UK GDPR and Outsourcing to India: A Complete Guide for UK Businesses (2026)

Every UK business thinking about an Indian BPO partner eventually asks the same question: will this break UK data rules? It is a fair concern. The UK Government's Cyber Security Breaches Survey 2025/2026 found that 43% of UK businesses, or around 612,000 firms, identified a breach or attack in the previous year. Only 15% formally reviewed the cyber risks from their immediate suppliers, and just 6% reviewed their wider supply chain.

The money at stake is real. UK GDPR fines can reach £17.5 million or 4% of worldwide annual turnover, whichever is higher. In October 2025, the ICO fined Capita £14 million after a breach affecting 6.6 million people, and £6 million of that fell on a group company acting as a processor. This guide explains exactly what UK law requires, who owns each task and how to set up outsourcing to India step by step.

Can a UK Business Legally Outsource Personal Data to India?

Yes. UK law does not ban outsourcing to India. It controls how personal data reaches, or becomes accessible to, organisations outside the UK.

The ICO says every restricted transfer must be covered by one of three mechanisms: adequacy regulations, appropriate safeguards or an exception.

The UK-India trade agreement took effect on 15 July 2026, but it did not replace these rules. The UK Government says personal data transfers remain protected under UK data protection law.

For routine customer support, payroll or back office work, plan on using an appropriate safeguard and a transfer risk assessment.

When Does Outsourcing to India Count as a Restricted Transfer?

Outsourcing to India is a restricted transfer when all three parts of the ICO's test are met. The ICO's own brief guide uses a UK business with an Indian customer service provider as an example.

The ICO's Three-Step Test

• Does UK GDPR apply? For a UK-established business handling customer or employee data, the answer is usually yes.
• Are you initiating a transfer outside the UK? This covers sending data and making it accessible. The ICO looks at who decided on the transfer and chose the receiver.
• Is the receiver a separate legal entity? An Indian BPO company is separate from a UK client, so this step is normally met.

Does Remote Access Count If Data Stays in the UK?

Yes. The ICO's example is a UK business using an Indian IT support company through a VPN. The data stays on UK servers, but a restricted transfer takes place when the Indian company accesses it.

This is the first point we explain to UK buyers. Keeping your CRM in the UK can reduce risk, but it does not remove the transfer rules.

How Common BPO Scenarios Work Out

This table simplifies the ICO's examples, so check your exact data flow against its guidance. The ICO also offers an interactive transfers tool that takes about 10 minutes.

Who is Responsible: Your Business or the Indian Provider?

The organisation that initiates the restricted transfer is responsible for the transfer rules. If you contract directly with an Indian provider, that is normally you.

The ICO's rule of thumb is simple: you are not initiating a transfer if you did not design its structure or choose the receiver. It also tells you to follow the contractual relationships.

Does a UK Office Move All the Risk to the Provider?

No. A UK contracting entity may take responsibility for the transfer, but your wider UK GDPR duties remain. A controller must still choose a processor offering sufficient guarantees.

Can a Processor Be Fined Directly?

Yes. In the Capita case, the ICO fined the controller £8 million and the processor £6 million. A provider cannot treat data protection as only the client's problem, and a client cannot treat compliance as fully outsourced.

IDTA or UK Addendum: Which Should You Use?

Use the IDTA for a UK-only arrangement if you want a standalone UK document. Use the UK Addendum if your provider already uses the EU SCCs or the contract also covers EU personal data. Neither one replaces your Article 28 contract.

For a UK-only customer support or back office contract, we would normally start with the IDTA. If you also serve EU customers, we would use the EU SCCs and UK Addendum so one contract set can cover both data flows.

EU data needs separate attention because UK and EU rules now take different approaches. A UK assessment may not be enough for EU customer records, so ask your adviser to confirm the choice against your actual data.

How to Complete a Transfer Risk Assessment for India

A transfer risk assessment (TRA) checks whether protection after the transfer will be not materially lower than in the UK. UK legislation now calls this the "data protection test", but the ICO still uses the term TRA.

The assessment looks at two main risks: access by public authorities or other third parties, and whether rights and contractual protections can be enforced. Follow these five steps.

1. Describe the Transfer

Record the provider, location, service, systems, data types, people affected, transfer frequency and retention period. A vague description produces a weak assessment.

2. Score the Risk to People

Give more weight to data that could cause harm if exposed. The ICO's TRA tool provides initial risk scores by data category. Basic order details and health records should not receive the same treatment.

3. Review the Relevant Indian Laws

We would review these points as a minimum:

Do not treat this table as your full legal review. Your answer depends on your own data, contract and service.

4. Add Measures That Reduce the Risk

• Controlled access. Keep data in your own UK-hosted environment and give the provider limited access.
• Data masking. Hide fields agents do not need, such as full card or bank details.
• Download controls. Block downloads, copying and personal devices where the process allows.
• Access security. Use multi-factor authentication, role-based access and activity logs.
• Government requests. Require the provider to tell you about access requests where the law allows.

5. Record the Decision and Review It

Record your conclusion and the reasons. Review it if the data, service, location, sub-processors or Indian law changes.

A TRA must reflect the real service, so a generic template will not be enough.

How to Outsource to India and Stay UK GDPR Compliant in 8 Steps

Follow these steps in order and finish them before the provider gets live access. The ICO expects your transfer mechanism to be in place at the point you make the information accessible.

1. Map the Data Flow

List each service, system, data field and legal entity. Include CRMs, helpdesks, call recordings, shared inboxes, spreadsheets and backups.

2. Reduce the Data First

The ICO says you must check whether you can achieve your aim without making a restricted transfer. Remove fields the team does not need, and anonymise data where you can.

3. Confirm Each Party's Role

Decide who is the controller, processor and sub-processor. The provider usually acts as your processor for support or back office work, but check any data it uses for its own purposes.

4. Run the Three-Step Test

Record whether each flow is restricted and who initiates it. Do this per service, as payroll and customer support may use different tools and teams.

5. Carry Out Due Diligence

Review certificates, policies, sub-processors, access controls and incident procedures. Our guides on how to choose a BPO service provider in India and choosing a secure BPO partner cover the wider vendor checks.

6. Complete the Safeguard and TRA

Sign the IDTA or UK Addendum and record the TRA. Whoever initiates the transfer owns this step.

7. Sign the Contract and Update Your Records

Complete the Article 28 terms. Update your privacy information and processing records, and complete a DPIA if the work is likely to create a high risk to people.

8. Start Small and Keep Checking

Start with a pilot, using limited access or test data where practical. Review access logs, staff changes, sub-processors and incidents on a schedule.

What Your Contract With an Indian Provider Must Include

Your contract should combine Article 28 processor terms, a transfer mechanism and service-specific security controls. An NDA protects confidentiality, but it does not provide these terms.

Essential Article 28 Terms

Extra Clauses We Recommend

These are not all listed in Article 28, but we would add them to an Indian BPO contract:

• Breach notice. Set a fixed deadline in hours, so you can meet the 72-hour ICO reporting window where it applies.
• Named locations. List delivery sites and require approval before moving work.
• Device rules. State whether work happens on company devices, in the office or from home.
• Recording rules. Control who can access call and screen recordings.
• AI tools. Ban the use of client data in unapproved AI tools or model training.
• Government requests. Require notice and challenge steps where the law allows.
• Termination support. Require access removal and written deletion confirmation.

If a provider offers only an NDA, the paperwork is incomplete.

What Changed in UK and Indian Data Law in 2025 and 2026?

The core transfer process survived, but the legal test, regulator structure and penalty risk changed. India also began phasing in its own data protection law. This is a summary as of November 2026, not legal advice.

Does the New Test Make Outsourcing Easier?

It makes the test more practical, but it does not remove the work. You still need a safeguard, a TRA where required and any extra measures the assessment identifies.

Does the DPDP Act Protect UK Customer Data in India?

Only partly. Section 17(1)(d) disapplies many DPDP duties when an Indian provider processes data of people outside India under a contract with a foreign company. Sections 8(1) and 8(5) continue to apply, covering data fiduciary responsibility and reasonable security safeguards.

Do not assume Indian rights such as access or erasure will protect your UK customers directly. Your UK contract must deliver what UK GDPR requires.

Which Outsourced Services Carry the Most Data Risk?

Risk depends on the data, not the service label. Health, payroll and HR records need more protection than routine product enquiries. These ratings are our practical starting point, not legal categories, and your TRA should set the final rating.

Why Telemarketing Needs Extra Attention

UK marketing calls raise two questions: can the data go to India, and can you lawfully make the call? Transfer paperwork answers only the first question. PECR still applies, and its maximum fine now reaches £17.5 million or 4% of global turnover.

What Does ICO Registration Prove?

ICO registration shows that an organisation appears on the ICO's register of fee payers. It does not prove that a provider's transfers, contracts or security meet UK GDPR. We say this as a company that displays an ICO registration: it is a useful check, but never the only one.

What to Ask an Indian BPO Provider

Is ISO 27001 Enough?

No. ISO 27001 is strong security evidence, but it does not replace your safeguard, TRA or Article 28 contract. Check that the certificate covers the service and location you are buying.

For a broader security review, read our guide on how secure data entry outsourcing is. If you are comparing support options, our UK and US customer support outsourcing guide covers costs and pricing models.

These checks also matter when you compare data entry services or finance and accounting outsourcing.

How We Handle UK GDPR at SkyOs BPO

We built SkyOs BPO to serve UK businesses from Mohali, so we expect buyers to test our paperwork as well as our service. You can review our certifications and data security approach before you speak to us.

Before work starts, we should agree your data flows, the contracting entity, the transfer mechanism, the TRA information you need, and who can access which systems. We would rather finish the paperwork first than rush your team into a risky launch.

Conclusion

Outsourcing to India under UK GDPR works when you treat data protection as part of the setup, not a clause to add later. Map your data, confirm who initiates the transfer, put the right safeguard and TRA in place, and sign Article 28 terms before anyone gets access.

Choose a provider on evidence rather than badges. Ask for the documents, check the certificate scope, and start with a small pilot. The rules changed in 2026, but outsourcing to India remains workable for UK businesses that do the paperwork properly.

If you are planning to outsource, send us your process and data flow. We will tell you what can move, what should stay in the UK and which documents your team needs.