The Legal, Tax, and Compliance Playbook for Setting Up a GCC in India (2026 Edition)

Setting up a GCC in India in 2026 starts with the legal, tax, and compliance foundation: the entity you register, the export regime you sit in, your data protection obligations, and your transfer pricing position. Get these right before the first hire and the center runs clean for years. Get them wrong and you spend year three untangling a dispute that traces back to a decision made in week one. The engineers and the city matter, but they are not the hard part.

Most enterprises approach this backwards. They lock in office space and start interviewing, only to discover that the entity structure they defaulted into does not match how Indian foreign investment rules work, or that the tax benefit they assumed they qualified for no longer exists. A Global Capability Center in India lives or dies on this groundwork, so before you commit capital, it helps to walk the terrain the way your India counsel and tax advisor eventually will, from entity type to export regime to the legal requirements that now carry penalties large enough to matter at board level. That is what this playbook is for.

Entity Structure for a GCC in India and Why Wholly Owned Subsidiary Wins

The default and the right answer for most GCCs is a private limited company incorporated as a wholly owned subsidiary of the foreign parent, and there is a reason almost every serious center lands here rather than on a branch office or a liaison office. It helps to clear up one point of confusion first, because founders often talk about Pvt Ltd versus WoS as if they were two different choices, when they are answers to two different questions. Private limited is the entity type under Indian company law; wholly owned subsidiary describes the ownership, meaning the foreign parent holds 100% of the shares. A GCC is almost always both at once: a private limited company that happens to be wholly owned by the parent, and that combination is what gives you full strategic control, a clean corporate shell that can hire at scale, sign leases, own IP created in India, and grow into whatever the center eventually becomes, without the activity restrictions that hobble a branch or liaison setup.

The reason this is even simpler than it used to be is that for most sectors relevant to a GCC, 100% foreign ownership is permitted under the automatic route, which means you own the whole thing without needing a local partner and without waiting on prior approval from the RBI or the government. You incorporate under the Companies Act, 2013 through the SPICe+ filing with the Ministry of Corporate Affairs, obtain your PAN, TAN, and GST registration, and report the inward investment under FEMA. That is the spine of it, and it also sets up the tax and repatriation picture that everything downstream hangs on, because how you fund and structure this entity shapes the corporate tax, transfer pricing, and dividend position you will live with for years.

One question CFOs ask early is how much capital has to go in, and the honest answer is that a private limited company can be incorporated with a modest paid-up capital and then funded through further equity infusion as the center scales, so you are not locking a large sum on day one, you are sizing the initial injection to your first phase and topping up under FEMA as hiring ramps. Every inward remittance gets reported, the share allotment gets filed, and provided you stay inside the automatic route thresholds, none of it needs prior approval, which is what keeps a well-run incorporation to a matter of weeks rather than months.

A joint venture only makes sense in the narrow case where you genuinely need a local partner for market access or sector-specific reasons, and it introduces ownership and exit complexity you will feel later, so treat it as the exception rather than something to reach for. The one nuance worth knowing early is the Foreign Owned or Controlled Company question, because once non-resident ownership crosses fifty percent, any onward investment the entity makes is treated as indirect foreign investment with its own filing obligations, which rarely bites a straightforward GCC but is exactly the kind of thing you want your counsel flagging at incorporation rather than at audit.

SEZ and STPI Registration for a GCC

This is where the older guidance floating around does real damage, so it is worth being precise, because the single most common error in this space is assuming that setting up as an export-oriented unit still hands you an income tax holiday. For a center you are standing up now, it does not, and getting that wrong at the modelling stage throws your whole business case off. A GCC exports services to its parent, which makes it export-oriented, and India has historically offered two frameworks to support that: the Special Economic Zone route and the Software Technology Parks of India scheme, so it helps to be clear-eyed about what each one does and does not do today.

Start with the SEZ route, because this is the one people still believe carries a tax break. The Section 10AA deduction on export profits was genuinely generous, 100% for the first five years and then tapering, but it came with a sunset clause, and only units that commenced operations on or before March 31, 2020 are eligible. A GCC incorporating in 2026 has missed that window entirely, so a new SEZ unit gets no 10AA income tax deduction at all. When the Income-tax Act, 2025 takes over from April 1, 2026 and moves the SEZ provisions into Section 144, it only preserves the deduction for units already inside their eligibility block; it does not reopen the door for new ones. So if a vendor quotes you Section 10AA as a live benefit, they are describing a regime you can no longer enter. SEZ status still offers duty and GST advantages on procurement, but the income tax holiday is not on the table for a fresh setup.

STPI is the other half of the myth, and the correction is just as important. The scheme is real and useful; it gives you duty-free imports, 100% FDI, single-window support, handles your mandatory SOFTEX filings, and it lets you operate from anywhere in India rather than tying you to a pre-notified SEZ area. Registration itself is light; you file the application with the local STPI jurisdictional office, submit your incorporation and project details, execute the legal agreement, and receive approval, which is why STPI registration takes roughly two to four weeks and stays popular with mid-sized centers. What it does not give you, and has not for well over a decade, is an income tax holiday, because the Section 10A exemption that STPI units once enjoyed expired on March 31, 2011, and units registered after that date pay normal corporate tax on their profits.

So the honest 2026 picture is that neither route shelters your export income from tax, which means the choice between them is an operational one rather than a tax one. Pick STPI when you want location flexibility, fast registration, duty-free imports, and clean SOFTEX handling without committing to an SEZ campus. Consider SEZ when the duty and procurement advantages genuinely move the needle for your cost base and you are comfortable locating inside a notified zone. Where a real income tax incentive matters, it comes from elsewhere, either the GIFT City route for genuinely financial work, covered next, or in narrow cases the Section 80-IAC startup deduction, a 100% profit deduction for three years out of the first ten, though that one demands DPIIT recognition plus a separate Inter-Ministerial Board certification and rarely fits a captive center built to serve its own parent. Plan the tax position around that reality rather than around a holiday that is no longer available.

GIFT City IFSC Advantages for Finance-Heavy GCCs

If your center will run treasury, fund management, insurance, or other genuinely financial cross-border activity rather than software and back-office work, GIFT City deserves a serious look, and Budget 2026 made it materially more attractive than it was even a year ago. GIFT City houses India’s first International Financial Services Centre; it operates under a single dedicated regulator, the IFSCA, instead of the usual patchwork of RBI, SEBI, and IRDAI, and it is treated for many purposes as offshore territory sitting on Indian soil.

The headline benefit for an eligible entity is the deduction under Section 80LA, a 100% deduction on profits from eligible business for any ten consecutive years out of the first fifteen, alongside GST relief on eligible services and exemptions from several transaction taxes. For cross-border intra-group work, there is also a notified safe harbour for IFSC entities that reduces transfer pricing dispute risk, which matters when your center is transacting constantly with the parent. The important caveat, and one worth stating plainly so nobody structures on a wrong assumption, is that GIFT City stays tax-advantaged only within limits, because the incentives attach to specific activity types and eligibility conditions, so the entity design has to be done before incorporation because it directly shapes the outcome. For a conventional engineering or shared-services GCC, GIFT City is usually the wrong tool; it earns its place when the work is financial in nature.

If GIFT City is genuinely the right home for the activity, the one procedural point worth knowing so the timeline does not slip is that the Letter of Approval has to be secured before you apply for IFSCA registration or licensing, and getting that sequence wrong forces avoidable re-filings that push the whole approval out. Handled in order, a well-prepared application moves through in a matter of weeks, which is why the structuring and the paperwork want to be planned together rather than treated as separate stages.

DPDP Act Compliance

A GCC handles the parent’s data by definition, often personal data belonging to customers and employees sitting in other jurisdictions, which puts the Digital Personal Data Protection Act, 2023 squarely in your path, and the reason it needs attention now rather than later is that it is rolling out in phases with real teeth at the end. The operational detail was filled in by the Digital Personal Data Protection Rules, 2025, which set out how data fiduciaries meet the obligations around consent, breach reporting, and cross-border transfer.

The timeline is the part to internalize. The first enforcement phase began in November 2025, Phase 2 by November 2026, requires breach response procedures, data protection impact assessments, and consent manager registration, and the heavier penalties, which run up to 250 crore rupees, arrive with Phase 3 in May 2027. For a GCC that is standing up systems from scratch, that phasing is a gift, because you can architect consent handling, cross-border data flows, and breach playbooks into the center on day one instead of retrofitting them under deadline pressure later. Building the data governance layer while you are still small is far cheaper than bolting it on at three hundred people.

GCC Tax Regulations in India Covering Corporate Tax, Transfer Pricing, and the Ongoing Calendar

Once the center is live, ongoing GCC compliance in India settles into a rhythm, and the pieces that matter most for a foreign-owned GCC are corporate tax, transfer pricing, and the labour framework. On the tax side, most GCCs elect the concessional corporate tax regime under Section 115BAA, a 22% base rate that works out to roughly 25.17% once surcharge and cess are added, and the one condition to know is that choosing it means giving up the specified incentive deductions, which for a new GCC is a non-issue precisely because, as covered above, those export-linked holidays are no longer available to you anyway. Layered on top are TDS obligations, GST filings on inter-company services, and annual ROC filings, none of which is exotic but all of which need clear calendar ownership from the start.

Transfer pricing is the one that decides whether an audit is boring or painful, because almost everything your GCC does is a related-party transaction with the parent, and it has to be priced at arm’s length with documentation that survives scrutiny. The relief here is that Budget 2026 introduced a uniform 15.5% safe harbour margin and raised the eligibility threshold to 2,000 crore rupees, which pulls a large share of existing GCCs into a regime where the margin is agreed up front rather than argued after the fact, so if your center fits, electing into safe harbour removes an enormous amount of future friction.

What trips centers up on transfer pricing is the documentation discipline behind it, because the tax authority will want to see that the pricing on the services your GCC renders to the parent reflects what independent parties would have agreed, backed by a functional analysis, benchmarking, and contemporaneous records kept year after year. A center that treats this as a once-a-year scramble tends to produce documentation that looks assembled under pressure, which is exactly what draws scrutiny, whereas one that builds the intercompany agreement, the cost base, and the mark-up logic cleanly at the start has almost nothing to defend later. This is the quiet reason the entity design and the pricing model belong in the same early conversation; they are two views of the same decision.

The employment layer changed recently too, the four consolidated labour codes came into effect on November 21, 2025, which means the contracts, salary structuring, and provident fund and gratuity handling your HR sets up need to reflect the new regime from the beginning rather than the old twenty-nine-law patchwork. Registering under the Shops and Establishments Act, running a POSH-compliant Internal Complaints Committee, and maintaining clean payroll records round out the obligations that a well-run center simply builds in as standard rather than treating as afterthoughts.

Sequencing the Setup So Compliance Never Becomes the Bottleneck

The reason all of this reads as a playbook rather than a checklist is that the order matters as much as the items. Entity structure comes first because it constrains everything downstream; the export regime decision follows because it depends on where you locate and what you are optimizing for, data governance and the compliance calendar get designed in parallel while the center is still small enough to shape cleanly, and the transfer pricing position gets settled before the inter-company invoices start flowing rather than after. Teams that sequence it this way tend to be operational in weeks and audit-ready by design. Teams that improvise tend to spend their second year fixing their first.

There is also a genuine build-versus-outsource question underneath all of this, because standing up in-house legal, finance, and compliance capability from a cold start is a real cost, and for a center under fifty or so people the fixed overhead of that machinery is hard to justify against the value it protects. This is exactly where the structure of your India entry, and who you build your GCC with, starts to matter as much as the entity you register.

Build Your India GCC on a Compliant Foundation with Codeft

Getting the legal, tax, and compliance layer right rewards a partner who has walked foreign companies through it before, and that is where Codeft fits. Through our Build-Operate-Transfer model, we stand up your India center on a clean, compliant foundation, run it while your team scales, and hand over full ownership when you are ready. Working alongside your legal and tax advisors, we make sure the operational side, the hiring, the infrastructure, the data governance practices, and the intercompany working model, is built correctly from day one rather than reverse-engineered later. If you are mapping out how your GCC in India should take shape, that is the conversation worth having early, and Codeft is built to have it with you.

Founder’s Perspective

The centers that struggle fail on the assumption that compliance is a formality you handle after the interesting decisions are made. The teams that win treat the legal and tax structure as the first architectural choice, because it is the one that quietly sets the ceiling on everything the center can become.

– Rahul Varadareddi, Co-founder & CEO, Codeft Digital

This playbook reflects the regulatory position as of early 2026 and is general guidance, not legal or tax advice. Confirm specifics with qualified India counsel and a tax advisor before acting.