Greenfield operations: India’s legal framework for GCCs

India’s emergence as a global business and technology hub has led multinational corporations to increasingly invest through two key greenfield models – global capability centres (GCCs), which build strategic enterprise capabilities, and data centres that represent long-term investment in digital infrastructure.

Building GCCs in India

India now hosts more than 2,000 GCCs, employing about two million professionals and generating nearly USD100 billion in revenue.

Multinational corporations (MNCs) typically choose from three principal entry models:

1. A wholly owned subsidiary offering full ownership and control but requiring complete set-up management;
2. A joint venture providing local expertise but involving shared control; or
3. A build-operate-transfer (BOT) model, under which a service provider establishes and operates the centre before transferring it to the Indian entity (typically through a master service agreement).

A GCC is typically established as a private limited company under the Companies Act, 2013. Setting up requires attention to governance matters including board composition, reporting structures, directors’ duties, corporate policies and ongoing statutory filings.

From an exchange control perspective, sectors commonly associated with GCCs, including information technology services, business process management and R&D, are permitted to have 100% foreign ownership under the automatic route (except for entities in a country sharing a land border with India), subject to applicable pricing and reporting requirements.

GCCs must also comply with a broader regulatory framework, viz employment and data governance. Labour laws regulate wages, social security, industrial relations and workplace safety, with state-level variations creating additional compliance considerations.

Under the Digital Personal Data Protection Act, 2023 (DPDP Act), GCCs must evaluate their role as data fiduciaries or data processors and ensure compliance with applicable obligations, including data protection, incident reporting and data retention requirements prescribed by the Indian Computer Emergency Response Team (CERT-In).

Data centres driving growth in India

A data centre is the physical infrastructure that keeps the digital world running, housing servers and equipment that store and process data for businesses, cloud platforms and digital applications. Rising digital consumption, evolving data localisation requirements and increasing AI use have created strong demand for data centre infrastructure in India. With cost advantages, an expanding digital ecosystem and a skilled workforce, India is well positioned as a leading destination for global data centre investment.

The Ministry of Electronics and Information Technology released the draft Data Centre Policy, 2020, proposing measures such as infrastructure status for data centres, incentive schemes, single-window clearances, dedicated data centre economic zones, and specialised construction standards.

A foreign company establishing a data centre in India will typically do so through an Indian subsidiary or joint venture, similar to GCCs. Land acquisition is another key consideration – the project site must have clear, marketable title and be zoned for industrial or commercial use, with change of land use approvals where necessary. Land acquisition is subject to stamp duty and registration, although several states offer incentives. Developers must also secure building plan approvals, fire safety clearances and environmental consents.

Given the energy-intensive nature of data centres, power procurement is a key operational consideration – usually sourced from distribution licensees through open access arrangements, or from captive generating plants. The captive model is often preferred for exemptions from cross-subsidy and additional surcharges, although operators must satisfy prescribed ownership and consumption requirements to qualify for captive status.

Conclusion

Data centres must navigate India’s evolving data governance framework. Operators providing only physical infrastructure (rack space, power, cooling and security) may not be regarded as processing personal data.

However, managed hosting and cloud service providers handling customer data are generally treated as data processors under the DPDP Act and must comply with CERT-In requirements.

Many data centre customers in regulated sectors such as banking, insurance and telecoms are subject to data localisation and residency requirements, often reflected in contractual arrangements.

Sidharrth Shankar and Prakriti Jaiswal are partners at JSA