ATB LEGAL
Dispute Resolution Employment Corporate & Commercial Personal Status Intellectual Property Regulatory & Compliance International Trade Insights People About Contact Us
Uncategorized

Outsourcing to India: What the IT or BPO Vendor Contract Must Cover

21 October 2026 · ATB Legal · 17 min read

Short answer: Outsourcing to India runs on the contract, because Indian law gives a foreign client few protections by default: ownership of deliverables, data handling, service levels, staff, exit and dispute resolution all have to be written into the vendor agreement. Copyright in code and other work product starts with the vendor or the individual author and passes to the client only by a signed written assignment that meets the Copyright Act’s formalities, and an Indian vendor must report listed cyber incidents to CERT-In within six hours whatever the contract says [1][2]. An arbitration clause with a seat outside India binds an Indian vendor, but the award is enforceable in India as a foreign award only if the seat is in a territory India has notified as reciprocating, so the seat should be checked before signing [3].

Who this is for: general counsel, procurement leads and CIOs at EU, UK, Swiss and Norwegian companies sending software development, IT support or back-office processing to an Indian vendor.

What Indian law does, and does not do, for the client

IT outsourcing means contracting an external vendor to build, run or support software and systems; business process outsourcing (BPO) means contracting it to run a business function, such as claims handling or customer service. The agreement is a commercial contract under the Indian Contract Act 1872 unless the parties choose another law, as they may in a cross-border deal (even an Indian-seated tribunal applies “the rules of law designated by the parties”, s.28(1)(b) Arbitration and Conciliation Act 1996) [3]; the general framework is on commercial contracts in India. A foreign governing law does not switch off the Indian rules on Indian copyright, the vendor’s own data and cyber-security duties, stamp duty, or enforcing an award in India.

Decision table: the clauses an outsourcing contract with an Indian vendor needs

ClauseWhy it matters in IndiaWhat to ask for
Scope and service levelsA sum named as payable on breach is a ceiling on “reasonable compensation” (Contract Act s.74) [4]Measurable service levels; service credits as a price adjustment, not the only remedy; termination for repeated failure
Copyright in deliverablesThe vendor owns its employees’ work; an assignment silent on term or territory is read as five years and India only [1]Present, worldwide, full-term assignment; no one-year lapse; subcontractor assignments
InventionsPatent assignments must be in writing; filing abroad first may need a permit [6][7]Invention disclosure; written assignment
Personal dataDPDP duties reach the vendor through the contract; EU data needs a GDPR transfer tool [8][11][12]Processing terms, security standards, deletion on exit
Security incidentsSix-hour CERT-In reporting; ICT logs kept for 180 days [2]Notice to the client within six hours; log access
StaffAn agreement restraining a lawful trade or business is void to that extent (Contract Act s.27) [19]Key-personnel terms; non-solicitation for the term and a short tail
Subcontracting, auditThe client answers to its own regulator (DORA for EU financial entities) [13]Consent to subcontractors; audit and regulator access; continuity testing
ExitPeople, knowledge and code sit with the vendorTransition period at agreed rates; data and code returned
DisputesPart I of the Arbitration Act does not govern a foreign seat; enforcing the award depends on reciprocity [3][15]Seat in a notified territory (which also keeps Indian interim relief available); section 9 not excluded
Tax and stamp dutyExports of services can be zero-rated for GST; an unstamped agreement is inadmissible in evidence [16][17][18]GST clause; stamp duty allocated

Who owns the code: copyright and inventions in deliverables

Under section 17 of the Copyright Act 1957 the author is the first owner; the employer is first owner only of work made in the course of employment “under a contract of service or apprenticeship”, and the commissioning rule in section 17(b) does not cover software [1]. Code written by the vendor’s employees therefore belongs to the vendor, code written by its freelancers or sub-vendors belongs to them, and the client owns only what is assigned to it.

An assignment must be in writing, signed, and identify the work and rights; if it omits the period it is deemed to be five years, if it omits the territory it is presumed to be India, and rights not exercised within one year lapse “unless otherwise specified in the assignment” (s.19) [1]. The formalities are explained under IP assignment in India. In a vendor contract they call for a present, worldwide, full-term assignment of all deliverables that excludes the lapse rule, a warranty that the vendor holds written assignments from everyone working on them, and a licence of any pre-existing vendor tools built in.

Moral rights, to claim authorship and to object to prejudicial distortion, stay with the individual author “even after the assignment”, though adaptations of a computer programme within section 52(1)(aa) are carved out (s.57) [5]; contracts usually take the vendor’s undertaking that its staff will not assert them, so far as the law allows.

A patent assignment is valid only in a written document “embodying all the terms and conditions” (s.68 Patents Act 1970) [6]. A person resident in India may not apply for a patent abroad without a written permit unless an Indian application was filed at least six weeks earlier (s.39) [7]; see foreign filing licence in India for inventions made in India. Know-how that is neither patented nor covered by copyright depends on confidentiality terms: see protecting trade secrets and know-how in India.

Data protection and security: DPDP Act, GDPR and CERT-In

  • DPDP Act. A data fiduciary may use a processor “only under a valid contract” and stays responsible for security safeguards over processing done for it (s.8(2), (5)); the DPDP Rules 2025 require appropriate terms in that contract (Rule 6) [8][9]. Where an Indian vendor processes data of people outside India under a contract with a foreign client, only the accountability and security duties apply (s.17(1)(d)) [8]. Most duties start on 13 May 2027, 18 months after the Rules were notified [9][10]; roles, transfers and penalties are in DPDP Act for foreign companies and offshore processors.
  • GDPR. India has no EU adequacy decision, so EU personal data handled by an Indian vendor needs a transfer tool, usually the Commission’s standard contractual clauses (Implementing Decision (EU) 2021/914), alongside GDPR processor terms [11][12].
  • CERT-In. The Directions of 28 April 2022 cover “service providers, intermediaries, data centres, body corporate and Government organisations”, so an Indian vendor must report listed incidents within six hours of noticing them, name a point of contact and keep ICT logs for a rolling 180 days within India, though CERT-In’s FAQs accept logs held abroad if they can be produced on request [2][21]. The client’s notice clause should fit inside that window; the first-day sequence is in legal priorities in the first 24 hours after a cyber-attack.

Regulated clients: DORA and Indian sector rules

An EU bank, insurer or other financial entity is bound by the Digital Operational Resilience Act (Regulation (EU) 2022/2554), applying from 17 January 2025, which expects ICT contracts to include complete service descriptions, incident assistance, audit and access rights, and exit strategies with transition periods [13]. Indian rules such as the RBI’s Managing Risks in Outsourcing Directions 2025 for NBFCs (28 November 2025) bind Indian regulated entities, not a European client buying from abroad [14].

Staff, subcontractors, AI tools and exit

  1. Staff. Section 27 of the Contract Act makes an agreement restraining anyone “from exercising a lawful profession, trade or business of any kind” void to that extent [19]; its reach over no-hire and non-solicitation clauses between companies is covered in non-compete clauses in Indian commercial agreements.
  2. Subcontracting. A consent right, an approved list, and flow-down of confidentiality, IP, data and audit terms.
  3. AI tools. Whether the vendor may use generative-AI tools on client code or data, and who owns and answers for the output: see India’s AI rules for foreign companies.
  4. Exit. A transition period at rates agreed now, return of data, code and documentation, knowledge transfer, and no right to withhold deliverables during a fee dispute.

Governing law, arbitration, stamp duty and tax

  • Seat. Part I of the Arbitration and Conciliation Act 1996 “shall apply where the place of arbitration is in India” (s.2(2)); the Supreme Court held in Bharat Aluminium Co v Kaiser Aluminium Technical Services (6 September 2012) that it does not govern arbitrations seated abroad [3][15]. Sections 9 (interim measures) and 27 (court help with evidence) still apply to a foreign-seated international commercial arbitration unless excluded, but only where the award would be enforceable under Part II, so an unnotified seat also costs the client Indian interim relief; the clause should keep them [3].
  • Enforcement. An award is a “foreign award” under Part II only if made in a territory notified as reciprocating (s.44(b)) [3]; check the seat against the Gazette notifications.
  • Stamp duty. An agreement executed only outside India “may be stamped within three months after it has been first received in India” (Indian Stamp Act 1899 s.18) [16]; unstamped, it is inadmissible in evidence until stamped, but not void (In re Interplay, Supreme Court, 13 December 2023) [17].
  • GST. The vendor’s services to a client abroad are a zero-rated export where the supplier is in India, the recipient and place of supply are outside India, payment arrives in convertible foreign exchange or in Indian rupees where the Reserve Bank of India permits, and the two are not merely establishments of one person (IGST Act ss.2(6), 16(1)(a)) [18][20].
  • Permanent establishment. Whether the arrangement gives the client a taxable presence in India is a treaty question that needs tax review before signing, in particular where the client’s staff direct work from the vendor’s premises or the vendor deals with customers on the client’s behalf.

Neither the UK–India CETA (in force since 15 July 2026) nor the concluded but unsigned EU–India FTA amends the Indian laws discussed here; their services and mobility terms are covered in India–UK trade deal (CETA) in force: what UK businesses can use now.

Worked example (illustrative)

Hypothetical company and figures. FX: INR 107 = EUR 1 (rounded exchange rates, October 2026). Fees, service levels, credit bands and transition rates are assumptions, not sourced market data.

A Belgian software company contracts a Pune-based vendor for 25 developers and a support desk for its EU customers, at EUR 150,000 a month for three years.

  1. Value. EUR 150,000 × 12 = EUR 1.8m a year (INR 19.26 crore); EUR 5.4m over the term.
  2. Service levels. Availability target 99.5% a month; a month at 99.0% triggers a 5% credit: 5% × EUR 150,000 = EUR 7,500 (INR 802,500). Credits are capped at 15% of the monthly fee (EUR 22,500) and do not exclude damages for serious failures [4].
  3. Code. The vendor’s draft says “all deliverables belong to the client” with no duration or territory, inviting the five-year and India-only presumptions [1]. The client substitutes a present, worldwide, full-term assignment excluding lapse, plus assignments from the vendor’s three freelance designers.
  4. Data. The desk handles only EU customers’ data, so the DPDP Act applies only for accountability and security (s.17(1)(d)) [8]; standard contractual clauses are still needed under the GDPR [11][12].
  5. Incidents. The vendor’s six-hour CERT-In clock [2] sets the client’s notice period at six hours, with a full report within 72 hours.
  6. Exit. Six months of transition assistance at 50% of the monthly fee: 6 × EUR 75,000 = EUR 450,000 (INR 4.815 crore), plus code, documentation and data.
  7. Disputes and stamp duty. Arbitration in Brussels under institutional rules, the seat confirmed against India’s section 44(b) notifications before signing [3]; the vendor bears any Indian stamp duty if the agreement is brought into India [16].

Risks and common mistakes, ranked

  1. “The client owns all IP” with no section 19 particulars, and no assignments from freelancers or sub-vendors [1].
  2. A breach-notice period longer than the vendor’s six-hour CERT-In clock [2].
  3. A seat chosen without checking reciprocity, which also loses Indian interim relief, or section 9 excluded [3].
  4. No exit plan: transition rates, code delivery and data return left until the end.
  5. Service credits as the only remedy [4].
  6. Dropping GDPR transfer terms because the DPDP Act partly exempts EU data [8][11].
  7. Bringing an unstamped agreement into India when a dispute starts [16][17].

Checklist to forward internally

  • ☐ Service levels, credits and remedies defined
  • ☐ Present, worldwide, full-term copyright assignment; lapse excluded; subcontractor assignments collected
  • ☐ Written patent assignments; foreign-filing plan for inventions made in India
  • ☐ Confidentiality and return or destruction on exit
  • ☐ DPDP processing terms; GDPR processor terms and standard contractual clauses
  • ☐ Incident notice within six hours; log access
  • ☐ Subcontractor consent, audit and regulator access, continuity testing (DORA where relevant)
  • ☐ Exit: transition period, rates, data and code return
  • ☐ Seat checked against India’s reciprocity notifications
  • ☐ GST, stamp duty and permanent-establishment questions assigned to an owner

Whether to use a vendor at all, or to build a captive centre or use build-operate-transfer, is covered in Global Capability Centre (GCC) operating model and entity in India: captive, build-operate-transfer or managed (ATB Corporate).

About ATB Legal

ATB Legal is a law firm advising on Indian and UAE law. Its work covers corporate and commercial matters, foreign investment and exchange control, mergers and acquisitions, international trade and customs, and dispute resolution, including arbitration. Contact details.

This article is general information, not legal advice, and is not a solicitation of work. Under the Bar Council of India rules, Indian advocates may not advertise or solicit work.

FAQ

What should an IT outsourcing contract with an Indian vendor include? An IT outsourcing contract with an Indian vendor should cover scope and service levels, ownership of deliverables, confidentiality, personal data and security, incident notice, staff and subcontractors, exit and transition, and governing law and arbitration. Under Indian law the points most often missed are a copyright assignment that meets section 19 of the Copyright Act, incident notice that fits the vendor’s six-hour CERT-In clock, and an arbitration seat in a territory India has notified as reciprocating [1][2][3].

Who owns the software code written by an Indian outsourcing vendor? The Indian vendor owns code written by its employees, and freelancers or sub-vendors own code they write, until the client takes a written assignment, because commissioning software does not by itself transfer copyright under section 17 of the Copyright Act 1957 [1]. The assignment must be signed and identify the work and rights; if it omits the period or territory, Indian law reads it as five years and India only, and unexercised rights lapse after one year unless the assignment says otherwise (s.19) [1].

Can an Indian vendor process EU personal data under the GDPR? An Indian vendor can process EU personal data under the GDPR if the EU client puts GDPR processor terms and a transfer tool in place, usually the Commission’s standard contractual clauses, because India has no EU adequacy decision [11][12]. On the Indian side, the DPDP Act’s consent, notice and transfer provisions do not apply to that data where it is processed under a contract with the foreign client, but security safeguards do (s.17(1)(d)) [8].

Does an Indian outsourcing vendor have to report a cyber incident to CERT-In? An Indian outsourcing vendor must report incidents listed in the CERT-In Directions of 28 April 2022 to CERT-In within six hours of noticing them, because the Directions apply to service providers, data centres and any body corporate [2]. It must also keep ICT logs for a rolling 180 days, within India unless they can be produced from abroad on request, so the client’s contract should require notice and log access on a matching timetable [2][21].

Can a contract with an Indian vendor be governed by foreign law with arbitration outside India? A contract with an Indian vendor can be governed by foreign law with arbitration seated outside India: Indian arbitration law respects the parties’ choice of law, and Part I of the Arbitration and Conciliation Act 1996 does not govern a foreign-seated arbitration [3][15]. The award is enforceable in India under Part II only if the seat is in a territory notified as reciprocating and, where the seat is in a notified territory, Indian courts can still grant interim measures under section 9 unless the parties exclude it [3].

Does a European client pay Indian GST on services bought from an Indian IT or BPO vendor? A client outside India does not normally pay Indian GST on services bought from an Indian IT or BPO vendor, because the vendor’s supply is a zero-rated export of services where the conditions in section 2(6) of the IGST Act are met [18]. Those conditions include a place of supply outside India and payment in convertible foreign exchange, or in Indian rupees where the Reserve Bank of India permits, so the contract’s tax clause should record them [18][20].

Related reading

Sources

  1. India Code, The Copyright Act, 1957 (Act No. 14 of 1957), as on 15 June 2026 (ss.2(o), 17, 18(1), 19) (15 June 2026) — https://www.indiacode.nic.in/bitstream/123456789/1367/1/a195714.pdf (accessed 20 October 2026)
  2. CERT-In, Directions under sub-section (6) of section 70B of the Information Technology Act 2000, No. 20(3)/2022-CERT-In (28 April 2022) — https://www.cert-in.org.in/PDF/CERT-In_Directions_70B_28.04.2022.pdf (accessed 20 October 2026)
  3. India Code, The Arbitration and Conciliation Act, 1996 (Act No. 26 of 1996), as on 1 June 2026 (ss.2(2), 28(1)(b), 44) (1 June 2026) — https://www.indiacode.nic.in/bitstream/123456789/1978/1/a199626.pdf (accessed 20 October 2026)
  4. Indian Contract Act 1872 (Act 9 of 1872), section 74, text hosted by the High Court of Tripura (1872, as amended) — https://thc.nic.in/Central%20Governmental%20Acts/Indian%20Contract%20Act,%201872.pdf (accessed 20 October 2026)
  5. Copyright Office, Government of India, The Copyright Act, 1957, Chapter XII, section 57 (author’s special rights) (1957, as amended) — https://copyright.gov.in/Copyright_Act_1957/chapter_xii.html (accessed 20 October 2026)
  6. Office of the Controller General of Patents, Designs and Trade Marks, The Patents Act, 1970, section 68 (1970, as amended) — https://ipindia.gov.in/writereaddata/Portal/ev/sections/ps68.html (accessed 20 October 2026)
  7. Office of the Controller General of Patents, Designs and Trade Marks, The Patents Act, 1970, incorporating all amendments till 1 August 2024 (s.39) (1 August 2024) — https://ipindia.gov.in/frontend/pdf/patents/1_113_1_The_Patents_Act__1970___incorporating_all_amendments_till_1-08-2024.pdf (accessed 20 October 2026)
  8. Ministry of Electronics and Information Technology (MeitY), The Digital Personal Data Protection Act, 2023 (No. 22 of 2023) (ss.8(2), 8(5), 17(1)(d)) (11 August 2023) — https://www.meity.gov.in/static/uploads/2024/06/2bf1f0e9f04e6fb4f8fef35e82c42aa5.pdf (accessed 20 October 2026)
  9. MeitY, Digital Personal Data Protection Rules, 2025, G.S.R. 846(E) (Rules 1 and 6) (13 November 2025) — https://www.meity.gov.in/static/uploads/2025/11/53450e6e5dc0bfa85ebd78686cadad39.pdf (accessed 20 October 2026)
  10. Press Information Bureau (MeitY), “Government notifies DPDP Rules to empower citizens and protect privacy” (14 November 2025) — https://www.pib.gov.in/PressReleasePage.aspx?PRID=2190014&reg=3&lang=2 (accessed 20 October 2026)
  11. European Commission, Data protection adequacy for non-EU countries (list of adequacy decisions) (page as at 20 October 2026) — https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/adequacy-decisions_en (accessed 20 October 2026)
  12. EUR-Lex, Commission Implementing Decision (EU) 2021/914 on standard contractual clauses for the transfer of personal data to third countries pursuant to Regulation (EU) 2016/679 (4 June 2021) — https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj/eng (accessed 20 October 2026)
  13. EUR-Lex, Regulation (EU) 2022/2554 on digital operational resilience for the financial sector (DORA) (Art 2(1)(n); recitals 71–74) (14 December 2022) — https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX%3A32022R2554 (accessed 20 October 2026)
  14. Reserve Bank of India, Reserve Bank of India (Non-Banking Financial Companies – Managing Risks in Outsourcing) Directions, 2025, RBI/DOR/2025-26/363 (28 November 2025) — https://rbi.org.in/scripts/BS_ViewMasDirections.aspx?id=12941 (accessed 20 October 2026)
  15. Supreme Court of India, Bharat Aluminium Co v Kaiser Aluminium Technical Services Inc, judgment text as published by Indian Kanoon (6 September 2012) — https://indiankanoon.org/doc/173015163/ (accessed 20 October 2026)
  16. The Indian Stamp Act, 1899, section 18, text as published by Indian Kanoon (1899, as amended) — https://indiankanoon.org/doc/29668940/ (accessed 20 October 2026)
  17. Supreme Court of India, In re: Interplay between Arbitration Agreements under the Arbitration and Conciliation Act 1996 and the Indian Stamp Act 1899, 2023 INSC 1066, judgment text as published by Indian Kanoon (13 December 2023) — https://indiankanoon.org/doc/139003074/?type=print (accessed 20 October 2026)
  18. Central Board of Indirect Taxes and Customs, The Integrated Goods and Services Tax Act, 2017 (No. 13 of 2017) (ss.2(6), 16; as enacted, s.2(6)(iv) since amended, see [20]) (12 April 2017) — https://cbic-gst.gov.in/aces/Documents/IGST-bill.pdf (accessed 20 October 2026)
  19. Indian Contract Act 1872 (Act 9 of 1872), section 27 and Exception 1, text hosted by the High Court of Tripura (1872, as amended) — https://thc.nic.in/Central%20Governmental%20Acts/Indian%20Contract%20Act,%201872.pdf (accessed 20 October 2026)
  20. Central Board of Indirect Taxes and Customs, Circular No. 202/14/2023-GST: clarification relating to export of services, sub-clause (iv) of section 2(6) of the IGST Act 2017 (payment in Indian rupees through Special Rupee Vostro Accounts) (27 October 2023) — https://gstcouncil.gov.in/sites/default/files/2024-06/circular-no-202-14-2023.pdf (accessed 20 October 2026)
  21. CERT-In, FAQs on the Cyber Security Directions of 28 April 2022 (FAQ 35, storage of logs) (May 2022) — https://www.cert-in.org.in/PDF/FAQs_on_CyberSecurityDirections_May2022.pdf (accessed 20 October 2026)

Disclaimer: This article is general information as at 20 October 2026, not legal advice.