Resources Categories
INDUSTRY FACT FILE · ITES, BPO, KPO & GCCS
Market Landscape and the Drivers of Cybersecurity Demand in ITeS, BPO and GCCs
The business, technology, regulatory, legal and statutory forces that create cybersecurity, audit and assurance work for service centres and GCCs.
|
In this document 1. Market landscape 2. Business drivers 3. Technology drivers 4. Regulatory drivers: CERT-In, DPDP and client flow-down 5. Legal and statutory drivers 6. How the drivers differ by centre type 7. What this means for buyers and for Codec Networks |
1. Market landscape
India is a leading global destination for business process services and global capability centres, ranging from large BPO firms to specialist KPOs and captive hubs of multinational companies. GCCs increasingly run critical engineering, operations and security functions for their parents—raising the stakes of any compromise.
|
6 hours Incident reporting to CERT-In |
Mar 2025 PCI DSS v4.0 fully mandatory |
180 days ICT log retention in India |
May 2027 Most DPDP obligations take effect |
|
Market segment |
Landscape and buying behaviour |
Cybersecurity opportunity |
|
Large BPO firms |
Many clients and sites, frequent audits |
Insider programmes, SOC, PCI DSS, multi-client assurance |
|
Mid-sized BPOs and KPOs |
Growing regulated-client portfolios |
Access and DLP assessments, ISO 27001, managed SOC |
|
Shared service centres |
Group finance and HR processes |
Payment-control testing, BEC defence |
|
Global capability centres |
Critical functions for global parents |
Privileged access, red teaming, joint SOC |
2. Business drivers
|
Business driver |
Buying trigger |
Relevant services |
|
Client audits |
Annual and ad hoc floor audits |
Audit readiness, evidence packs |
|
Contract penalties |
Breaches trigger penalties and termination |
Insider and DLP controls |
|
Regulated clients |
RBI, SEBI, IRDAI outsourcing rules |
Flow-down assessments |
|
Parent standards |
GCCs must meet global policies |
Gap assessments against parent frameworks |
|
Reputation |
Insider incidents become public |
Investigations and controls |
3. Technology drivers
|
Technology driver |
Exposure created |
Codec Networks opportunity |
|
Cloud contact centres |
Misconfiguration and integrations |
Configuration and application reviews |
|
VDI and WFH |
Unmanaged devices and local data |
WFH and VDI assessments |
|
Identity and help desks |
Reset-based account takeover |
Help-desk control testing |
|
Privileged access in GCCs |
Movement into parent systems |
PAM and tiered admin reviews |
|
AI agent assist |
Leakage of customer data |
AI governance |
Figure 3: The four groups of drivers behind cybersecurity spending in ITeS, BPO and GCCs.
4. Regulatory drivers: CERT-In, DPDP and client flow-down
|
Instrument |
Key requirements |
|
CERT-In Directions (2022) |
Six-hour incident reporting; 180-day ICT logs in India |
|
CERT-In audit policy guidelines (July 2025) |
Risk-based, independent cyber audits |
|
DPDP Act 2023 and Rules 2025 |
Processor safeguards through client contracts; most obligations from May 2027 |
|
Client regulator outsourcing rules |
RBI, SEBI and IRDAI oversight of service providers |
|
PCI DSS v4.0 |
Card-data security for contact centres; future-dated requirements mandatory from 31 March 2025 |
|
Flow-down, not always direct Many requirements reach service centres through client contracts. Confirm the clauses in your agreements and the official instruments. |
Figure 4: Regulatory timeline shaping ITeS, BPO and GCC security, as of October 2026.
5. Legal and statutory drivers
|
Law or obligation |
Relevance |
Demand created |
|
IT Act, 2000 and CERT-In Directions |
Incident reporting and logging |
SOC, logging and IR readiness |
|
DPDP Act, 2023 and Rules, 2025 |
Processing customer personal data |
Processor privacy programmes |
|
Overseas privacy laws (GDPR, HIPAA) |
Client-country obligations |
Control mapping and audits |
|
Employment and evidence law |
Investigations and disciplinary action |
Forensically sound investigations |
|
Contracts |
Security, audit, penalty and liability clauses |
Assurance evidence |
6. How the drivers differ by centre type
|
Centre type |
Dominant business drivers |
Dominant technology drivers |
Principal regulatory drivers |
|
Contact centres |
Client audits, fraud prevention |
CCaaS, CRM, WFH |
DPDP, PCI DSS, client rules |
|
Back-office BPO |
Processing integrity |
Workflow and ERP |
Client regulator flow-down |
|
Shared service centres |
Financial control |
ERP and payments |
Group policies, DPDP |
|
GCCs |
Parent trust, resilience |
Global directories and cloud |
Parent and home-country rules, CERT-In |
7. What this means for buyers and for Codec Networks
|
Customer buying need |
Recommended offering |
Natural recurring engagement |
|
“What can each agent see and copy?” |
Access and masking review, DLP assessment |
Quarterly recertification |
|
“Our client audit is next month.” |
Audit readiness and evidence pack |
Annual audit support |
|
“We need PCI DSS for card payments.” |
PCI DSS scoping and readiness |
Annual assessment support |
|
“We suspect an insider leak.” |
Forensic insider investigation |
UEBA monitoring |
|
“Our GCC has global admin rights.” |
Privileged access review and red teaming |
Joint SOC monitoring |
Talk to Codec Networks
|
Contact Codec Networks Pvt. Ltd. New Delhi: 507, 5th Floor, New Delhi House, Barakhamba Road, Connaught Place, New Delhi – 110001 Gurugram: 707, 7th Floor, Silverton Tower, Golf Course Extension Road, Sector 50, Gurugram – 122018, Haryana Landline: 011 430 496 96 | 011 437 522 99 Mobile: +91 99716 76124 | +91 88007 88220 | +91 88003 31124 Email: mktg@codecnetworks.com Web: www.codecnetworks.com |
Note: This document is general industry guidance based on public information available as of October 2026. Client, card-industry and overseas requirements apply through contracts. Confirm obligations against the official CERT-In, MeitY, DoT, TRAI and client-regulator instruments and your agreements.