Moonlighting and Conflict of Interest in Indian GCCs: The HR Governance Problem Companies Cannot Ignore

Moonlighting is no longer a casual HR issue.

For Indian Global Capability Centres, it has become a serious governance question.

A GCC employee may work on sensitive technology systems, source code, customer support processes, payroll data, internal finance records, legal operations, HR analytics, cyber security, procurement, research, or product development. If the same employee takes up outside work without disclosure, the problem is not limited to whether the employee is working extra hours.

The real issue is conflict of interest.

Could confidential information be exposed?
Could client data be misused?
Could intellectual property be compromised?
Could the employee's productivity or availability suffer?
Could the employee be working for a competitor, vendor, customer, or related business?
Could the GCC face legal, cyber, contractual, or reputational consequences?

For GCCs, moonlighting should therefore be treated as a workforce governance issue, not merely as a matter of employee discipline.

Why the moonlighting issue matters more in GCCs

GCCs are not ordinary workplaces. They are deeply integrated with global businesses. Indian employees may support overseas parent companies, group entities, clients, products, platforms, compliance systems, and shared services.

This creates two specific risks.

First, employees may have access to sensitive information far beyond their immediate job title. A mid-level employee may have access to global customer data, internal dashboards, confidential technical documents, financial reports, legal templates, product roadmaps, or access credentials.

Second, GCC employees often work in hybrid or remote settings. Remote work has improved flexibility, but it has also made it easier for undisclosed outside work to go unnoticed. The concern is not every side activity. The concern is undisclosed work that conflicts with the employer's business, uses employer resources, affects work performance, or creates legal exposure.

EY has noted that moonlighting in India's technology sector exposes companies to strategic, operational, financial, and compliance risks, and that companies need clear policies, internal controls, and sanction frameworks.

That is exactly where GCCs need to focus.

The legal position is not simple

There is often a mistaken assumption that moonlighting is either completely illegal or completely permitted. The legal position is more nuanced.

Indian law does contain restrictions on double employment in specific contexts. For example, Section 60 of the Factories Act, 1948 states that no adult worker shall be required or allowed to work in any factory on a day on which the worker has already been working in another factory, except in prescribed circumstances.

However, this does not automatically answer the question for all GCC employees, especially those in IT, services, corporate functions, or white-collar roles. The legal analysis often depends on the employment contract, standing orders where applicable, company policies, nature of work, confidentiality obligations, conflict of interest rules, and facts of the case.

The Model Standing Orders also recognise the concept of exclusive service in certain industrial employment contexts. But for many modern GCC roles, the practical control point is still the employment contract and internal policy framework.

This is why GCCs should avoid vague statements such as "moonlighting is illegal" or "dual employment is always allowed". Both positions are too broad.

The better approach is to define what is prohibited, what requires disclosure, and what may be permitted.

Not every outside activity is misconduct

A balanced policy should distinguish between different kinds of outside activity.

For example, an employee teaching a weekend course, writing a book, volunteering, mentoring startups, speaking at events, or doing occasional non-conflicting freelance work may not create the same risk as working secretly for a competitor or vendor.

The real risk arises when outside work:

1. Conflicts with the employee's current role
2. Competes with the employer's business
3. Uses company resources or devices
4. Uses confidential information
5. Affects availability or productivity
6. Breaches client obligations
7. Creates data security exposure
8. Violates working-hour, exclusivity, or disclosure obligations
9. Involves a vendor, customer, competitor, or group company conflict

GCCs should not use one broad rule for every situation. A policy that treats all outside activity as misconduct may be difficult to administer fairly. A policy that permits everything silently is equally risky.

The right model is controlled disclosure.

The contract should speak clearly

Many employment contracts contain broad language on full-time employment, exclusivity, confidentiality, non-solicitation, IP ownership, and conflict of interest. But these clauses are often copied from templates and not connected to actual GCC risks.

A GCC employment contract should clearly state:

1. Whether the role is full-time and exclusive
2. Whether outside work requires prior written approval
3. What kinds of outside work are prohibited
4. What must be disclosed
5. What counts as conflict of interest
6. Whether company assets, devices, software, data, or time can be used for outside work
7. What continuing confidentiality obligations apply
8. What disciplinary consequences may follow

The policy must also be practical. Employees should understand what they can and cannot do. HR should not need to interpret vague clauses each time an issue arises.

Confidentiality and data security are central

For GCCs, the strongest reason to regulate moonlighting is not moral judgment. It is confidentiality and data security.

An employee working for another entity may consciously or unconsciously carry information from one workplace to another. In technology, consulting, finance, legal operations, HR, and data roles, even general knowledge can be commercially sensitive.

This is especially important where the employee has access to:

1. Source code
2. Product roadmaps
3. Client data
4. Pricing information
5. Internal process documents
6. Cyber security protocols
7. HR data
8. Payroll information
9. Legal records
10. Vendor negotiations
11. Customer support systems
12. AI models or training datasets

The GCC's response should therefore combine HR policy with IT controls. Contracts alone are not enough. There should be access management, device control, role-based permissions, data loss prevention, logging, exit checks, and clear reporting channels.

HR should not investigate casually

When moonlighting is suspected, GCCs must be careful. A rushed or poorly documented investigation can create employment disputes.