Resources Categories
INDUSTRY FACT FILE · ITES, BPO, KPO & GCCS
Industry Overview: ITeS, BPO, KPO and Global Capability Centres in India
Who runs customer and business processes for organisations worldwide, the obligations that reach them, who buys cybersecurity and why each needs a distinct approach.
|
In this document 1. Why service-centre security matters now 2. The ecosystem at a glance 3. Categories of ITeS, BPO, KPO and GCC organisations 4. The obligations that reach service centres 5. Government, client and private participants 6. Who buys cybersecurity inside a service centre 7. Why each centre type needs a different approach 8. How Codec Networks works with service centres |
|
Sector scope Sector: ITeS, BPO, KPO and GCCs — contact centres, shared service centres, global capability centres and outsourced processing businesses. Primary service proposition: customer data protection, access reviews, DLP assessments, SOC, privacy and insider threat investigations. Software developers, system integrators and MSPs are covered in the IT Services fact file. |
1. Why service-centre security matters now
India's ITeS, BPO, KPO and global capability centres (GCCs) run customer service, back-office processing, analytics, finance and technology operations for organisations around the world. Their people see client customers' identities, accounts, health records and payment details on screen every day.
|
6 hours To report cyber incidents to CERT-In |
Mar 2025 PCI DSS v4.0 future-dated requirements mandatory |
180 days ICT logs to be kept in India |
May 2027 Most DPDP obligations take effect |
That makes people the main control surface. Criminal groups recruit and bribe agents, impersonate staff to talk help desks into password and MFA resets, and target finance teams with fake bank-change requests. In 2023, attackers reportedly used help-desk social engineering to breach a major US casino group, and in 2025 a large US crypto exchange disclosed that bribed overseas support contractors had leaked customer data.
CERT-In's Directions require six-hour incident reporting, and the DPDP framework requires reasonable security safeguards for personal data. Clients pass on their regulators' outsourcing rules, PCI DSS for card data, and overseas privacy laws such as GDPR and HIPAA.
|
Key takeaway In people-intensive operations, controlling what each person can see, copy and change matters as much as firewalls. Clients increasingly audit the delivery floor itself. |
2. The ecosystem at a glance
Figure 1: India's ITeS, BPO, KPO and GCC ecosystem.
3. Categories of ITeS, BPO, KPO and GCC organisations
|
Category |
Who they are |
Typical ownership |
Key regulatory basis |
|
Contact centres |
Voice, chat and email customer support and collections |
Indian and global BPO firms, captive centres |
CERT-In; DPDP; client contracts; PCI DSS where cards handled; TRAI for telemarketing |
|
BPO back-office operations |
Claims, payments, records management, data processing |
BPO firms and captives |
CERT-In; DPDP; client regulator flow-down |
|
KPO and analytics firms |
Research, analytics, legal, financial and medical services |
Specialist firms and captives |
Client contracts; DPDP; overseas privacy laws |
|
Shared service centres |
Finance, HR, procurement and IT for group companies |
Indian and multinational groups |
Group policies; DPDP; financial controls |
|
Global capability centres |
Captive technology, operations and R&D hubs of global firms |
Multinational parent companies |
Parent standards; home-country regulators; CERT-In; DPDP |
|
Outsourced processing businesses |
Specialised processing for banks, insurers and healthcare |
BPO and technology firms |
Client regulator outsourcing rules; HIPAA or GDPR for overseas clients |
|
Work-from-home delivery |
Agents and analysts working remotely |
All of the above |
Client contracts; DoT OSP guidelines (liberalised in 2020) |
4. The obligations that reach service centres
|
Instrument |
What it means for service centres |
|
CERT-In Directions (28 April 2022) |
Cyber incidents reported within six hours of noticing them; ICT logs kept for a rolling 180 days in India |
|
CERT-In audit policy guidelines (25 July 2025) |
Risk-based, independent cyber audits, with event-triggered audits after major changes |
|
DPDP Act 2023 and DPDP Rules 2025 |
Clients as data fiduciaries must ensure processors apply reasonable safeguards; most obligations from May 2027 |
|
Client regulator outsourcing rules |
RBI, SEBI and IRDAI require their regulated entities to oversee service providers, with audit rights and incident clauses |
|
PCI DSS v4.0 |
Card-data security standard for contact centres taking payments; future-dated requirements mandatory from 31 March 2025 |
|
Overseas and telemarketing rules |
GDPR, HIPAA and other client-country laws through contracts; TRAI's 2018 regulations for commercial communications |
|
How these apply Many requirements reach service centres through client contracts. Confirm the clauses in your agreements and the official instruments. |
5. Government, client and private participants
- CERT-In sets incident reporting, logging and audit expectations.
- MeitY oversees the IT Act and DPDP framework; DoT liberalised Other Service Provider guidelines in 2020, easing registration requirements.
- TRAI regulates commercial telemarketing communications.
- Clients and parent companies set security standards and audit the delivery floor.
- Industry bodies such as NASSCOM support standards and skilling.
6. Who buys cybersecurity inside a service centre
|
Stakeholder |
What they care about |
What they buy |
|
Centre head and delivery leadership |
Client trust, audits, contract renewals |
Assurance programmes, client reporting |
|
CISO |
Insider risk, identity attacks, incidents |
SOC, UEBA, DLP, red teaming |
|
Client and account managers |
Client audit findings and SLAs |
Audit readiness and evidence packs |
|
IT and help-desk leads |
Reset processes, endpoints, VDI |
Access reviews, help-desk controls |
|
Compliance and quality |
ISO, SOC 2, PCI DSS |
Readiness and audits |
|
HR and legal |
Background checks, investigations |
Insider investigations, evidence handling |
|
Data protection lead |
DPDP, GDPR and HIPAA |
Privacy programme, DLP |
7. Why each centre type needs a different approach
|
Centre type |
Highest-consequence risk |
Starting point for assurance |
|
Contact centre |
Insider data theft and screen capture |
Masking, clean-desk, UEBA, DLP |
|
BPO back-office |
Fraudulent account and payment changes |
Maker-checker review, access recertification |
|
KPO and analytics |
Bulk data leakage and AI tool misuse |
DLP, access reviews, AI governance |
|
Shared service centre |
BEC and vendor-master fraud |
Payment-control testing, BEC simulation |
|
Global capability centre |
Privileged access into parent systems |
Tiered admin, PAM, joint SOC |
|
Work-from-home teams |
Unmanaged devices and local data |
VDI, encryption, WFH audits |
8. How Codec Networks works with service centres
Codec Networks is a CERT-In empanelled information security auditing organisation certified to ISO 9001:2015, ISO/IEC 27001:2022 and ISO/IEC 20000-1:2018. For service centres we deliver customer data protection reviews, access reviews, DLP assessments, managed SOC with UEBA, privacy programmes and forensic insider threat investigations.
Talk to Codec Networks
|
Contact Codec Networks Pvt. Ltd. New Delhi: 507, 5th Floor, New Delhi House, Barakhamba Road, Connaught Place, New Delhi – 110001 Gurugram: 707, 7th Floor, Silverton Tower, Golf Course Extension Road, Sector 50, Gurugram – 122018, Haryana Landline: 011 430 496 96 | 011 437 522 99 Mobile: +91 99716 76124 | +91 88007 88220 | +91 88003 31124 Email: mktg@codecnetworks.com Web: www.codecnetworks.com |
Note: This document is general industry guidance based on public information available as of October 2026. Client, card-industry and overseas requirements apply through contracts. Confirm obligations against the official CERT-In, MeitY, DoT, TRAI and client-regulator instruments and your agreements.