As Indian businesses become increasingly dependent on external technology providers, a fundamental question is emerging: can operational responsibility be delegated without diminishing corporate accountability?
A few years ago, a leading Indian airline found itself confronting a significant data security incident involving millions of passenger records. The breach had not originated within the airline’s own systems. It occurred through an international technology service provider entrusted with processing and storing passenger information.
Personal details, including travel records and identity information, were potentially exposed. The episode illustrated an uncomfortable reality of modern enterprise operations. An organisation may have limited direct control over the infrastructure on which it depends, yet remain exposed to the commercial and reputational consequences when that infrastructure fails.
For corporate India, this is becoming a defining challenge in enterprise risk management.
The expanding perimeter of corporate risk
Outsourcing has transformed the economics of business.
Banks depend on technology partners for digital infrastructure. Insurers rely on external administrators, intermediaries and service providers. Manufacturers increasingly integrate cloud platforms, connected machinery and industrial software into their operations.
The commercial rationale is compelling. Specialist providers deliver expertise, scalability and efficiencies that would often be prohibitively expensive to develop internally. But every external dependency also creates a potential point of vulnerability.
Consider the airline incident. Its reliance on a globally established technology provider was neither unusual nor commercially unreasonable. Yet a compromise within shared infrastructure exposed information belonging to customers of multiple airlines.
The consequences extended beyond the organisation where the breach originated. Such incidents challenge the traditional understanding of corporate risk boundaries. Increasingly, the enterprise’s exposure is determined not simply by the systems it owns, but by the ecosystem on which it relies.
When the vulnerability lies elsewhere
A comparable concern emerged when a prominent Indian digital brokerage disclosed a suspected compromise involving customer information maintained through third-party data infrastructure. The incident raised concerns about the potential exposure of sensitive customer records, including identity and verification documentation. The brokerage subsequently strengthened security measures and reassured customers about the protection of their financial assets.
The broader lesson was significant.
An organisation may maintain robust safeguards around its core transaction systems while remaining vulnerable through external repositories containing sensitive information.
For financial institutions, this distinction matters considerably.Customer trust is built not merely on the security of funds and transactions, but on the expectation that personal and financial information will remain protected throughout the service delivery chain.
The effective risk perimeter therefore extends well beyond the corporate network. It includes every external organisation authorised to access, process, retain or transmit critical information.
The accountability gap
Third-party risk management has traditionally relied on contractual protections, vendor due diligence, compliance certifications and periodic audits. These mechanisms remain essential. Their limitations, however, are becoming increasingly apparent.
A service provider may satisfy every contractual requirement at the time of appointment, yet subsequently introduce subcontractors, alter infrastructure or develop vulnerabilities that remain undetected between assessments. Cloud computing, interconnected platforms and artificial intelligence add further complexity.
An enterprise deploying an AI-enabled customer service platform, for example, may depend on separate providers for software, computing infrastructure, language models and data processing. If sensitive information is compromised, establishing the source of failure can become a complicated exercise involving multiple organisations and jurisdictions.
Contractual liability may determine who ultimately bears certain financial consequences. It does not necessarily restore customer confidence, reverse operational disruption or eliminate regulatory exposure. This creates a distinction between the management of vendor relationships and the management of enterprise dependencies.
The former is largely procedural. The latter is fundamentally strategic.
From procurement to the boardroom
India’s evolving data protection framework reinforces the importance of this distinction. The Digital Personal Data Protection Act, 2023, establishes a framework under which data fiduciaries retain responsibility for personal data processing undertaken on their behalf, subject to the applicable provisions and their commencement.
The principle has wider implications for corporate governance.
Third-party exposure is not confined to privacy or cybersecurity. A disruption affecting a logistics provider can interrupt manufacturing deliveries. A cloud infrastructure failure can impair banking operations. A compromised industrial software supplier can threaten production continuity.
These are enterprise risks arising through external relationships. Their oversight therefore requires coordination between procurement, information security, compliance, legal, operational leadership and enterprise risk management. For chief risk officers, the challenge is to distinguish routine supplier relationships from dependencies whose failure could materially affect the organisation.
A conventional vendor register may establish who provides a service. It does not necessarily reveal how dependent the business has become on that provider.
The next frontier of enterprise resilience
The answer is unlikely to lie in reducing outsourcing. External partnerships remain essential to competitiveness, innovation and digital transformation.
Instead, enterprises will need a more sophisticated understanding of their external dependencies, including concentration risks, subcontracting arrangements, data access privileges and recovery capabilities. Critical service providers may warrant continuous monitoring, stronger transparency requirements and credible contingency arrangements.
Boards, meanwhile, should be asking three fundamental questions.
Which external providers are indispensable to the organisation? What would happen if they became unavailable or compromised? And how quickly could the enterprise restore critical operations?
These questions move third-party risk management beyond procurement compliance and towards business resilience. The distinction between internal and external infrastructure is becoming increasingly irrelevant to customers, regulators and shareholders. They experience disruption through the enterprise whose services they use, irrespective of where the underlying failure occurred.
For corporate India, the emerging lesson is straightforward.
An enterprise can outsource a function, a technology platform or an operational process. But the responsibility for understanding the risks created by those decisions remains firmly within its own boardroom.
