Can I license data from India?

Explanation#

Implementation rules under the DPDP Act continue to roll out.

De-identified operational records reduce, but do not remove, obligations.

Rights and privacy#

• 1Confirm customer, vendor and employee agreements allow the use
• 2Remove or de-identify personal details before anything leaves the company
• 3Approve the final dataset and permitted uses in writing

How licensing works#

A business describes its data, buyer demand is assessed, scope and permitted use are proposed, the data is prepared and de-identified, an agreement is signed, and the approved dataset is delivered. See data licensing for detail.

Who holds the rights in records an Indian IT services firm or GCC creates?#

Usually the client or the parent company, not the Indian team that holds the records. In an IT services or BPO engagement, the master services agreement and statements of work normally say who owns client data and deliverables. In a global capability centre, the intercompany services agreement plays the same role, and the records usually belong to the parent's business.

Having system access, storing the data in India or doing the work does not by itself give anyone the right to license it. The useful first step is to sort records by who they were created for, then read the agreement that governs each group.

How does the DPDP Act apply to client records handled in India?#

For an IT services firm or capability centre, the Act's hook is where the processing happens: section 3 applies to the processing of digital personal data within India, so digital records about identifiable people that are handled in India can fall within it. Section 3 also carves out some categories, and section 17 lists exemptions; whether any of them fits a given client engagement is a question for counsel.

Two provisions matter most for licensing. The legitimate use in section 7(a) covers only the specified purpose for which a person voluntarily gave the data, so a new use such as AI training generally needs its own basis. Section 16(1) lets the central government restrict transfers to countries or territories outside India that it notifies. The DPDP Rules, 2025 were notified in November 2025 with an 18-month phased compliance timeline (checked 13 October 2026).

Client records may also carry the client's home-country law through the data processing agreement. Where several laws apply, the stricter terms usually set the limit in practice.

What should the contract review check before India-held records are offered?#

Read the contracts before anyone discusses a dataset. These checks usually settle whether there is anything to offer:

SourceX can consider companies in India when the data they offer is at least 90% English, confirmed on the actual dataset; every dataset still goes through rights, privacy, quality and buyer-fit review.

• 1Ownership clause: who owns client data, deliverables and anything derived from them.
• 2Use restriction: whether the agreement limits processing to the services, which usually rules out any other use.
• 3Derived and aggregated data: whether anonymized or aggregated outputs are excluded from client ownership, and on what conditions.
• 4Intercompany terms for a GCC: which entity owns records and who may approve a new use.
• 5Workforce notice: whether staff were told their work records could be used beyond managing employment.
• 6Transfer terms: data residency or onshore-only commitments in client contracts and any government transfer restriction.
• 7Written permission: if the client owns the records, a signed approval naming the use, the buyer type and the scope.