Using Indian Tech and AI Teams on UK Client Data: Contracts and Safeguards

India is where much of the world’s software, data and AI work gets done, and UK businesses increasingly rely on Indian teams for development, data labelling, model fine-tuning, analytics and support. When those teams work on UK client data, every data protection and confidentiality obligation travels with it.

This guide explains offshore data processing in India from a UK business’s point of view: the UK GDPR transfer rules after the Data (Use and Access) Act 2025, how India’s own law applies to UK data processed in India, the specific risks of AI work, and the contract and security safeguards that matter. The UK GDPR points should be reviewed by a UK data protection solicitor. For the legal-sector view, see our guide to UK GDPR transfers to India.

The UK side: restricted transfers after the DUAA

Sending personal data to an Indian team, or letting that team access it remotely, is usually a restricted transfer under UK GDPR. The ICO’s own example describes a UK business contracting with an IT support company in India whose staff access UK-held personal data through a VPN, treating that as a restricted transfer the moment the data becomes accessible; see the ICO’s guidance on international transfers.

Since 5 February 2026, the Data (Use and Access) Act 2025 has applied a new “data protection test”: protection in the destination must be “not materially lower” than under UK law. The Act also codifies the requirement to carry out a transfer risk assessment where appropriate safeguards are relied on.

For most offshore data processing in India, the transfer mechanism will be the ICO’s International Data Transfer Agreement or the EU Standard Contractual Clauses with the UK Addendum, together with Article 28 processing terms where the Indian provider acts as your processor.

The Indian side: what law applies to UK data in India

India’s Digital Personal Data Protection Act, 2023 includes an exemption designed for the outsourcing industry. Section 17(1)(d) exempts processing in India of personal data of people outside India where it’s carried out under a contract with a person outside India. That means most DPDP obligations, such as notice, consent and data subject rights, don’t apply to your UK customers’ data processed by an Indian provider. Confirm the exact list of provisions that still apply.

The exemption isn’t total. The Indian provider’s duty to protect the data with reasonable security safeguards continues to apply. Other Indian laws apply too: CERT-In’s 2022 directions require organisations in India to report specified cyber incidents within six hours and keep system logs for 180 days (see our guide to the CERT-In 6-hour rule), and the Information Technology Act, 2000 penalises unauthorised access and data theft.

For your transfer risk assessment, this combination, contractual protections, statutory security obligations in India, and practical access controls, is usually the basis for concluding that the data protection test is met for routine offshore data processing. If your own business also serves Indian customers, India’s law applies directly; see our guides to India’s DPDP Act for UK businesses and selling SaaS to Indian customers from the UK.

AI-specific risks in offshore data processing

AI work raises risks that traditional outsourcing doesn’t. Data used to fine-tune models can become embedded in model weights. Labelling and evaluation expose raw data to many people. And AI teams often use third-party tools and APIs, each of which is another place your data could go; see our guide to AI tools at work and confidentiality.

Model ownership deserves attention too. If an Indian team fine-tunes a model on your data, the contract should say who owns the resulting weights, prompts, datasets and evaluation results, and whether the provider may reuse any of them. Address these directly. Decide whether client data may be used to train or fine-tune models at all, and under what conditions. Check your own client contracts, because many UK enterprise clients prohibit using their data for training or require approval of subprocessors and offshore locations. Minimise and pseudonymise data before it’s shared, restrict which AI tools the team may use, require that tools don’t retain or train on your data, and keep models trained on one client’s data separate from others.

Plan for the end of each project: how datasets, intermediate files and fine-tuned models will be deleted or returned, and how you’ll verify it. These points belong in the contract, not just in a project plan.

Contract and security safeguards

The contract with your Indian team or vendor is the backbone of compliant offshore data processing. It should define the data in scope and the permitted purposes, prohibit other uses including model training unless expressly allowed, require specific security controls, set breach notification timelines short enough for you to meet the ICO’s 72-hour deadline, restrict subcontracting, give you audit rights, and require deletion or return at the end.

Choose governing law and dispute resolution you can actually use. Contracts governed by English law with arbitration or the English courts are common. Both are workable in India: India enforces arbitral awards from New York Convention countries, and the United Kingdom is a reciprocating territory under Section 44A of India’s Code of Civil Procedure, which allows certain UK superior court judgments to be executed in India. Confirm that the UK remains on the Section 44A list when you draft.

Staff changes are a further risk in offshore data processing: make sure access is removed promptly when team members leave the project or the provider, and that leavers are reminded of their continuing confidentiality obligations. Public sector and regulated clients in the UK may impose extra conditions on offshore data processing, such as security clearance, data residency or prior approval of specific locations, so check those requirements before any data moves. On security, certifications such as ISO 27001 and SOC 2 reports provide useful assurance, but check how your specific project is set up. Many UK businesses prefer to keep data in their own UK-hosted environment and give the Indian team controlled access, so data never leaves infrastructure they control. Individual confidentiality undertakings, multi-factor authentication, role-based access and logging complete the picture. The US version of this guide is Indian AI teams and US client data.

Incidents, remedies and quick answers

If a breach or misuse occurs, act on both sides. In India, the provider must report qualifying incidents to CERT-In within six hours, unauthorised access and data theft can be prosecuted under the IT Act, and you can seek urgent injunctions in Indian courts to stop further use or disclosure. Under the contract, you can claim damages, invoke indemnities and terminate. In the UK, you’ll need to assess whether to notify the ICO within 72 hours and inform affected individuals and clients. Because the timelines are short, decide in advance who does what, and test the plan; see our guide to ransomware and cyber insurance.

Quick answers

Is offshore data processing in India allowed under UK GDPR?

Yes, with a valid transfer mechanism such as the IDTA, a transfer risk assessment and appropriate security.

Does India’s DPDP Act apply to UK customer data processed in India?

Mostly not, due to the Section 17(1)(d) exemption, but the provider must still keep the data secure.

Can UK court judgments be enforced against an Indian provider?

Often, yes. The UK is a reciprocating territory under Section 44A of India’s Code of Civil Procedure, and arbitral awards are also enforceable.

Related reading: Indian scam call centres and UK victims; also who owns the AI model: IP for UK startups building in India; also outsourcing to India under UK GDPR: five clauses.

Final word

Halverton & Co. is an Indian law firm that advises on Indian law, including data processing contracts, DPDP and IT Act compliance, and confidentiality for offshore technology and AI teams. We practise in Jharkhand, Maharashtra and before the Supreme Court of India, and we work alongside your UK solicitors, who advise on English law. Halverton & Co.: Where tech needs law! If you have a question about Indian law, write to us at office@halvertonandco.com, or get in touch.

This article reflects developments reported up to early October 2026. It is for general information only, is not legal advice, and does not create a solicitor-client relationship. Halverton & Co. is an Indian law firm, is not authorised or regulated by the Solicitors Regulation Authority, and does not advise on English law or UK tax.