Nasscom Calls for Privacy Reset in GCC Employment Data Compliance

Nasscom flags HR data privacy challenge

Nasscom has called attention to the implications of India’s Digital Personal Data Protection framework for employment data handled by global capability centres, arguing that HR compliance now requires a privacy reset.

The issue was highlighted in a Nasscom publication dated 12 August 2026. Its focus on GCC employment data places day-to-day workforce information within the wider discussion on privacy compliance, rather than treating data protection solely as a customer-facing or information-technology matter.

For global capability centres operating in India, the central concern is the role of HR functions in handling employment data. Workforce information is integral to employment administration, but the DPDP framework means that its treatment must also be considered through a privacy lens.

Why the development matters for GCCs

GCCs form part of international business structures and commonly support wider enterprise operations. Within that setting, employment information is not merely an internal administrative record. It is business data handled through HR processes and organisational systems, making its governance a compliance issue for the enterprise.

Nasscom’s emphasis on a “privacy reset” signals that established HR routines should be reconsidered in light of India’s DPDP Rules. The message is relevant not only to HR teams, but also to the legal, compliance, information-security, finance and management functions responsible for organisational controls.

The development also underscores a basic governance point: privacy obligations cannot be addressed only through a policy owned by one department. Employment data originates from and is used across business processes. Effective compliance therefore depends on how those processes operate in practice and how responsibility is allocated within the organisation.

HR compliance moves beyond conventional administration

Traditional HR compliance has generally concentrated on the employment relationship and the records required to administer it. The privacy dimension adds another question: how is personal data treated throughout those processes?

That question changes the compliance conversation. It directs attention towards the handling of employment information as a continuing governance responsibility, rather than a one-time documentation exercise. Policies, operational practices and technology controls must work together if an organisation is to demonstrate a coherent approach to employee-data privacy.

For professionals advising GCCs, the issue is therefore broader than the wording of employee notices or internal policies. The underlying business processes must support the organisation’s stated privacy approach. A gap between written policy and actual data handling can undermine the effectiveness of the compliance framework.

A cross-functional responsibility

Employment-data governance sits at the intersection of several corporate functions. HR teams understand why workforce information is collected and used. Technology and information-security teams oversee the systems through which it is handled. Legal and compliance professionals interpret regulatory obligations, while management determines accountability and resources.

Finance professionals and internal auditors may also have an important governance role where employee information forms part of payroll, reporting, control testing or assurance processes. The practical task is to ensure that privacy considerations are embedded wherever employment data enters an organisational workflow.

This cross-functional character makes senior oversight important. A fragmented approach, in which each team addresses only its own part of the process, may leave gaps between policy, systems and operations. Nasscom’s intervention places the need for an integrated response squarely before GCC leadership.

What businesses should take from the privacy reset

The immediate lesson is that GCCs should treat employment data as a specific compliance workstream under their broader privacy programme. HR processes should not be assumed to be adequately covered merely because the organisation already has general data-protection or cybersecurity policies.

Businesses should examine whether accountability for employment-data privacy is clearly assigned and whether the relevant corporate functions are working from a common framework. They should also consider whether internal policies accurately reflect operational practice and whether oversight mechanisms cover the actual handling of employee information.

The exercise should be approached as business-process governance. HR, legal, compliance, technology and assurance teams need a shared understanding of where privacy responsibilities arise and who is expected to address them. For GCCs, this alignment is especially important because workforce administration operates within a broader enterprise environment.

Implications for advisers and assurance teams

For chartered accountants, finance leaders and other professional advisers, the development adds employment-data privacy to the range of governance issues requiring management attention. It may affect the way organisations assess internal controls, allocate compliance ownership and review the interaction between HR records and enterprise systems.

Advisers should avoid treating the subject as an isolated HR matter. The more useful approach is to consider how employment-data governance connects with existing risk-management, technology, internal-control and assurance arrangements. This can help management identify where responsibility is unclear or where operational practice has moved ahead of written policy.

The Nasscom publication is consequently best understood as a governance signal for GCCs. India’s DPDP Rules require organisations to reconsider how established employment-data practices fit within a privacy-focused compliance environment. The required reset is organisational as much as legal: employee-data protection must be reflected in day-to-day processes, systems and accountability.

Key takeaway

Nasscom’s focus on GCC employment data makes clear that HR privacy is an enterprise compliance responsibility. GCCs should align HR processes, technology controls and management oversight so that their handling of workforce information is consistent with India’s DPDP framework.