Technology & Outsourcing 2024

Last Updated October 10, 2024

India

Law and Practice

Author



ANA Law Group is a full-service law firm based in Mumbai, featuring a team of dedicated professionals with extensive industry knowledge and expertise in a diverse range of legal areas. With prominent cross-border exposure and a solution-oriented approach, the firm provides significant value to clients internationally, as each client receives the attention required to achieve practical legal solutions. Some of the firm's key practice areas include commercial contracts, IT and outsourcing transactions, employment law, data privacy, IP, and digital media.

India's IT outsourcing industry is still considered one of the largest exporters of IT and business process outsourcing (BPO) services ‒ something that has been on an increasing growth curve throughout the past several decades. Information technology and BPO services reportedly constitute approximately 60% of India's service exports and are estimated to be the largest component of India's service exports.

While the early days may have been focused on catering to businesses that reached out to India for cost reduction or to address manpower concerns, the current scenario is significantly different from how it started. IT outsourcing to India currently encompasses anything that one can relate to any kind of advanced technology development. The world reaches out to India for its outsourcing industry’s advanced skills and capabilities for support across the globe. Today, Indian captive subsidiaries and third-party vendors support most of the emerging and advanced technology for multinational corporations in the areas of AI, cloud computing, and blockchain.

The BPO market is steadily expanding with technological advancements, especially in developing countries like India. Although the COVID-19 situation created confusion among businesses globally, it surprisingly worked to the advantage of the Indian IT industry. India's domestic consumption for IT services over the past few years has experienced unprecedented growth, from remote working platforms and spreading to e-commerce, followed by the increased demand for outsourced support of various kinds to global businesses.

One of the key factors behind this development is the high-quality technical skills that today's Indian IT industry offers in the fields of AI, medical devices and pharmaceuticals, gaming, movies, robotics, etc. Another positive trend is that many large global corporations now consider India the preferred location to set up their global capabilities centres (GCCs) to support cloud management, data analytics and other high-tech services (as well as traditional services such as software development testing and support). Over the past few years, more than 150 MNCs have set up their GCCs in India.

Further, remote work that began during the pandemic ‒ followed by the hybrid working model ‒ became very common globally and is expected to continue as a preferred working model for employees as well as employers; hence, the demand for technological solutions to support these work models will further increase. Post-pandemic, two of COVID-19's major footprints (the work-from-home/hybrid work models) have kept the Indian IT outsourcing companies busy developing solutions and support for a variety of businesses across the globe.

Additionally, with the adoption of new technologies such as AI and IoT (Internet of Things), the BPO market in India is steadily evolving. Businesses in India are adapting to more technological advancements to stay relevant in the market and considering models that involve customers, employees, and other stakeholders. The technology also makes it possible for businesses to connect and outsource worldwide.

New technologies have had a very positive impact on the outsourcing industry. While some of these technologies are intended to reduce human interface and operate as an internal solution for various business functions, the development in the new technology sector has been exponential and continues as an ever-expanding ecosystem. It has opened up new opportunities for research, development, support and maintenance of the new technologies.

The large and highly qualified talent pool available in India can handle all kinds of requirements in the field of new technology and has positioned India as the most preferred jurisdiction for global clients. The language skills, time zone advantage, well-established common-law-based legal system, and geopolitical acceptance also help India attract global companies. The Indian IT outsourcing industry also supports large Indian corporations, some of which are globally appreciated innovators and leading businesses in their respective sectors.

However, the ability to deploy insourced AI and automation for various technology solutions results in companies assessing whether certain kinds of IT services should be outsourced to a third-party service provider. Notwithstanding, the scale and coverage of new technologies are likely to keep the Indian service providers engaged.

Further, there has been a lot of interest in the field of cloud-based outsourcing services as businesses have been looking for cost-effective options, along with a need-based increase in capacity. AI-based technologies have had an impact all across the IT and outsourcing industry. The industry is focused on developing AI technologies for both Indian and international corporations. Sectors like data analytics greatly benefit from AI. Outsourced service providers are actively involved in licensing these technologies from established companies and creating solutions to enhance their overall efficiency.

Virtual reality and metaverse technologies have created new service demands, presenting an opportunity for first-mover advantage and "Make in India" initiatives, particularly in healthcare, education, and gaming. With the growing network in outsourcing, several gaming platforms are generating revenues by offering courses or seminars on their platforms and by outsourcing their services to educational institutions that are transitioning their campuses to the metaverse.

IT outsourcing to India has progressed greatly from its origins as a cost-saving alternative. Currently, all kinds of industries (including IT and manufacturing) and professional service providers such as accounting and law firms utilise the services of the Indian outsourcing industry. The nature of outsourced services varies from support services to high-end search and product development. The services outsourced to India include traditional software development and testing, cloud services, blockchain, analytics, digital transformation, call centre/customer services, human resources, legal and accounting process outsourcing, back-office support, digital marketing, and many more.

There are no general regulatory restrictions on technology transactions or outsourcing in India. However, when it comes to outsourcing in Indian banking or the financial sector, India's central bank (the Reserve Bank of India)'s regulations mandate certain compliances concerning the functions that can be outsourced (eg, outsourcing of core functions) and security measures will apply for the appropriate use of contracts and technology. India's insurance and capital markets regulators have similar regulations applicable to outsourcing in their respective sectors.

A major industry-specific regulation in the financial sector is the Reserve Bank of India's Master Direction on Outsourcing of Information Technology Services 2023 (the "RBI Outsourcing Directions"). These guidelines apply to the outsourcing of IT services by banks and financial institutions, subject to certain exceptions. These guidelines have been introduced to ensure the protection of customer interests as well as regulatory compliance. The major compliance requirements are:

  • to carry out due diligence on the outsourced service providers;
  • adequate governance in the performance of the outsourced activity (for which the institution’s key management must be responsible);
  • a risk management framework in line with the roles and responsibilities of the Board of Directors, Senior Management and IT Function subject to internal and external quality assurance on a periodic basis;
  • to put in place a management structure to monitor and control Outsourced IT activities;
  • a proper grievance redressal mechanism in case of deficiencies in the outsourced service;
  • a comprehensive outsourcing agreement with the service provider or the financial institution to exercise control over the outsourced activities, if required; and
  • a comprehensive compliance requirement while availing cloud computing services.

The banks also have certain reporting obligations with regard to the outsourcing of some functions. There are similar compliance requirements for cross-border outsourcing as well.

Similarly, the Securities and Exchange Board of India (SEBI) and the Insurance Regulatory and Development Authority of India (IRDAI) have also issued sector-specific guidelines for IT outsourcing to ensure confidentiality, data safety, and security. These regulations also restrict the outsourcing of core functions.

India also recently enacted its data privacy legislation, the Digital Personal Data Protection Act 2023 (DPDPA). Various provisions of the DPDPA are expected to be enforced in a phased manner, and the legislation will seek compliance from large technology companies in the initial stages. Although no specific timelines have been prescribed, the smaller companies will likely receive more time for total compliance. This law will apply to almost all kinds of data processing in India.

The statute mandates a data subject's specific and express compliance (except in the case of excluded legitimate-use categories). Further, a data controller will be responsible for ensuring reasonable technical and security measures to prevent data breaches. Additionally, the data controllers must report all types of data breaches or cyber-incidents to a government authority ‒ namely, the Indian Computer Emergency Response Team (CERT-In or ICERT). The timelines prescribed for reporting cyber-incidents are also sector-specific (ie, a shorter timeline is prescribed for the banking and financial sectors). Other businesses also find the reporting timelines very short, and it is difficult to determine what kind of incidents should be mandatorily reported. Given that almost all businesses in India can be exposed to cybersecurity or other kinds of cyber incidents on a daily basis, businesses are adopting a case-to-case-based approach to deciding about such reporting.

Although the transfer of personal data out of India is permitted subject to the prescribed compliances, the government can restrict such data transfers to specific (blacklisted) countries under the DPDPA. However, the government has not as yet prepared such a list of countries.

Regarding children's data, parental consent is mandatory, irrespective of whether the data controller is engaged in a business or activity specifically targeting children.

The foregoing provisions of the DPDPA will apply to international businesses operating in India or through their outsourced providers when processing Indian personal data. In terms of compliance, given that all the major corporations (as well as the large Indian outsourced service providers) already implemented GDPR compliance measures several years ago, a comparative analysis of compliance requirements may be appropriate from the DPDPA perspective.

The standard contract models follow either a third-party service provider outsourcing, a captive unit, or a Build-Operate-Transfer (BOT) model. Many international businesses initially began outsourcing to India through third-party service providers.

A captive unit is normally established by setting up a wholly owned subsidiary in India. Although setting up a captive unit and the associated compliances involve more effort for a customer, they can ultimately be in charge of the complete operations of its India captive outsourcing centre. This model provides more transparency, protects confidential information and IP, and allows the implementation of a customer's own protocols within its captive Indian outsourcing centre.

Another preferred outsourcing model in India is the BOT model, which is chosen more for the outsourcing of a company's core functions. A BOT model is suitable for companies unsure of their long-term outsourcing plans, enabling them to use a facility developed in India according to their specifications. It also offers the flexibility to either acquire the facility at a specified date or opt-out. However, this model comes with its own set of challenges. For instance, operational costs can be higher than those associated with third-party outsourcing and may be comparable to those of a captive centre. Once the BOT centre is transferred to the customer, they must comply with various Indian regulations concerning real estate, taxation, employment, and other relevant legislation.

A BOT model may also be perceived as a collaborative advantage to clients as well as suppliers. For example, the client seeking to work with experts while suppliers seeking to participate on account of higher margins is a cooperative outcome for both. However, in the years to come, the companies might adopt a hybrid approach wherein the client outsources to a third party and also operates as a captive for others.

Additionally, as opposed to the initial perception that the IT outsourcing industry involves projects outsourced from overseas jurisdictions, domestic outsourcing is also a significant part of today's industry. Domestic companies across all industry sectors contribute to a large number of onshore outsourcing projects in India.

Similarly, many international companies (as well as Indian companies) frequently adopt the staff augmentation model whenever there is a need for additional resources. Companies consider this a more cost-effective and easy-to-manage model than dedicated team-based outsourcing unless their products are of a long-term nature.

Project-based outsourcing models are also very popular in India. A clear, well-drafted contract that clearly identifies the terms and conditions, remedies in case of default or delays, audit rights, and a reputable outsourcing partner can make the project-based models easy and effective.

A joint venture between a customer and the service provider establishes an outsourcing service centre while allowing for equal participation and control to a customer. However, this is not a very commonly used model for outsourcing to India, as most India-bound outsourcing transactions aim to procure services for a customer's own consumption. This model may be more appropriate if the customer and service provider want to operate jointly and sell their services to outside entities in addition to their own consumption.

A fixed-price outsourcing contract is normally established where the client transfers its in-house activities to the vendor by receiving the expected output in return for a fixed amount. This model guarantees that the vendor receives a fixed amount from the client, ensuring financial stability. It allows both parties to budget effectively without concerns about fluctuating expenses and is suited for well-defined projects with clear deliverables.

Multi-sourcing models can be suitable, ie, when outsourced services can be obtained from different vendors without the need for synchronised outputs among them. While this approach allows for procuring services from multiple vendors, it can lead to challenges in coordinating their efforts and managing project timelines effectively. Given that the other existing outsourcing models have been tested and well-established over several years, multi-sourcing is not commonly used.

Digital transformation, including the adoption of cloud computing, software as a service (SaaS), and infrastructure as a service (IaaS), had a significant impact on outsourcing contract models in India.

Introducing these platforms has persuaded businesses to adopt service-based models instead of traditional labour-based ones. Companies appear to be more comfortable with pay-per-use arrangements as opposed to outsourcing based on full-time resources. Similarly, businesses are adopting pay-per-use pricing models in outsourcing contracts, where clients pay only for the resources they use, thereby creating cost-effective outsourcing models in India.

Digital transformation has necessitated more flexible and industry-responsive outsourcing contract models in India. These new and evolving models focus more on services, data security, and adaptability to meet the changing needs of the business landscape. The international customers outsourcing to India, as well as the Indian companies adopting the digital transformation, may have to focus more on their contract negotiations in order to benefit from the digital transformation.

In the past few years, the Indian outsourcing industry has witnessed significant growth in the development and support of digital solutions, mainly because of the businesses' demand for digital transformation in order to reach out to consumers in a more attractive, cost-effective and interactive manner. Social media content creation and management, app development, data analytics, etc, contribute as a sizeable complement to digital transformation initiatives.

Businesses prefer outsourcing models for digital transformation because the key resources within an organisation need not be fully involved in the management of such projects. Therefore, while an organisation's human resources focus on core competencies, an expert outsourced service provider can add a lot more value to a business's requirements in the field of digital transformation – often at a much lower cost and with a faster turnaround.

Technology transactions and outsourcing are largely governed by the contract law in India. At the outset, customer protection can be ensured through a well-drafted contract of international standards; thus, the remedies can be availed through contractual, statutory, and common law provisions.

The key contractual provisions are representations and warranties from the vendor, confirming its:

  • authority to contract and perform the obligations under the contract;
  • principal-to-principal contract arrangement;
  • knowledge and skill to render the services;
  • obligation not to breach various provisions of the contract;
  • responsibility to manage its own business and employees;
  • protection of the customer’s IP rights and confidential information; and
  • provision of services with the agreed quality and timelines.

Further, the following provisions form part of an outsourcing contract to ensure the protection of a customer’s rights:

  • maintenance of quality;
  • audit rights;
  • remedies in case of breach;
  • indemnity and liability;
  • damages as well as liquidated damages;
  • assurance of service levels and performance;
  • service-level credits;
  • business continuity;
  • provisions for adequate insurance to be obtained by the service provider;
  • provisions for termination and consequences of termination;
  • non-compete and non-solicitation provisions;
  • dispute resolution provisions;
  • choice of forum and choice of the governing law;
  • confidentiality and data protection; and
  • a well-drafted force majeure clause that excludes events arising from the service provider’s defaults or non-compliance.

Customers should be vigilant in maintaining an arm's length relationship with the service provider by structuring the outsourcing contract on a principal-to-principal basis. It is also essential to include adequate provisions to ensure that the service provider's employees are treated in a way that prevents them from being able to claim an employment relationship with the customer.

It may also be prudent for a customer to insist that the service provider should not further subcontract the services or should not do so without the customer's prior written approval. While India has a large talent pool of resources working in the IT outsourcing industry, there is also significant attrition. This results in vendors trying to subcontract their projects to other service providers, which may not always work in the best interests of a customer.

Customer’s Rights/Protections in IP developed

As India has been a favourite destination for global companies for IT activities, research and development, resulting in a variety of IP developments, the companies must understand the legal and practical aspects to ensure effective ownership of IP developed in India. 

In a typical project, the overseas customers ("customers") execute agreements ("development agreements") with their Indian service providers ("service providers") before the commencement of the projects. In most of these agreements, the service providers confirm that they have assigned and/or agree to assign all service provider-developed IP rights.

However, based on the applicable Indian law and also the practices followed in India, development agreements alone may not ensure the customer's ownership of India-developed IP rights. Therefore, an outsourcing contract must address some practical concerns, such as:

  • who owns the India-developed works’ IP rights;
  • how to ensure that the customer owns the IP developed by the service provider;
  • the stages of IP development and related ownership;
  • terms of license/assignment (as the case may be), in case of IP being transferred; and
  • the documents required and the explanation of such documents’ necessity.

The IP ownership in India varies under different IP laws ‒ for instance, in the case of an employee-developed copyright, the employer will be the first owner of the copyright. Therefore, the service provider will own its employee-developed copyright. However, this will not apply to independent contractor-developed copyrights. Regarding patents, the inventor will be the first owner, regardless of whether they are employees or contractors.

In most cases, the standard templates of development agreements normally provide that:

  • all the IP developed by the service provider’s employees and contractors under the agreement will be assigned to and owned by the customer; or
  • the service provider “hereby assigns” (and, in some cases, “agrees to assign”) the IP developed under the development agreement to the customer.
  • Nonetheless, the development agreement may not provide for any specific deeds of assignment or other documentation to affect the transfer of IP from the service provider to the customer – although the development agreement may contain an undertaking in that regard.

However, the important legal and practical concern in cases where the service provider promises that its employees and contractors will assign the IP rights to the customer is whether it is advisable to make such assignments directly with the customer and create such contractual relationships between the customer and the service provider's employees and contractors. Further, when the service provider promises to assign the IP rights to the customer, the concern is whether the service provider owns all the IP rights in the work product developed by its employees and contractors.

Unless extremely necessary and supported by detailed agreements and documentation, a customer should avoid direct IP assignment and the creation of contract relationships with the service provider's employees and contractors. Therefore, a better option is for the service provider to assign the IP rights to the customer under a two-level IP assignment process. The first level will be between the service provider and its employees and contractors to ensure that the service provider owns the IP in the work product developed. The second level will be between the service provider and the customer, under which the service provider will assign the IP rights obtained from its employees and contractors.

Further, the customer and the service provider must agree in the development agreement to execute specific deeds of assignment to assign all the IP rights. A format of the deed of assignment must be agreed upon, and preferably, a draft should be annexed to the development agreement, broadly identifying the development work to be carried out by the service provider. This will act as prima facie proof of the kind of IP rights that may be developed, and the parties have validly agreed that the customer will own such service provider's developed IP.   

After ensuring that the service provider owns the IP rights developed by its employees and contractors, the customer must ensure that the service provider executes the deeds of assignment in the customer's favour to assign any copyright, invention, patent, design rights and all other IP developed. In order to achieve this, the development agreement between the customer and the service provider should clearly make the service provider liable to ensure that the service provider's contracts with its employees have the above-mentioned provisions for IP protection.

Under the development agreement, the Indian vendor is required to provide a power of attorney to the customer (ie, in case the vendor is not available to complete the assignment). This document will authorise the customer to take the necessary steps to acquire the intellectual property rights that the Indian vendor has developed and agreed to assign. Similarly, the vendor should also obtain a similar power of attorney from its employees.

The absence of a deed of assignment from the employees and independent contractors to the vendor can cause greater challenges if the vendor’s personnel leave the employment in the middle of a partly developed project. This is why there must be a deed of assignment at the beginning of the project, which will broadly identify the nature of work handled by the employees and their agreement to assign this. Thereafter, when the work product/project is complete, the key employees involved in the project must execute another deed of assignment assigning all the IP rights in such work product to the vendor.

Further, in the case of a breach of IP or confidentiality obligations by the service provider personnel, the general dispute resolution provisions of the outsourcing contract may not suffice. The customer should obtain specific assurances from the service provider with regard to initiating legal actions against the service provider personnel and providing adequate information and support in case the customer decides to take charge of such proceedings.

Performance and service level provisions must be approached seriously. The service provider must agree that the performance of the services will meet or exceed each of the service levels, as may be applicable. Further, service-level credits must be defined as separate from liquidated damages or penalties ‒ although they can finally be offset against any damages if the customer initiates any proceedings and damages awarded.

Business Continuity and Disaster Recovery

As part of the outsourcing agreement, the service provider must prepare and provide a detailed disaster recovery plan for crisis management and business continuity. The disaster recovery plan must be based on industry practices and include remote performance capabilities for the provision of services in case of a disaster. The parties may also agree to mock disaster recovery exercises once every year.

Data breaches can cause irreparable harm to a customer and it may be difficult to estimate the damages in monetary terms - hence, the customer should have the right to seek injunctive relief, irrespective of whether arbitration or another dispute resolution mechanism is in the agreement. If any personnel from the service provider breach or threaten to breach any terms or conditions of the outsourcing agreement, the customer has the right to seek injunctions against those personnel and take legal action for the breach. This right is in addition to the service provider's right to prosecute their own personnel. The service provider must agree to provide all the required assistance to the customer in this regard.

The service provider must agree that any deliverable materials or other software/hardware provided as part of the services will not infringe the IP rights of any third party.

The service provider must agree that it will not directly or indirectly participate in any act that constitutes a violation of the United States Foreign Corrupt Practices Act (FCPA), Mexican local laws regarding anti-corruption (eg, the Ley Federal Anticorrupcion en Contractataciones Publicas), the UK Bribery Act, and all other applicable national and local laws and regulations relating to the subject matter hereof, including both the anti-bribery and accounting provisions of the FCPA.

It is critical to get an agreement from the service provider regarding its key personnel. The parties typically designate a group of service provider employees as critical to the services under an agreement and also ensure such key personnel's consistent quality and availability in providing the services as a material provision.

To the extent permitted by applicable law, the customer should conduct detailed background investigations of service provider personnel engaged in providing the services. This can be done practically through the service provider, based on a detailed policy and a reputed vendor. The agreement should have detailed provisions confirming that the service provider's employees will not be considered the customer's employees under any circumstances.

Further, the agreement should also specify that the service provider will be responsible for the payment of compensation (including employment-related taxes, federal, state, and local income taxes, and workers' compensation) associated with their employees' employment.

One of the major grounds for termination is the material breach of contract. There are practical limitations to comprehensively defining what constitutes material breaches, and, as a result, termination on the grounds of certain material breaches ends up in long discussions. Depending on the nature and scale of the contract, some provide for termination for convenience with reasonable notice or by payment of termination payout in a pre-determined amount.

Other standard grounds for termination include bankruptcy, a force majeure event, a change of control, a change of any applicable laws that may impact the rendition of services under the agreement, any adverse regulatory actions against the service provider, and service-level defaults.

The outsourcing agreements normally provide exhaustive post-termination provisions, such as transitioning the services to a new service provider. In case the services have to be transitioned because of the service provider's default, many customers do succeed in obtaining an agreement from the service provider to bear the costs for such transitioning. Other provisions include the return of customer materials and information.

In case a service provider breaches the contract, the customer can seek and obtain damages for any direct losses caused as a result of such breach. However, the customer will not be able to succeed in a claim for indirect or consequential damages or loss of profits. Notwithstanding, the parties are free to agree on a quantum of liquidated damages with respect to various breaches or consequences anticipated under the contract. Liquidated damages are a more practical and preferred option and can be obtained, irrespective of whether the party proves that it has suffered actual damage or loss. In many cases, the liquidated damages are quantified based on the fees paid to the service provider or the value of a certain kind of project.

In India, no implied terms are relevant to technology transactions or outsourcing.

Please refer to 2.3 Restrictions on Data Processing or Data Security. Additionally, depending on the nature and size of the outsourced operations, customers demand a variety of cybersecurity and data protection safeguards from the service providers. The service agreements normally include extensive provisions mandating the service provider's obligations to ensure that the customer's confidential information, trade secrets, business plans, and information regarding IP are handled with utmost care and only in the manner and as required for the provision of services as specified in the services agreement. Customers also require that the service provider's personnel execute non-disclosure agreements to confirm their compliance with the service provider's confidentiality and security obligations under the services agreement.

Regarding business continuity in cyber-incidents, any service providers with alternate arrangements and locations maintain unrestricted provision of services. This has almost become a standard requirement in large-scale outsourcing contracts.

Further, the majority of the Indian outsourcing service providers' customers include any subsidiaries of multinational companies as well as large Indian corporations. These businesses include e-commerce, healthcare companies, financial institutions, technology solution providers, and social media platforms. All these businesses will be involved in processing the personal data of Indian customers, and therefore, the outsourcing companies will also have to comply with the various requirements of the DPDPA/SPDI Rules.

Regarding data localisation requirements, even though the new legislation reverses the requirement of data localisation, the government has the power to restrict the transfers to certain countries. Additionally, the new legislation does not want to interfere with sector-specific localisation requirements, such as the ones introduced by India's central bank.

India is adapting to securing data through encryption processes, which helps mitigate data breaches on a large scale. Several data protection methods are applicable in cloud computing, such as access control, data masking, integrity checking, etc. Cloud service providers work to ensure that users have access to only authorised and required data. Suppliers conducting personal and periodic security training for all stakeholders may ensure customers' business continuity.

Benchmarking, a comprehensive SLA, periodic audits, remedies for deficiency in the quality of services or performance timelines, and disaster recovery and business continuity options are the most common contractual clauses that help the customer manage and measure the supplier’s performance in technology transactions and outsourcing.

Although a customer can draft a comprehensive outsourcing contract and have it executed by the service provider, the customer's ultimate remedy in the case of the service provider's poor performance or breach of agreement will be to initiate legal actions, which is a challenging solution. Therefore, apart from a good contract, the customer should also approach the outsourcing relationship in a practical manner.

Performance management and measurement is a process that must commence from the initial stages of an outsourcing engagement. The customer must conduct a thorough due diligence and capability assessment of the service provider. Thereafter, the customer must carry out periodic audits of the services, structured in such a manner that it does not create a permanent establishment or employment claims from the service provider personnel against the customer. The outsourcing agreement should include provisions enabling the customer to seek removal of certain service provider personnel in case of non-performance and underperformance, contrary to the agreement.

There are no major differences if the outsourcing is cloud-based. However, customers generally tend to exercise more caution in including provisions to address breaches of confidentiality and data privacy, as well as remedies, including liquidated damages for such breaches. In many cases, customers insist that – unless the customer expressly consents – the service provider will not provide the services from, within or through the use of a public, community or hybrid "cloud" or on virtual servers not directly owned or leased and controlled by the service provider.

Indian labour laws do not permit the automatic transfer of employees from one entity to another unless such transfer arises from a transfer of ownership to another entity. Thus, outsourcing does not change the entity's structure in terms of its employees unless the transaction involves the acquisition or is operated as a BOT model. Further, from a practical perspective, most companies obtain employee consent for the transfer to a new entity to avoid future conflicts.

In case of lack of transparency concerning how the service provider has managed the employee-related compliances, it is advisable for a customer to hire such employees after they formally terminate their relationship with the service provider and the service provider gives appropriate warranties and indemnities to protect the customer from any past claims initiated by the employees. Additionally, in terms of social security benefits such as gratuity and provident funds managed through government organisations, the transferee may have to continue maintaining those benefits by making contributions from the date of onboarding such transferred employees.

Historically, trade union activities in India have been limited to the traditional sectors. The unions primarily focused on wage and benefits issues. However, as part of the development of the economy and diversity in employment roles, the trade unions have also been focusing on more areas to ensure the workforce’s overall welfare.

Further, the trade unions have also become active in the IT/BPO sectors during the past few years. Although there have not been any major negative impacts, trade unions in key cities such as Bangalore, Pune and Kolkata have been very active participants in the IT industry.

As regards other sectors, workers' council consultation can be based on the nature of changes introduced by outsourcing, ie, if outsourcing alters the job conditions or causes loss of employment, the employers will have to consult the workers' council.

There have not been any organised approaches in this respect. The customer preference in respect of onshore, offshore, or nearshore outsourcing can be regarded as more of a needs-based choice. However, the goal of offshore outsourcing in India has evolved from simply cutting costs to boosting efficiencies.

Further, outsourcing activities in India are currently wider than just data processing or call centre activities. Therefore, the structuring of transactions in this respect is normally based on the assessment of the most beneficial location or model.

India does not have any specific laws governing remote working. However, certain legislations related to workers' compensation and payment of wages may be interpreted to apply to remote-working employees, requiring the company to compensate for any injury caused during such remote work and to ensure payment of wages to remote employees on or before the due date. In some Indian states, the place of remote work can be considered as a commercial establishment even if it is not one. Legal provisions, such as minimum wage requirements, may also be applicable to remote workers to ensure they receive the applicable minimum wages.

Ana Law Group

7th Floor
Keshava
Bandra Kurla Complex
Bandra East
Mumbai 400 051
India

+91 22 6112 8484

mailbox@anaassociates.com www.anaassociates.com
Author Business Card

Trends and Developments


Author



ANA Law Group is a full-service law firm based in Mumbai, featuring a team of dedicated professionals with extensive industry knowledge and expertise in a diverse range of legal areas. With prominent cross-border exposure and a solution-oriented approach, the firm provides significant value to clients internationally, as each client receives the attention required to achieve practical legal solutions. Some of the firm's key practice areas include commercial contracts, IT and outsourcing transactions, employment law, data privacy, IP, and digital media.

Introduction

The Indian IT outsourcing industry has experienced significant growth over the past several years. However, the Covid-19 pandemic posed challenges that hindered further development in the sector. While demand for IT services continues to rise, the industry faces its own set of obstacles. Overall, India's IT and software sector has played a crucial role in establishing the country as a preferred investment destination for global investors and an offshoring destination for IT companies worldwide.

One of the recent challenges faced by the industry has been employee attrition, as many workers are leaving their jobs for significantly higher compensation, exceeding the existing industry average. Indian vendors have faced difficulties retaining experienced talent, and finding adequate replacements with similar compensation has been challenging. However, these vendors have quickly adapted to the situation by leveraging India's diverse demographic landscape and expanding beyond the well-established IT outsourcing capitals. As a result, companies are increasingly reaching out to smaller towns to establish centres in tier-2 and tier-3 cities. This strategy enables them to attract a larger talent pool cost-effectively.

The IT outsourcing industry has undergone rapid diversification, expanding beyond traditional services such as software development, support, and call centres. It now includes services like digitisation and the remote management of clients' core functions, whether on a project basis or otherwise. Additionally, a wide range of support functions is offered in the banking, finance, and accounting sectors. As the needs of the industry evolve, the outsourcing sector is increasingly utilising artificial intelligence to provide a range of tools, machine learning programs, and other virtual support systems to alleviate pressure caused by an insufficient workforce.

A survey conducted by India’s central bank, the Reserve Bank of India, found that computer services accounted for two-thirds of India’s total software services over the course of 2023-24, wherein BPO services remained the dominant component of Indian Information Technology Enabled Services (ITES) exports.

An important development is that cloud-based outsourcing has become essential in all kinds of outsourcing. Until a few years ago, the customers in large outsourcing transactions negotiated a specific clause in the outsourcing agreement restricting the service providers from using third-party cloud solutions in rendering the services.

However, with technological advancements, the reliability of cloud models has increased. Moreover, the cost advantage, high-quality delivery, data security, and the ability to scale as required are only some of the additional advantages many users have when choosing cloud-based models for appropriate projects.

Cybersecurity

In recent years, the world has seen a significant increase in ransomware attacks, with many cases going unreported and receiving little publicity. Despite advancements in technology, cybersecurity and data breaches remain a major concern in the context of information technology outsourcing. Countries worldwide have initiated legislative measures to enhance cybersecurity, and outsourcing agreements often include stringent provisions related to data security.

Data Protection Act 2023

The Indian government has recently introduced the Digital Personal Data Protection Act, 2023, which outlines detailed requirements for data protection and reporting cyber incidents. Many provisions of the new legislation are still under review, leaving the IT and outsourcing industries, as well as other businesses, uncertain about which incidents should be prioritised for reporting and the subsequent actions that need to be taken.

While cyber security is a growing concern in the IT services industry, an interesting aspect is that the issues related to cyber security are also a fast-growing business for the IT industry. Even large corporations are finding it challenging to keep their cyber security and data safety measures up to date with the help of only their internal resources. Many businesses without extensive infrastructure or resources struggle to meet all cyber security and safety requirements. This challenge has led to a significant demand for outsourcing data security compliance processes and audits, creating a new revenue stream for outsourcing service providers.

Implementing Artificial Intelligence

Another important trend is the environment of artificial intelligence and machine learning in the outsourcing sector. In addition to providing artificial intelligence and machine learning solutions to the customer, the service providers themselves function based on these technologies, which help the service provider render more efficient and cost-effective services. Many businesses depend on reports from their outsourced service providers, which utilise data analytics and artificial intelligence to analyse future market trends and shifts in customer behaviour.

Outsourcing specific services is no longer seen merely as a strategy for managing costs or human resources. Instead, with the advancements in artificial intelligence, blockchain, and robotic automation, leveraging outsourced services from experienced providers offers significant added value to customers.

India’s Place on the Global Outsourcing Market

The Indian outsourcing industry is not immune to competition and challenges from other jurisdictions, but several positive factors may still give Indian companies an edge over their global counterparts. At the outset, India benefits from having an early-mover advantage in outsourcing. The country boasts a highly educated and qualified talent pool with decades of experience in various technologies that global clients require. Additionally, India's strong English language skills, geopolitically stable position and robust legal system all contribute to its competitive advantage. Furthermore, India has established legislation protecting data and intellectual property, setting it apart from countries like China and/or those in Eastern Europe.

Further, challenges faced by IT outsourcing companies are also evolving along with the industry's growth and introduction of new technologies and services. In addition to potential data security breach concerns, this includes increased costs of infrastructure and human resources, as well as handling projects with the support of remote working teams

.

Fintech businesses have grown significantly since the demonetisation, which Covid later followed. Digital payments and blockchain technology have become part of the mainstream business operations. As the customers of semi-urban and rural markets prefer digital payment systems, mobile banking, etc, the IT Industry's role in supporting these market-induced requirements is also increasing proportionately. The healthcare industry is experiencing similar growth, with telemedicine, mobile clinics, and associated services becoming increasingly popular. Another significant trend is the use of technology and digital solutions in the education sector. This shift generates substantial work for IT outsourcing companies while presenting challenges related to scaling up and developing the necessary infrastructure and safeguards.

Intellectual Property

A significant concern when outsourcing to India is the protection of intellectual property. Contrary to popular belief, India has a robust intellectual property protection framework that aligns with international IP laws. The Indian Intellectual Property Office and judicial proceedings have been completely digitised, and since the pandemic, many Indian courts have adopted a hybrid model for hearings, allowing both physical appearances and online representation.

Most Indian High Courts now assign judges with expertise in intellectual property (IP) matters to oversee related cases. Prominent High Courts, such as those in Delhi, Madras, and Calcutta, have established specialised divisions with dedicated judges for IP cases. It is expected that other High Courts will also follow suit in the near future. Many Indian High Courts have been designating judges who possess knowledge and experience in intellectual property issues to adjudicate these cases.

The strategy for intellectual property protection should be adopted with a blend of contractual, practical, and legal considerations. The outsourcing contract should be drafted with all necessary provisions for intellectual property protection while addressing the impact of applicable intellectual property laws on the transaction covered by the outsourcing contract. The practical aspects include periodic training programs for the service provider and their personnel, explaining the importance of confidentiality and intellectual property protection and the potential consequences of a breach. Although Indian law does not have indirect or consequential damages, the customer can obtain an agreement for liquidated damages recognised under Indian law.

Conclusion

Indian employment law regime has always been supportive of the information technology and outsourcing industry, and it still continues to do so, helping relatively trouble-free operations for IT companies. Further, various exemptions from the applicable labour laws and periodic amendments to facilitate the better functioning of the IT industry have been helping the industry significantly.

To conclude, the opportunities, consistent growth, and supportive legislative and regulatory environment minimise the impact of the odd challenges on India's outsourcing industry. The trends and forecasts bring much more optimism and indications for larger and more diverse growth of the outsourcing industry in the coming years.

ANA Law Group

7th Floor
Keshava
Bandra Kurla Complex
Bandra East
Mumbai 400 051
India

+91 22 6112 8484

mailbox@anaassociates.com www.anaassociates.com
Author Business Card

Law and Practice

Author



ANA Law Group is a full-service law firm based in Mumbai, featuring a team of dedicated professionals with extensive industry knowledge and expertise in a diverse range of legal areas. With prominent cross-border exposure and a solution-oriented approach, the firm provides significant value to clients internationally, as each client receives the attention required to achieve practical legal solutions. Some of the firm's key practice areas include commercial contracts, IT and outsourcing transactions, employment law, data privacy, IP, and digital media.

Trends and Developments

Author



ANA Law Group is a full-service law firm based in Mumbai, featuring a team of dedicated professionals with extensive industry knowledge and expertise in a diverse range of legal areas. With prominent cross-border exposure and a solution-oriented approach, the firm provides significant value to clients internationally, as each client receives the attention required to achieve practical legal solutions. Some of the firm's key practice areas include commercial contracts, IT and outsourcing transactions, employment law, data privacy, IP, and digital media.

Compare law and practice by selecting locations and topic(s)

{{searchBoxHeader}}

Select Topic(s)

loading ...
{{topic.title}}

Please select at least one chapter and one topic to use the compare functionality.