GCC 50 - Privacy Policy

Effective Date: August 2026

1. INTRODUCTION

GCC 50 ("Programme") is India's Most Admired Capability Centres assessment, a joint initiative of Fortune India and ANSR in equal partnership. This Privacy Policy explains how we collect, use, protect, and handle personal and organizational data submitted by participating Global Capability Centres ("Participants") during the assessment process.

The Programme is committed to protecting the privacy and confidentiality of all data submitted. Participant information will be used solely for purposes connected with the administration, assessment, benchmarking, recognition and operation of the Programme. Access to participant information is restricted to authorised personnel, evaluators, jury members and service providers involved in administering and supporting the Programme, each of whom is subject to appropriate confidentiality obligations. Participant information will not be used for unrelated consulting, marketing, sales or commercial activities without the participant's consent, except as otherwise required by law.

2. DATA COLLECTION

2.1 What Data We Collect

During the GCC 50 assessment, Participants may submit the following categories of data ("Personal Data" and "Organizational Data"):

  • Organizational Data: Strategic plans, business cases, governance frameworks, organizational charts, operational metrics, financial data, performance dashboards, innovation portfolios, transformation case studies.
  • Personnel Data: Names, titles, credentials, experience levels, certifications of leadership team members (as found in org charts and capability matrices).
  • Engagement & Culture Data: Anonymized employee engagement survey results, retention rates, diversity metrics, eNPS scores (aggregated, non-identifying).
  • Assessment Responses: Your responses to the 30 GCC 50 assessment statements and supporting evidence.
  • Contact Information: Names, emails, phone numbers of primary contacts for the assessment process.

2.2 Purpose of Data Collection

We collect this data solely for the following purposes:

  • To evaluate your centre's performance against the 6 GCC 50 dimensions
  • To validate evidence supporting your assessment ratings of 4 or 5
  • To calculate your scores and determine your ranking
  • To provide you with a detailed benchmarking report
  • To publish anonymized aggregate findings about the GCC 50 cohort
CRITICAL COMMITMENT: We will NOT use your data for any other purpose without your explicit written consent. Your assessment data is strictly confidential and maintained separate from ANSR's consulting and commercial operations.

3. DATA ACCESS & RESTRICTED USE

3.1 Who Has Access to Assessment Data

Your assessment data may be accessed ONLY by the following persons to the extent necessary for Programme related purposes and subject to confidentiality obligations:

  • Independent Evaluation Jury: A panel of independent experts (recruited specifically for GCC 50 assessment) who review evidence and validate ratings. Jury members sign strict NDAs prohibiting use of data for any consulting or commercial purpose.
  • GCC 50 Data Stewardship Team: Limited personnel at GCC 50 (jointly managed by Fortune India and ANSR) responsible for secure data storage, portal administration, and technical security only. These team members have access only to data required for their specific security and compliance function.
  • Authorised personnel of ANSR and Fortune India involved in Programme administration, participant communications, governance, legal compliance, technology support, editorial development and event management.
  • Approved third-party service providers engaged to support operation of the Programme

3.2 The Firewall: Who Absolutely Does NOT Have Access

GCC 50 Assessment data is maintained under a strict firewall. The following parties—including all ANSR commercial operations—do NOT have access to individual centre assessment data:

  • ANSR Commercial/Consulting Operations: ANSR's consulting, advisory, sales, and business development teams are not authorized to access participant assessment information except where such access is required for Programme administration and is subject to appropriate confidentiality controls and approvals.. This firewall ensures that confidential strategic information cannot be used in ANSR's consulting work with other clients.
  • ANSR Leadership (Outside Assessment): ANSR executives and business leaders (outside the GCC 50 assessment management team) do not access participant data.
  • Data from all other participants will be shared only in anonymized, aggregate form. Fortune India’s commercial team will not have access to individual centre-level data.
  • Other Participating Centres: No centre can see another centre's data, scores, or evidence.
  • Competitors or Market Researchers: Your data is never sold, shared, or licensed to any third party.
  • Government or Regulatory Bodies: Your data is not shared with authorities except where legally compelled by court order.
3.3 Fortune India Editorial use and Publication

Fortune India’s editorial team may use information relating to recognised GCC 50 participants for the preparation of rankings, profiles, interviews, articles and other Programme-related editorial content. Confidential assessment submissions and supporting evidence shall not be published without the participant's prior approval. Editorial content may be based on publicly available information, participant-approved materials, interviews and information separately approved for publication by the participant

FIREWALL ASSURANCE: GCC 50 maintains organisational, contractual and technical safeguards designed to ensure that participant information is used only for Programme-related purposes and that access is restricted on a need-to-know basis.

4. DATA SECURITY

4.1 Security Measures

GCC 50 implements industry-standard security controls to protect your data:

  • Encryption in Transit: All data transmitted to our secure servers is encrypted using TLS 1.2 or higher (256-bit encryption).
  • Encryption at Rest:Participant information is protected through commercially reasonable administrative, technical and organisational safeguards designed to prevent unauthorised access, disclosure, alteration or loss.
  • Access Control & Logging: Only authorized personnel with specific need-to-know can access your data. All access is logged, monitored, and regularly audited.
  • Firewalls & Intrusion Detection: Multi-layered security with firewalls, intrusion prevention, and real-time monitoring.
  • Multi-Factor Authentication: All personnel accessing data must use multi-factor authentication (MFA).
  • Regular Backups: Appropriate business continuity and data recovery processes are maintained consistent with industry practice.
  • Third-Party Security Audits: Regular security audits by independent third-party firms to ensure compliance.
4.2 Data Breach Notification

In the event of a material security incident affecting participant information, GCC 50 will provide notification without undue delay and in accordance with applicable law. . Our notification will include: (a) description of the breach, (b) types of data affected, (c) steps you should take to protect yourself, (d) actions we are taking to remediate, and (e) contact information for questions.

5. DATA RETENTION & DELETION

5.1 Retention Period

GCC 50 retains your assessment data and evidence for the following periods:

  • Assessment Data (Ratings & Responses): Retained for 2 years after the assessment window closes (until October 10, 2028). After 2 years, data is securely destroyed.
  • Evidence Documentation: Retained for 18 months after ranking announcement (until May 1, 2028). After 18 months, evidence is securely destroyed.
  • Benchmarking Report: Your individual benchmarking report is retained indefinitely for your own records, but GCC 50 will delete our copy 18 months after the assessment closes.
  • Anonymized Data: Aggregate, anonymized findings used for research and publication are retained indefinitely, but cannot identify your centre.
5.2 Secure Destruction

When data reaches the end of its retention period, it is securely destroyed using approved data destruction methods (cryptographic erasure or physical destruction of storage media). Destruction is certified and documented.

6. YOUR DATA RIGHTS

6.1 Right to Access

You have the right to access and review all your submitted data and evidence. To request access, email [privacy_contact_email] with your centre name and contact person. GCC 50 will provide access within 14 days.

6.2 Right to Rectification

If you discover inaccuracies in your submitted data, you may request correction. For assessment data, corrections are accepted until October 10, 2026. For evidence, you may replace or update evidence until the same deadline.

6.3 Right to Object

You may object to the processing of your data for specific purposes. However, objection to core assessment processing may result in your withdrawal from the Programme. Contact [privacy_contact_email] to discuss.

6.4 Right to Data Portability

You have the right to request a copy of your data in a portable, machine-readable format (CSV, PDF). GCC 50 will provide this within 21 days of request.

6.5 Right to Withdraw

You may withdraw from the Programme and request deletion of your data before October 10, 2026. After submission, withdrawal requests will be honored, but your assessment will not be scored. Email [privacy_contact_email] to withdraw.

7. CONFIDENTIALITY AGREEMENTS

7.1 Jury Confidentiality

All jury members sign a strict Confidentiality and Non-Disclosure Agreement (NDA) before accessing any data. This NDA includes:

  • Prohibition on sharing or discussing individual centre data outside the evaluation process
  • appropriate contractual, legal and equitable remedies
  • Lifetime confidentiality obligations (continuing even after the jury member leaves)
  • Explicit prohibition on using assessment data for any consulting, advisory, or commercial engagement
  • Audit rights to ensure compliance
7.2 GCC 50 Staff Confidentiality

All GCC 50 personnel (from both Fortune India and ANSR) with access to assessment data are required to sign confidentiality clauses. Violations result in immediate termination and potential legal action. Specifically, ANSR staff members working on GCC 50 are contractually prohibited from discussing, sharing, or using assessment data in any commercial context.

7.3 Conflict Management

GCC 50 shall implement reasonable measures to identify, manage and mitigate actual, potential or perceived conflicts of interest involving jury members, evaluators and programme personnel. Individuals with identified conflicts may be recused from reviewing relevant submissions.

Participant information may be accessed by authorised jury members, evaluators, advisers or service providers located outside India, subject to appropriate confidentiality and security safeguards and applicable laws.

8. THE FIREWALL: ORGANIZATIONAL SEPARATION

GCC 50 maintains strict organizational separation between:

  • Assessment Operations: Teams managing assessment administration, jury coordination, data security, and results validation.
  • ANSR Consulting Operations: ANSR's consulting, advisory, and commercial teams serving other clients.
GCC 50 maintains organisational, contractual and technical controls designed to ensure that participant information is accessed only by authorised persons for Programme-related purposes. Participant information will not be used for unrelated consulting, marketing, sales or commercial activities without the participant's consent, except where required by law.

FIREWALL COMMITMENT: Your assessment data will NEVER be used in ANSR consulting engagements, shared with ANSR clients, or leveraged for ANSR commercial advantage. The firewall is absolute.

9. REDACTION & ANONYMIZATION

9.1 Your Right to Redact

Before submitting evidence, you may redact or mask sensitive information such as:

  • Employee salaries or compensation
  • Specific client or customer names
  • Proprietary product names or technical secrets
  • Personal identification numbers (PAN, Aadhaar, etc.)
  • Personal contact information of individual employees
  • Sensitive financial data (exact revenue figures, profit margins)
Redacted information does not reduce the credibility of your evidence—we understand confidentiality constraints.

9.2 Anonymized Findings

When GCC 50 publishes aggregate insights, all data is anonymized and aggregated. No individual centre can be identified. Example: "50% of GCC 50 centres report 80%+ automation in core processes" (no centre identified).

10. LEGAL COMPLIANCE

10.1 Governing Law

This Privacy Policy is governed by the laws of India. All data handling complies with:

  • Information Technology Act, 2000 and Rules thereunder
  • Digital Personal Data Protection Act, 2023 (or applicable data protection laws)
  • Industry best practices and international standards (ISO 27001, SOC 2 Type II)

10.2 Legal Disclosure

GCC 50 may disclose your data only if required by law (court order, government warrant, regulatory demand). In such cases, GCC 50 will provide you with notice as soon as legally permissible, unless prohibited by law.

11. CONTACT & GRIEVANCE REDRESSAL

11.1 Privacy Officer

For privacy concerns, data access requests, or complaints (including firewall violations), contact:

Data Privacy Officer
GCC 50
Email: [privacy_contact_email]
Phone: [privacy_contact_phone]
Response time: Within 14 days

11.2 Escalation

If your concern is not resolved within 30 days, you may escalate to GCC 50's Privacy Committee or file a complaint with the competent data protection authority under applicable law.

12. CHANGES TO THIS POLICY

GCC 50 may update this Privacy Policy from time to time. Significant changes will be communicated to you via email. Continued participation after changes means acceptance of the updated Policy. However, the firewall protections outlined in Section 8 will not be weakened without explicit consent from participants.