims for 500 new centres and a state total of 1,000 by 20296. It promises fast-track approvals within 45 days6.
The facts
What do the CERT-In Directions ask of a GCC?
The Directions apply to every “body corporate”1. CERT-In’s FAQ takes that term from section 43A of the IT Act: any company, including a firm or sole proprietorship7. The FAQ adds that the Directions apply to “any entity whatsoever” in the matter of cyber incidents7.
| Clause | What it says | What the floor needs |
|---|---|---|
| (i) Time | Sync all ICT clocks to the Network Time Protocol (NTP) servers of the National Informatics Centre (NIC) or National Physical Laboratory (NPL)1. Servers traceable to them also count1. An entity spanning several geographies may use another standard source that does “not deviate from NPL and NIC”1. | One time source for every switch, firewall, access point and server, and a record that it matches NIC or NPL. |
| (ii) Reporting | Report the incident types in Annexure I “within 6 hours of noticing such incidents or being brought to notice about such incidents”1. Annexure I lists 20 types1. | A person in India with the authority to file. |
| (iii) Point of Contact | Designate a Point of Contact to interface with CERT-In, and send the details in the Annexure II format1. | A named person and a deputy, registered before the floor opens. |
| (iv) Logs | Enable logs of all ICT systems and keep them “for a rolling period of 180 days”, “within the Indian jurisdiction”1. | A log store in India, sized for 180 days of every device on the floor. |
Two FAQ answers matter to a GCC. When an incident touches more than one party, “Any entity which notices the cyber security incident, shall report to CERT-In”7. That obligation “is neither transferrable nor indemnified”7.
On logs, the FAQ says they “may be stored outside India also” if the entity can produce them to CERT-In in reasonable time7. The same FAQ calls itself “not a legal document”7.
The facts
Where does the DPDP Act put a centre working on its parent’s data?
The Act defines a Data Processor as any person who “processes personal data on behalf of a Data Fiduciary”2. Section 8 makes the Fiduciary responsible for that processing “irrespective of any agreement to the contrary”2. It may engage a processor “only under a valid contract”2.
Section 2, the definitions, is in force now3. Sections 3 to 17, with the duties in section 8 and the exemptions in section 17, come into force on 13 May 20273.
A Data Fiduciary is whoever “determines the purpose and means of processing of personal data”, alone or with others2. For the centre’s own staff records, that is likely to be the Indian entity itself.
Section 17(1)(d) covers personal data of people outside India, processed by someone based in India under a contract with someone outside India2. For that processing, Chapter III, section 16 and most of Chapter II do not apply2. Sections 8(1) and 8(5) still do: the Fiduciary’s responsibility and its duty to take reasonable security safeguards2. Whether the exemption covers your centre is for counsel to say.
The DPDP Rules, published in the Gazette as G.S.R. 846(E) dated 13 November 2025, set out what those safeguards must include “at the minimum”8. Rules 6, 7 and 8 come into force 18 months after publication, on 13 May 20278.
- Rule 6(1)(b) and (c): access control over the computer resources the Fiduciary or its processor uses, and logs, monitoring and review of access8.
- Rule 6(1)(e) and 8(3): logs and personal data kept for at least one year, including processing by a Data Processor8.
- Rule 6(1)(f): a safeguards provision in the Fiduciary’s contract with its processor8.
- Rule 7(2): the Fiduciary’s detailed report to the Data Protection Board within 72 hours of becoming aware of a breach8.
The facts
What does the parent bring to the audit?
Its certificate, first. ISO/IEC 27001:2013 certificates not transitioned by 31 October 2025 expired on that date, BSI says9. So any ISO/IEC 27001 certificate the Bengaluru site joins today is to the 2022 edition.
A parent in EU financial services brings the Digital Operational Resilience Act (DORA). It has applied since 17 January 202510. Its areas include ICT risk management, incident reporting, resilience testing and ICT third-party risk10.
DORA defines an “ICT intra-group service provider” as a group undertaking that “provides predominantly ICT services to financial entities” in the same group11. The European Banking Authority was asked whether such a provider outside the EU shares DORA’s exemption from oversight as a critical third-party provider11. Its answer, published on 11 December 2024, says the exemption “does not make a distinction” between providers in the Union and in a third country11.
Help Net Security’s write-up of Verizon’s 2026 Data Breach Investigations Report puts third-party involvement at nearly half of breaches, up 60% in a year12. Only 23% of third-party organisations fully fixed their multi-factor authentication (MFA) issues12.
What it means
Where do the two rulebooks differ on the floor?
Most controls line up. Both rulebooks want access control, logging, an incident process and a contract. They part in four places: where logs live and for how long, which clock the devices trust, who files in India and what the intra-group agreement says.
| Parent control | Indian duty | Evidence the systems should produce |
|---|---|---|
| Log retention, set for the global security information and event management (SIEM) tool | Logs of all ICT systems for a rolling 180 days, within India1. From 13 May 2027, at least a year of logs of personal data processing8. | Retention settings on a store in India, and a search that reaches the oldest day. |
| A global time source | NIC or NPL, or a source that does not deviate from them1. | NTP settings by device class, and a drift check. |
| Incident response through the global security operations centre (SOC) | Any entity that notices a listed incident reports it within 6 hours, and cannot transfer that duty by contract17. | A runbook naming who decides and who files, and the registered Point of Contact. |
| Breach notice to the parent | From 13 May 2027, the Fiduciary’s notice to the Board without delay, and its detailed report within 72 hours8. | A notice time in the intra-group agreement that leaves the parent room to report. |
| Intra-group or supplier agreement | From 13 May 2027, a valid contract, with a provision for reasonable security safeguards238. | The signed agreement and its security schedule. |
| Access reviews | From 13 May 2027, access control over computer resources, and logs of access to personal data8. | Dated review exports from the identity platform, signed off. |
A captive centre is not a vendor, but it sits on the parent’s network and handles the parent’s data. Expect the third-party questions anyway.
Hiring decides what the centre can run itself. In ISC2’s research published on 24 September 2026, 524 security professionals in India named AI (52%) and cloud security (43%) as the most in-demand skills13. Almost all, 97%, reported at least one skills need13.
What it means
What should be in place before the floor opens?
Work back from the opening date:
- Write the crosswalk on one page: each parent control, the Indian duty it meets and the system that will produce the evidence.
- Name the CERT-In Point of Contact and a deputy, and send their details in the Annexure II format1.
- Set every switch, firewall, access point and server to one time source, and record that it does not deviate from NIC or NPL. CERT-In’s FAQ of May 2022 lists samay1.nic.in and samay2.nic.in for NIC, and time.nplindia.org for NPL7.
- Send logs from every ICT system on the floor to a store in India, set to a rolling 180 days1. Check its capacity against the floor’s full log volume before go-live.
- Set at least one year’s retention for logs of personal data processing before 13 May 20278.
- Write the reporting path: who in India decides, who files within 6 hours and how the parent’s SOC hands an alert to them17.
- Add a Rule 6(1)(f) safeguards clause and a breach-notice time to the intra-group agreement8.
- Start the asset register before the first laptop ships: device, serial number, owner, location and support end date.
- Put every configuration and credential in the parent’s vault, not on an installer’s laptop.
In the first quarter after opening
- Run the first access review and file the export.
- Rehearse one reportable incident with the parent’s SOC, through to a draft CERT-In report.
- Restore one floor system from backup and record how long it took.
- Reconcile the asset register with device management.
Our view
Should India get its own stack, or extend the parent’s?
Our view: extend the parent’s design, and add India’s duties to it as configuration. A separate Indian stack doubles the tools to run, and gives the parent’s security team two estates to audit.
Where the rulebooks differ, take the stricter setting. Keep the global SIEM, and add a 180-day store in India for the floor’s logs. The Directions say “within the Indian jurisdiction”1, and the FAQ that allows storage abroad is “not a legal document”7. A copy in India meets both readings.
Design the floor so the systems produce the evidence. Access reviews come out of the identity platform, retention out of the log store and the asset register out of device management. Evidence assembled by hand before an audit is slow to produce and hard to check.
At handover, everything goes into the parent’s vault: configurations, runbooks, credentials and the asset register. The centre should not depend on one installer or one engineer for a password.
If the centre runs cloud workloads, hire for cloud security early: it is the second most in-demand skill in ISC2’s India data13.
There is a fair case for doing less. A small centre on the parent’s cloud desktops has little local ICT beyond the network and the firewall. Its crosswalk is short, and the parent’s stack may cover most of it. The Indian entity still needs its own Point of Contact, and must report any listed incident it notices within 6 hours17.
Limits
What does this leave to counsel and the parent?
Applicability is for your counsel. Take three questions to counsel and the parent’s compliance team: whether your centre is a Data Processor, whether section 17(1)(d) applies and whether DORA treats it as an intra-group ICT provider211. Rules for a centre that is itself regulated by RBI, SEBI or IRDAI are outside this piece, as are building and fire approvals.
Where we fit
Where does NetScale fit on a new floor?
Our new office and GCC floor IT work builds the network, Wi-Fi, security, collaboration and devices to the parent’s standards, phased to the opening date. It starts with a written design and cost model that is yours to keep, and ends with every configuration and credential handed over. Access control, logging and retention are designed in from the start. NetScale is based in Bengaluru and holds ISO/IEC 27001:2022 and ISO/IEC 27701:2025 certificates for its own operations.
Questions readers ask
Does the CERT-In six-hour rule apply to a GCC in India?
Yes, in our reading. The Directions of 28 April 2022 apply to every body corporate, which CERT-In’s FAQ explains as any company, firm or sole proprietorship17. Any entity that notices a listed incident reports it within 6 hours, and the FAQ says that duty cannot be transferred17. Applicability is for your counsel.
Can our GCC send its logs to the parent’s SIEM abroad?
Is a GCC a data processor under the DPDP Act?
Often, for the data it handles on its parent’s behalf: the Act calls anyone who processes personal data for a Data Fiduciary a Data Processor2. From 13 May 2027, the parent as Fiduciary is responsible for that processing and needs a valid contract23. For data of people outside India, section 17(1)(d) lifts most duties but keeps sections 8(1) and 8(5)2. Applicability is for your counsel.
Will the parent’s ISO 27001 certificate cover our Bengaluru floor?
Only if the certificate’s scope is extended to the site. That certificate will be to ISO/IEC 27001:2022: BSI says certificates not transitioned by 31 October 2025 expired on that date9. Ask the parent’s certification lead when the Bengaluru site enters scope, and build the floor’s evidence for that audit.
References
- 1CERT-In, Ministry of Electronics and Information Technology. Directions under sub-section (6) of section 70B of the Information Technology Act, 2000 relating to information security practices, procedure, prevention, response and reporting of cyber incidents for Safe & Trusted Internet. 28 April 2022. cert-in.org.in (opens in a new tab)
- 2Ministry of Law and Justice (Legislative Department), Gazette of India. The Digital Personal Data Protection Act, 2023 (No. 22 of 2023). 11 August 2023. meity.gov.in (opens in a new tab)
- 3Ministry of Electronics and Information Technology, Gazette of India. Notification G.S.R. 843(E) under section 1(2) of the Digital Personal Data Protection Act, 2023. 13 November 2025. meity.gov.in (opens in a new tab)
- 4nasscom and Zinnov (PR Newswire). India’s GCCs are increasingly leading the AI mandate for global enterprises, driving global value creation: Nasscom - Zinnov Report. 2 July 2026. prnewswire.com (opens in a new tab)
- 5Cushman & Wakefield. India’s Office Leasing Reaches ~43 MSF in H1 2026 as GCCs Continue to Drive Demand: Cushman & Wakefield. 14 July 2026. cushmanwakefield.com (opens in a new tab)
- 6India Briefing. Karnataka Global Capability Center Policy 2024-2029: Key Features. 11 December 2024. india-briefing.com (opens in a new tab)
- 7CERT-In, Ministry of Electronics and Information Technology. Frequently Asked Questions (FAQs) on Cyber Security Directions of 28.04.2022. May 2022. cert-in.org.in (opens in a new tab)
- 8Ministry of Electronics and Information Technology, Gazette of India. Digital Personal Data Protection Rules, 2025 (notification G.S.R. 846(E)). 13 November 2025. meity.gov.in (opens in a new tab)
- 9BSI. Transition to the ISO/IEC 27001:2022 standard: what you need to know. Undated page, read October 2026. bsigroup.com (opens in a new tab)
- 10European Insurance and Occupational Pensions Authority (EIOPA). Digital Operational Resilience Act (DORA). Undated page, read October 2026. eiopa.europa.eu (opens in a new tab)
- 11European Banking Authority. 2024_7096 Exemption for Non-EU ICT Intra-group Service Providers. 11 December 2024. eba.europa.eu (opens in a new tab)
- 12Help Net Security, reporting the Verizon 2026 Data Breach Investigations Report. Verizon DBIR: Vulnerability exploitation is the dominant initial access vector. 20 May 2026. helpnetsecurity.com (opens in a new tab)
- 13ISC2. ISC2 Research: India’s Cybersecurity Workforce Reaches a Turning Point: Skills, AI and Retention Define the Next Challenge. 24 September 2026. isc2.org (opens in a new tab)
Changes
- First published.
Written by NetScale IT Services. How these guides are written