The Complete Compliance Checklist for BPOs and Global Capability Centres

BPOs and Global Capability Centres (GCCs) in India run large, often round-the-clock workforces handling sensitive client and customer data, which puts them at the intersection of labour law, workplace safety and data protection compliance. This checklist covers the areas that matter most.

Key facts at a glance

• BPOs handling certain telecom-linked traffic may still need to confirm Other Service Provider (OSP) registration status with the Department of Telecommunications.
• EPF is mandatory once a company has 20 or more employees, on wages up to Rs 15,000/month.
• ESI is mandatory once a company has 10 or more employees, on wages up to Rs 21,000/month, and coverage has expanded to more IT/BPO categories.
• A POSH Internal Committee is mandatory once a company has 10 or more employees, including remote and hybrid teams.
• Most states require additional safeguards for women working night shifts, such as transport and security.
• DPDP Act substantive obligations become enforceable from 13 May 2027, applying to any personal data processed within India regardless of client location.
• The four Labour Codes came into force nationally on 21 November 2025, with state-level rules still being notified.

OSP registration and telecom-linked compliance

BPOs handling voice or data traffic historically needed Other Service Provider (OSP) registration from the Department of Telecommunications, particularly for international call centres. Recent years have seen significant relaxation of these requirements, including removal of many reporting and infrastructure conditions. Companies should confirm current applicability with DoT for their specific service model rather than assume either full exemption or full applicability by default.

Shops and Establishments and Special Economic Zone status

Most BPO and GCC offices register under the state Shops and Establishments Act, which governs working hours, leave, holidays and record-keeping. GCCs and BPOs operating out of SEZ units follow an additional layer of compliance under SEZ rules, including specific reporting to the Development Commissioner, alongside the standard state-level registration.

Labour law compliance for round-the-clock operations

BPOs and GCCs frequently run multiple shifts, including overnight, which brings additional labour compliance considerations beyond the standard thresholds.

POSH for hybrid and remote-heavy workforces

Because much of the BPO/GCC workforce operates in hybrid or fully remote arrangements, the Internal Committee and POSH policy need to explicitly cover virtual harassment scenarios (video calls, chat platforms) in addition to physical workplace incidents. The Supreme Court's push for district-wise POSH audits and mandatory ICC registration on the government's SHe-Box portal applies to these companies the same way it applies to traditional offices.

Data protection for client and customer data

BPOs and GCCs process large volumes of personal data on behalf of clients, often across borders. Under the DPDP Act 2023, the Data Protection Board is already operational, the Consent Manager framework becomes operational 13 November 2026, and full substantive obligations around notice, consent, security safeguards and breach reporting become enforceable 13 May 2027. Penalties for failing to implement reasonable security safeguards can reach up to Rs 250 crore per instance. For companies processing data for overseas clients, this is a domestic Indian obligation that sits alongside whatever data protection terms exist in the client contract, not a substitute for them.

Labour Codes transition

The four Labour Codes (Wages, Industrial Relations, Social Security, OSH) came into force nationally on 21 November 2025. Because labour is a concurrent subject, each state must notify its own rules before the Codes are fully operational there, and most states had not fully notified as of mid-2026. BPOs operating across multiple states should track each state's specific status for provisions like overtime, working hours and social security definitions rather than assuming uniform national applicability yet.

If you are not sure where your BPO or GCC stands on labour and statutory compliance, ComplianceCheck's statutory compliance assessment gives you a clear picture in a few minutes.

Sources

• Department of Telecommunications — dot.gov.in
• Ministry of Labour and Employment — labour.gov.in
• EPFO — epfindia.gov.in
• ESIC — esic.gov.in
• MeitY / Data Protection Board — meity.gov.in
• Respective state labour department

This guide is general information, not legal advice. Requirements vary by state, sector and headcount - confirm specifics with a compliance professional or the relevant authority.