BPO Company Setup in India: Compliance Guide

India has long been a preferred destination for global BPO operations. STPI-registered units contributed ₹10,69,270 crore in IT and ITeS exports during FY 2024-25, accounting for around half of the country’s software exports. Along with a skilled workforce and strong technology infrastructure, this has made BPO company setup in India an attractive option for companies from Japan, the UAE, the US, Europe, and many other markets.

Most BPO operations do not require a separate sector-specific operating licence. However, businesses handling regulated activities (such as financial services, insurance or certain telecom-related functions) should assess whether any sector-specific approvals apply. . The focus is instead on meeting the applicable compliance requirements under the Companies Act, FEMA, STPI or SEZ (where relevant), FDI regulations and Digital Personal Data Protection Act, 2023 and the applicable Digital Personal Data Protection Rules, 2025 and state labour laws as the business starts operations and builds its workforce.

Getting these right from the first month of operations is significantly less expensive than retrofitting them twelve months in when a global client’s compliance team runs an audit.

What Legal Structure Should a Foreign Company Use for BPO Company Setup in India?

BPO company setup in India is most commonly done through a Private Limited Company incorporated as a Wholly Owned Subsidiary under the Companies Act 2013. 100% FDI is permitted under the Automatic Route for IT and ITeS activities including BPO, data processing, call centre operations, and back-office services subject to applicable sectoral laws, FEMA regulations and the Consolidated FDI Policy. No prior government approval is required. FC-GPR must be filed through the RBI FIRMS Portal (Single Master Form) within 30 days from the date of allotment of shares. The Private Limited Company structure works for BPO company setup in India because it provides limited liability, full operational flexibility, the ability to issue ESOPs for talent retention, and a clean framework for FEMA reporting and profit repatriation. An LLP cannot issue equity shares and is not the right vehicle for a business that may bring in additional investors or key employee equity participation. A Branch Office can only conduct permitted activities but all its liabilities trace back to the foreign parent, which creates unnecessary risk exposure for a business that processes client data at scale.

The MoA objects clause must be drafted to cover all anticipated BPO activities specifically. Generic “IT services” language is insufficient. The objects clause should cover data processing, voice and non-voice customer support services, back-office processing, knowledge process outsourcing, document management, and any sector-specific processes the company will handle for clients, such as financial data processing, healthcare claims processing, or legal support services. Although companies generally have broad objects, ensuring that anticipated business activities are covered helps avoid future amendments to the MoA and facilitates business expansion.

What Is STPI Registration and Does a BPO Company Need It?

STPI registration under the Software Technology Parks of India scheme is available to export-oriented BPO units and provides duty-free import of capital goods, facilitates certain export-related operational approvals and coordination with government agencies , SOFTEX certification for service exports, and a government-recognised framework that improves credibility with global clients. STPI registration does not provide an income tax holiday for new registrations since Section 10A was discontinued after 2011, but the operational benefits remain significant for export-focused BPO operations.

More than 5,921 units are currently registered under the STP scheme across 67  STPI centres pan-India. For a BPO company setup in India targeting 100% export revenue, STPI registration is worth obtaining not for tax reasons but for operational ones.

What STPI actually provides for a new BPO unit today:

• Duty-free imports: Capital goods including servers, workstations, networking equipment, and consumables for software export can be imported without customs duty under the STPI bond
• SOFTEX certification: STPI certifies SOFTEX forms which are the mandatory documentation for reporting software and service exports to RBI. SOFTEX certification is required for eligible software exports in accordance with RBI requirements and supports FEMA compliance. Single-window clearance: STPI coordinates with customs, the DGFT, and other agencies on behalf of registered units, reducing the multi-agency compliance burden
• NFE obligation: Registered units must maintain a positive Net Foreign Exchange position across their registration period. This means the value of service exports must exceed the value of duty-free imports made under the STPI bond

The STPI registration application requires: Certificate of Incorporation, PAN, GST registration, IEC (Import Export Code), premises proof, a project report describing the BPO activities and projected export revenue, and a Board Resolution. Most STPI centres process applications within 30 days when documentation is complete.

Should a BPO Company Setup in India Use STPI or SEZ?

For BPO company setup in India, STPI is the more practical choice for most new entrants and small to mid-scale operations. Eligible SEZ units may claim deduction on export profits under Section 10AA of the Income-tax Act, subject to satisfaction of the prescribed conditions.  (100% for five years, 50% for the next five, up to 50% for the subsequent five) but requires operating within a designated SEZ enclave, carrying higher compliance intensity through the Development Commissioner, and accepting operational restrictions that most BPO operators find constraining.

The STPI-SEZ comparison for BPO operations:

For a Japanese or UAE company setting up a captive BPO or shared services centre in India for the first time, STPI registration in the first two years and migration to SEZ if the scale justifies it is a common pattern. STPI and SEZ benefits are mutually exclusive. A unit cannot be registered under both simultaneously.

What Are the DPDPA Obligations That Directly Affect BPO Company Setup in India?

BPO units processing personal data of individuals on behalf of global clients face specific obligations under the Digital Personal Data Protection Act 2023 and the DPDP Rules 2025. The BPO operates as a Data Processor under the DPDP framework because it processes data on behalf of client Data Fiduciaries. The Rules impose contractual liability through the service agreement, one-year log and data retention requirements, security safeguard standards, and cross-border data transfer restrictions that directly affect BPO delivery models.

India’s BPO sector faces unique challenges as Data Processors for global clients including contractual liability for security safeguards under Rule 6(1)(f), one-year log and data retention requirements creating costs, cross-border data transfer restrictions impacting delivery models, client data processing instructions potentially conflicting with DPDP requirements, and workforce training and access controls.

The BPO-specific DPDPA obligations that must be built into operations from Day 1:

Contractual obligations: Every client master service agreement must now contain specific data processing clauses reflecting DPDPA obligations. The client, as Data Fiduciary, contractually imposes security safeguards on the BPO as Data Processor under Rule 6(1)(f). Global clients, particularly US and EU companies, are already building India-specific DPDPA clauses into their MSAs.

Log and data retention: DPDP Rules 2025 require one-year retention of security logs. For a BPO processing large volumes of personal data across multiple client systems, this creates storage and access management costs that were not in the original infrastructure budget.

GDPR and DPDPA simultaneously: Indian BPO operators processing EU citizen data through their Indian operations are simultaneously subject to GDPR (as sub-processors) and DPDPA (as entities operating in India). The two frameworks do not align perfectly, and the compliance programme must address both without treating one as a substitute for the other.

Sector-specific overlays: BPO units handling US healthcare data must comply with HIPAA. Those processing financial data for UK clients must address FCA expectations. Those supporting insurance processes must comply with applicable insurance data regulations. These sector overlays sit on top of DPDPA, not instead of it.

What Are the GST Obligations for an Export-Oriented BPO Company Setup in India?

BPO services supplied to foreign clients are generally treated as exports under the IGST Act, 2017 and qualify for zero-rated GST treatment if the statutory conditions are satisfied. To invoice exports without charging GST, An LUT should be furnished before making zero-rated exports without payment of IGST and must be renewed each financial year. GST on import of services is the reverse-charge obligation that catches most new BPO setups. When the Indian BPO entity receives services from its foreign parent, whether technology platforms, management support, shared infrastructure, or software licences, those inward services attract 18% GST under the reverse charge mechanism. The Indian entity pays 18% GST to the government and can claim it as input tax credit if it is making zero-rated or taxable outward supplies. For purely export-focused BPO operations, the input tax credit accumulates and must be claimed as a cash refund, which adds a cash flow management dimension to the compliance programme.

The RBI purpose codes for BPO service exports are specific and must be used correctly at the bank level. P0802 covers software consultancy and implementation. P0803 covers other software services and BPO. Incorrect purpose codes may lead to FEMA documentation issues and banking queries. .

What Labour Law Obligations Activate When a BPO Hires in India?

BPO company setup in India with a growing headcount triggers a cascade of labour law obligations. EPF registration is mandatory within one month of reaching twenty employees. ESI registration is mandatory at ten employees. Professional Tax registration is required in each state where employees are located. The four new Labour Codes, operative from November 21, 2025, consolidate twenty-nine predecessor statutes and now govern the entire employment relationship from wages to social security to working conditions.

The four Labour Codes that now govern the employment framework for a BPO:

• Code on Wages 2019: Minimum wage, overtime, payment timelines. All wages must be paid by the 7th of the following month.
• Industrial Relations Code 2020: Termination, retrenchment, and dispute resolution. At-will employment does not exist in India.
• Social Security Code 2020: EPF at 12% employer contribution, ESI at 3.25%, gratuity after five years of service.
• Occupational Safety, Health and Working Conditions Code 2020: Working hours (nine hours per day, forty-eight per week), night shift permissions for women (now explicitly permitted in IT and ITeS establishments), and health and safety standards.

For a BPO operating night shifts to serve US or European client time zones, the women workers night shift permission under the OHS Code is directly relevant. The Code permits women to work night shifts in IT and ITeS establishments where adequate safety measures including transport, security, and a separate rest room are in place.

The contract labour angle is the one that most BPO operators underestimate initially. A BPO using a staffing vendor to onboard large batches of agents quickly needs to comply with the Contract Labour (Regulation and Abolition) Act provisions under the OHS Code. If the establishment crosses twenty contract workers at any point, the BPO as principal employer has registration, welfare amenity, and wage default liability obligations for those workers even though they are on the vendor’s payroll.

What Client Contract Obligations Must Be Built Into a BPO Company Setup in India?

Every client master service agreement for a BPO company setup in India must address data processing under DPDPA, confidentiality with India-specific trade secrets protection (India has no standalone trade secrets law, so the contractual clause carries the entire burden), dispute resolution through arbitration rather than litigation given Indian commercial court timelines, limitation of liability, and intellectual property ownership of output created during service delivery.

The IP ownership clause is the one most often inadequately drafted. When a BPO’s Indian employees create processes, tools, or insights in the course of delivering services to a client, the default position under Indian law is that IP created by an employee belongs to the employer company unless the employment contract and the client agreement both address ownership. A client who assumes that all output IP flows to them automatically does not have that right unless the BPO’s employment contracts include an IP assignment clause and the MSA includes a work-for-hire or IP assignment provision to the client.

Limitation of liability clauses in Indian commercial contracts are enforceable, but the Consumer Protection Act 2019 can override them where a service deficiency claim is framed as a consumer protection matter. For B2B BPO services to large corporate clients, this is unlikely to be the route a dissatisfied client takes. For BPOs providing services to SME clients who might qualify as consumers, it is worth considering.

The governing law and dispute resolution clause should specify institutional arbitration for most BPO MSAs. Indian commercial litigation takes three to seven years even in dedicated Commercial Courts. Parties may choose institutional arbitration (such as SIAC, ICC, MCIA or other recognised institutions) depending on the commercial arrangement.

Conclusion

BPO company setup in India requires coordinating five parallel tracks from the first month: MCA incorporation and FEMA compliance for the investment, STPI or SEZ registration for the export framework, DPDPA compliance building into the operational infrastructure, GST registration and, where applicable, furnishing an LUT before making zero-rated exports without payment of IGST , and labour law registrations as soon as the headcount triggers the applicable thresholds.

The BPO registration compliance in India framework has not become simpler over the past two years. The Digital Personal Data Protection Act, 2023, read with the DPDP Rules, 2025, introduced a comprehensive data governance framework . The Labour Codes consolidated multiple labour laws into a unified framework governing wages, industrial relations, social security and occupational safety . SOFTEX form requirements and NFE obligations for STPI units run continuously throughout operations.

What has not changed is the fundamental commercial logic: India’s talent pool, cost structure, English language capability, and time zone coverage make it the most viable large-scale BPO destination globally. The outsourcing company FDI India route is clean, the Automatic Route covers the sector completely, and the operational infrastructure in Bengaluru, Hyderabad, Chennai, Pune, and NCR supports BPO operations at any scale.

Corporate Legit Consulting LLP advises foreign companies on BPO company setup in India, covering MCA incorporation, FEMA compliance, STPI registration and SOFTEX filing, SEZ evaluation, DPDPA operational compliance, GST LUT filing, labour law registration, and client MSA structuring for Indian BPO operations. Reach out to Corporate Legit before the first employee is hired.