The wave of Indian global capability centre (GCC) carve-outs running through the corporate market is a multi-year IT contract wrapped in an M&A shell.
More than 20,000 professionals transitioned from multinational captives and technology subsidiaries to IT services providers in the 12 months to October 2026, with an estimated transaction pipeline of $1.3bn to $1.5bn. The pricing across pure captive transactions reflects that division of value.
On 1 October 2026, Tata Consultancy Services (TCS) executed an agreement to acquire BBY Services India LLP which is the entity housing Best Buy’s India GCC, with completion subject to customary closing conditions. The target entity turned over nil in FY24, INR 48.12 crore in FY25, and INR 294.53 crore in FY26. TCS agreed to acquire this business that had grown from zero to INR 294 crore of turnover in two years and employs roughly 450 engineers, for an equity consideration of exactly INR 1 lakh (approx. $1,200). In July 2026, HCLTech agreed to acquire Guardian Life’s Indian captive operations, transferring nearly 2,000 employees for $10.5 million (roughly $5,250 a head), anchored by a seven-year services agreement.
No commercial buyer acquires an active operating enterprise for INR 1 lakh or $5,250 per employee. The purchase consideration is nominal because the standalone captive carries no independent market value: its revenue is an intra-group cost recharge, its sole client is its parent, and its business model possesses no third-party customer contracts. The entire economic value sits in the multi-year master services agreement (MSA), with the corporate carve-out functioning merely as the legal rebadging mechanism.
The transaction that commanded a full enterprise multiple was Wipro’s acquisition of Olam Group’s Mindsprint in May 2026. It was reported in the region of $386m and it proves the rule. Mindsprint commanded enterprise value because it transferred proprietary, commercial IP products across supply chain and commodity trading with external market revenue, rather than operating as an internal captive cost centre.
For pure captive carve-outs, executing an outsourcing transaction as a corporate acquisition determines where the unhedged legal exposure sits.
Unprivileged Employment Risk
The commercial terms of these transactions sit predominantly in the master services agreement (MSA). The MSA covers service levels, rate cards, benchmarking, change control, and exit assistance while the share purchase agreement serves to transfer the corporate entity and its staff.
As a result, diligence concentrates on employment liabilities. Under Section 25FF of the Industrial Disputes Act, 1947, transferring an industrial undertaking without triggering statutory retrenchment compensation requires uninterrupted employment on terms no less favourable than existing conditions.
As a consequence diligence on a GCC carve-out is largely employment diligence: continuity of service, benefit and gratuity fund liabilities, worker classification disputes, secondment tax exposures, pending conciliations, and disciplinary histories. The risk here is in opening personal and operational records regarding individuals who are not parties to the transaction.
The legal assessment of that risk is unprivileged from inception.
In In Re: Summoning Advocates who give legal opinion or represent parties during investigation of cases and related issues (2025 INSC 1275), the Supreme Court of India held that communications with in-house counsel are not protected by legal professional privilege under Section 132 of the Bharatiya Sakshya Adhiniyam, 2023 (BSA). Section 134 BSA protects confidential communications made to an external legal adviser, but does not extend to internal communications between corporate management and salaried in-house counsel.
While the absence of privilege is a recognized issue in conventional M&A, a captive transfer splits the workforce from the historical records evaluating them.
The captive’s internal HR and in-house legal teams hold the personnel records, payroll structures, and institutional dispute histories, making them the natural point of origin for assembling the employment risk assessment. The default operational path ensures that this assessment remains in the seller’s archives, while the employees documented in those files transition to the buyer.
When a transferred employee later initiates conciliation proceedings, or when the corporate buyer seeks indemnification for inherited liabilities, an unprivileged written assessment of that precise exposure sits in the seller’s hands, regarding individuals who now work for the counterparty.
Mitigating this exposure requires instructing external practising advocates under Section 132 BSA to conduct the risk evaluation before diligence is committed to writing. This becomes an operational expense rarely budgeted on an optimised transaction.
The Phased DPDP Regime: Sequence vs Statutory Exemptions
This employment data transfer is taking place under a transitional data protection regime whose primary substantive obligations have not yet commenced.
The Digital Personal Data Protection Rules, 2025 (notified under G.S.R. 846(E) on 13 November 2025) operate on a phased implementation timetable:
- 13 November 2025: The framework establishing the Data Protection Board of India took effect, with board appointments underway.
- 13 November 2026: The Consent Manager architecture under Rule 4 comes into force.
- 13 May 2027: The substantive compliance regime (Rules 3, 5 through 16, 22, and 23, governing itemised notice, consent withdrawal, data principal rights, and breach notification) comes into full force.
The corporate restructuring exemption under Section 17(1)(e) of the Digital Personal Data Protection Act, 2023 is strictly conditioned on formal approval. While the provision exempts processing necessary for a scheme of compromise, arrangement, merger, amalgamation, or corporate reconstruction, it applies only where approved by “a court or tribunal or other authority competent to do so by any law for the time being in force”.
However, the legal vulnerability is governed by transaction sequence rather than deal structure.
Diligence occurs months before any regulatory or court approval exists. Because Section 17(1)(e) requires an approval in force to trigger the exemption, it provides no statutory safe harbour for the virtual data room (VDR) during due diligence, whether the deal is structured as an NCLT scheme, a slump sale, or an LLP buyout. Additional to that, Section 17(1) expressly excludes Sections 8(1) and 8(5) from any restructuring exemption: the duties to implement reasonable security safeguards and adhere to data erasure requirements apply universally throughout diligence and post-completion integration.
A carve-out closing in 2026 assembles and transfers the personal, performance, and financial data of thousands of employees under a framework where notice and consent standards are not yet binding. That dataset does not expire when the substantive rules commence on 13 May 2027. Both the buyer and the seller (retaining archive copies) will hold legacy employee data subject to compliance rules and data principal rights that were never operationalised at closing. Retroactive consent cannot cure a disclosure that has already occurred.
Operational Adjustments for Transaction Counsel
A GCC carve-out operates across three distinct legal domains managed by separate practice groups:
- Commercial Contracts: The master services agreement governing long-term operational margin.
- Employment & Disputes: The employee risk register and Section 25FF compliance, governed by unprivileged in-house records.
- Data Protection: The historical transfer of employee datasets, governed by a staggered statutory implementation timetable.
This dynamic creates two distinct advisory work streams that sit ahead of the share purchase agreement:
- Structuring the employment diligence through external counsel from the outset. Because internal assessments prepared by captive teams remain unprivileged under Section 132 BSA, retaining independent advocates early to evaluate gratuity calculations, contractor classification, and pending conciliations ensures that legal privilege attaches before sensitive personnel exposures are committed to writing.
- Establishing data room governance and transitional covenants that anticipate the May 2027 DPDP enforcement baseline. Because Section 17(1)(e) cannot protect pre-approval diligence in any deal structure, the virtual data room requires tailored compliance with Sections 8(1) and 8(5), incorporating permissioned access, personal data redaction, audit logging, and enforceable return-or-destruction mechanisms before employee datasets are shared.
For transaction counsel, these mechanics expand the scope of work well beyond standard M&A documentation, generating two high-value advisory mandates prior to signing.
Lawfinity Solutions advises international law firms on cross-border legal market positioning. If the India corridor is a live question for your firm, we would be interested in a conversation. Lawfinity works with one firm per jurisdiction. Engagements begin with a single conversation about your firm’s current position and where the corridor question is live for you. Write to Prachi Shrivastava
