Risks of outsourcing to India, and how to manage each one

The risks at a glance

India is one of the most established places in the world to send work. Its industry body, NASSCOM, estimates the technology and services sector at about $315 billion in revenue for the 2026 financial year, with exports of about $246 billion, and counted more than 1,750 global capability centres, the in-house offices that large companies run there themselves. The risks below are the ones any careful buyer plans for, and each has a standard answer.

Our guide to the pros and cons of outsourcing to India covers cost, skills and quality. This guide goes deeper on the legal, contract and calendar side.

Data protection: what Indian law adds, and what it doesn't

India's Digital Personal Data Protection Act, 2023 now has rules. The DPDP Rules 2025 were notified in November 2025, and most of the duties apply from about May 2027.

For most outsourced work, one exemption matters. Section 17(1)(d) says much of the Act does not apply when an Indian business processes personal data of people outside India under a contract with a business outside India. Two duties still apply to the Indian vendor: accountability for the processing, and reasonable security safeguards. Failing to take those safeguards carries the Act's highest penalty, up to ₹250 crore, set by the Data Protection Board after an inquiry.

Section 16 lets the Indian government restrict transfers to countries it names, and keeps stricter sector rules in place. One example is often overstated: the Reserve Bank of India's 2018 rule that payment system data be stored only in India applies to payment system operators and banks, not to every business that outsources finance work.

• If you are in the UK or EU, your GDPR duties stay in full: a written processor contract, transfer clauses for a country without an adequacy decision, and your permission before any sub-processor is used.
• Give access only to the systems and data the task needs, ideally through accounts you control and can switch off.
• Ask how the vendor's laptops, logins and screens are secured, and keep the answers in writing.

Our cost and GDPR guide lists the documents to ask a provider for.

Ownership of the work: get it in writing

Under India's Copyright Act, 1957, the first owner of work made by an employee in the course of employment is the employer, unless agreed otherwise. That employer is your vendor, not you. So you own the work only if the vendor assigns it to you.

The Act sets defaults that catch out short contracts. An assignment is valid only in writing and signed. If it doesn't say how long it lasts, it is taken to last five years. If it doesn't say where it applies, it is taken to cover India only. Future work can be assigned in advance.

1. Put a written assignment of all work made for you in the contract, worldwide and for the full term of the rights.
2. Ask the vendor to confirm that its staff and any freelancers have signed agreements that pass their rights to it.
3. Require your written consent before any subcontracting, so no unknown party touches your work.
4. Agree that your materials, logins and data are returned or deleted when the contract ends.

Tax: permanent establishment and new rules at home

A foreign company can become taxable in India if it has a permanent establishment there: broadly, a fixed place of business at its disposal, its own staff working in India, or an agent who habitually signs contracts on its behalf. In 2017 India's Supreme Court held, in the e-Funds case, that back-office work done by an Indian subsidiary did not create one. An ordinary contract with an independent vendor, with no office or staff of your own in India, is generally low-risk, but large or long engagements deserve tax advice.

For US buyers, fees for work done entirely in India are generally foreign-source income, according to the IRS, and not subject to US withholding. A proposed bill, the HIRE Act, would add a 25% excise tax on some payments for offshore services. As of October 2026 it has not passed and is still in committee, so watch it rather than plan around it.

This section is general information, not tax or legal advice. Rules depend on your country, your contract and how the work is set up.

People: turnover, status updates and who is the employer

People change jobs everywhere. Infosys reported voluntary attrition of 13.0% over the twelve months to June 2026. A team, rather than one person, means a resignation or an absence doesn't stop the work, and a written brief means a new person can pick up where the last one stopped. Our guide on how to brief a remote team shows how.

Remote teams in any country tend to report less when the client is a stranger. Make bad news easy to give: ask for a short written status at the end of each day, with what is done, what is blocked and what is unclear, and thank people for raising problems early.

Manage the vendor, not its people. Agree the work, the quality measure and the deadlines with the vendor, and leave hiring, leave, pay and performance reviews to it. That keeps the lines clear, and it is how a managed service is meant to work.

Indian holidays: how they work and how to plan around them

There is no single holiday list for all of India. Central government offices in Delhi have 17 holidays a year. Central offices elsewhere observe 14 compulsory holidays and choose 3 more from a list of 12 that includes Pongal, Onam and Ganesh Chaturthi. Private companies follow their state's law: Karnataka requires 10 paid holidays a year, including 1 May and 1 November, and Maharashtra requires 8. Each company publishes its own list.

Most festival dates follow the Hindu or Islamic calendars, so they move against your calendar every year. Islamic holidays depend on the sighting of the moon and can change at short notice: in 2026, the central government moved Id-ul-Zuha from 27 May to 28 May a week before the day.

• Ask your provider for its holiday list in December for the coming year, and put it in your own team calendar.
• Plan around October and November. Dussehra, Durga Puja in the east, and Diwali fall then, many people travel home, and it overlaps with the busiest quarter for many Western businesses.
• Use late December the other way round. When your own team is away, the India team is mostly working, so give it a clear backlog: tests, documentation, catalog clean-up or review work that doesn't need your sign-off.
• Don't plan a launch on a moon-dependent date. Leave a day either side of Id-ul-Fitr and Id-ul-Zuha.
• Agree cover for festival weeks in the contract: who is on duty, and how fast urgent work is answered.

A safe way to start

1. Pick one repeatable task with a clear quality measure. Our guide on what to outsource first helps you choose.
2. Sign the contract with the data, ownership and subcontracting clauses above before any data is shared.
3. Run a small paid trial, measure the quality, and agree a holiday and cover plan before you scale.

HerWorkCircle is a managed team: you agree the work, the quality measure and the price with us, and our team checks every piece before it reaches you. Send a brief for a free 20-minute call and a clear price for a trial.

Questions

Sources

1. Strategic Review 2026: industry estimates (24 February 2026) NASSCOM
2. Strategic Review 2025 press release (global capability centres) NASSCOM (24 February 2025)
3. Digital Personal Data Protection Act, 2023 (sections 8, 16, 17 and the Schedule) Ministry of Electronics and IT (Gazette text)
4. DPDP Rules 2025 explained (17 November 2025) Press Information Bureau
5. Storage of payment system data (6 April 2018) Reserve Bank of India
6. Copyright Act, 1957 (sections 17 to 19) Copyright Office, Government of India
7. Outsourcing back-office functions does not create a permanent establishment (e-Funds, 2017) Cyril Amarchand Mangaldas, law firm (12 January 2018)
8. Source of income: personal service income US Internal Revenue Service
9. S.2976, Halting International Relocation of Employment Act US Congress
10. Infosys Q1 FY27: attrition at 13% (23 July 2026) Storyboard18
11. Holidays for central government offices, 2026 Department of Personnel and Training (3 July 2025)
12. Change in the date of Id-ul-Zuha, 2026 Department of Personnel and Training (May 2026)
13. Holidays for central government offices, 2027 Department of Personnel and Training (16 July 2026)
14. Karnataka Industrial Establishments (National and Festival Holidays) Act, 1963 Indian Kanoon (text of the Act)
15. Maharashtra Shops and Establishments Act, 2017, section 18 Lawgist (text of the Act)
16. West Bengal holiday list 2026 Simpliance, compliance service
17. UK bank holidays GOV.UK
18. Federal holidays US Office of Personnel Management
19. Public holidays in Germany DGB, German Trade Union Confederation
20. Public holidays in France Service-Public.fr