Financial services organisations who send their customers' data to India will not have welcomed the recent story in The Sun about Karan Bahree, who apparently offered to sell to a journalist the personal data of thousands of UK residents. The precise details are disputed (and Bahree has now been sacked by his employers), but apparently he was able to obtain personal details from call centre operators who were willing to sell the data. The Sun reported that high street banks including Barclays, the Woolwich, HSBC and Lloyds TSB were affected.
UK businesses holding personal data are subject to the Data Protection Act; often, when a UK business uses a call centre in India, the call centre acts as a subcontractor and a "data processor", subject to the terms of its contract with the UK business; the UK business is still the "data controller" and as such remains liable for any breaches of the Act. I suspect that in many instances, the financial services organisations who were implicated in The Sun's sting will be checking the agreements with their Indian sub-contractors for the terms dealing with data security ...