Most conversations about global capability centers still assume enterprise scale by default, broad functional coverage, deep management layers, multi-year build timelines. We think that assumption is already out of date. India now hosts over 2,100 capability centers, with more than 100 added last year, and a growing share of that number belongs to companies nowhere near enterprise size.

Amit Dhandal, Co-founder and Director at IncubXperts, spoke about this shift in a recent interview featured as part of the D&B GCC Summit coverage. He touched on the talent market tightening, on centers reaching operating maturity faster than they used to, and on why the right center design has to start from the business mandate rather than a template. Those points are worth reading in full, and we'd point you to the interview itself for them.

What we want to spend more time on here is the point we think gets underweighted most often: governance.

Governance isn't a phase. It's a design constraint from day one.

Amit named data security, compliance, and regulatory requirements as the area where first-time builders get caught off guard. In our experience, that's an understatement of how consequential it actually is.

Most companies still treat governance as something to sort out once the center is running, a legal and IT workstream that trails behind the real build. That sequencing is backwards, and India's regulatory environment no longer tolerates it well. The Digital Personal Data Protection Act 2023 layers sector-specific obligations on top of existing rules, and depending on what a center actually does, payment data handling, cross-border transfer restrictions, and tax exposure can each pull in a different direction. None of that is exotic information. It's publicly available. What's missing, more often, is the discipline to build it into the operating model before the center scales, rather than retrofit it afterward.

Our own view is that governance should function as an architectural constraint, the same way a mandate or a target operating model does. Data classification, access controls, retention policy, incident response, these aren't compliance checkboxes to clear before launch. They shape how the center should be structured from the outset. A company that treats them that way avoids most of the expensive corrections we see later-stage centers having to make, the kind that come from bolting governance onto a structure that was never built to accommodate it.

This is also where company size stops being a shortcut. A hundred-person software company setting up its first center doesn't get a lighter version of these obligations just because it's smaller. It gets the same regulatory exposure with less internal infrastructure to absorb it, which is exactly why we think this deserves more attention earlier in the process than it typically gets.

Where we land on this

The center that fits a growing company was never going to look like a scaled-down version of one built for a multinational, and governance is usually where that mismatch becomes visible first. It's also the one variable that's genuinely cheap to get right early and expensive to fix later.

If you'd like to explore Amit's full conversation, including his view on talent timing and why there's no universal model for GCC design, you can read the full interview here (PDF). And if this is a conversation you're already having internally, our GCC services for SMB and mid-market organizations walk through how we approach it end to end.