How LexComply Enabled a Listed ITES Giant to Unify Compliance Governance Across 20 Countries on 6 Continents

Quick Answer: Who: A BSE & NSE-listed Indian IT/ITES enterprise, IT services, BPM, and KPO delivery, operating wholly owned subsidiaries in 20 countries across 6 continents Problem: No verified confidence in even knowing the full universe of applicable laws, let alone a compliance management system to track the 80,000+ compliance obligations spanning SEZ/STPI filings, labour law across 24x7 shift operations, cross-border data privacy regimes, and client-mandated security audits, all on spreadsheets with zero central visibility Solution: LexComply's AI-powered Compliance Management System (CMS), deployed through a structured 5-phase onboarding built for a multi-entity, multi-geography delivery model Result: Up to 80% reduction in manual compliance effort, same-day reporting closures across every delivery centre, a fully auditable evidence trail ready for client due-diligence audits, and zero false-compliance closures Why it matters: India's IT-BPM sector is a $315.4 billion industry exporting $246 billion in FY2026 (IBEF), and every dollar of that runs through contracts that demand provable, continuous compliance

Last updated: September 2026

How a LexComply enabled Listed ITES Giant Unified Compliance Governance Across 20 Countries on 6 Continents

A LexComply Case Study on Building an AI-Driven Compliance Management System for Global IT/ITES-BPM Operations, Regulatory Intelligence, Audit-Readiness, and Client-Proof Governance at Scale

• Note on confidentiality: The client at the centre of this case study is a real LexComply engagement. Per our client confidentiality agreement, we refer to it throughout simply as "the Group."

Why Does a Global ITES Delivery Engine Need a Compliance Management System?

The Group is the archetype of India's IT/ITES success story:

• Publicly listed on India's stock exchanges, with the governance obligations of a listed entity layered on top of a services business (SEBI, MCA, RBI, FEMA)
• A portfolio spanning IT services, business process management (BPM/BPO), and knowledge process outsourcing (KPO), each serving global enterprise clients under strict contractual SLAs

Wholly owned subsidiaries in 20 countries spanning Asia-Pacific, the Middle East, Africa, Europe, North America, and South America/Oceania, each running delivery centres, client-dedicated units, or near-shore hubs

A 24x7, shift-based, multi-jurisdiction workforce, meaning labour law, shift-work regulations, and employee data privacy obligations differ by delivery centre, sometimes by client

Client contracts that themselves impose compliance obligations, SOC 2, ISO 27001, GDPR data-processing addenda, HIPAA for healthcare BPO mandates, on top of statutory law in every operating geography

• On paper, this is exactly what "Make in India, Serve the World" looks like. In the compliance function, it is a different picture: every new client logo and every new delivery centre adds another layer of law, another data-privacy regime, and another audit a client's procurement or InfoSec team can ask for on 48 hours' notice.

What Happens When Delivery Scales Faster Than Governance?

• Before LexComply, the Group's compliance function looked like this:
• No certainty over the applicable universe itself, the single hardest question in compliance was never answered with confidence: do we actually know every law and compliance that applies to us? Across 20 subsidiaries and three business lines (IT services, BPM, KPO), nobody could produce a verified, complete list, only a best-effort one, assembled from memory, past audits, and whatever the last consultant happened to flag

Manual tracking on spreadsheets, the default system of record for SEZ/STPI filings, SOFTEX submissions, labour registrations, and statutory due dates across every delivery centre

No single owner, compliance tasks floated between legal, HR, delivery leads, and finance, with no named accountability or audit trail a client's due-diligence team could inspect

Zero centralised visibility, leadership had no real-time view of compliance status across 20+ jurisdictions, even as client contracts increasingly demanded proof-on-demand

Evidence scattered across inboxes and drives, SOFTEX certificates, PF/ESI challans, data-processing agreements, and client audit responses lived in individual employees' mailboxes, not a retrievable repository

Impossible regulatory monitoring at scale, over 1,500+ regulatory amendments a year in India alone (SEZ rules, labour codes, IT Act amendments, data protection rules), before even counting 19 overseas jurisdictions each evolving their own data-privacy and labour frameworks

Why Is the Biggest Risk the Law You Do Not Know Applies to You?

Every other compliance risk is downstream of this one. A missed deadline assumes you at least knew the obligation existed. The far more dangerous, and far more common, failure mode is the law nobody put on the list in the first place:

• A new subsidiary is incorporated in a 21st geography, and the state- or municipal-level labour, shops & establishment, or data-localisation rules specific to that location are never formally mapped

A business line quietly starts handling a new category of client data (health records, payment data) and the sector-specific compliance obligations that come with it are never identified as "now applicable"

A regulator introduces a new compliance nobody was watching for, because monitoring only covered the laws already known to apply, not the ones that just started to

• Internal legal teams, stretched across 20 jurisdictions, default to answering the questions they are asked rather than proactively re-verifying the full universe every time the business changes shape

Auditors and client due-diligence teams ask "show us your complete list of applicable laws", a question a spreadsheet-based system, built up informally over years, usually cannot answer with full confidence

This is precisely the gap Phase 1, Business Understanding, exists to close. Rather than starting from what the Group already believed applied, LexComply's onboarding started from zero: mapping every entity, every business line, and every geography from first principles, cross-referencing all of it against a maintained library of 10,000+ laws, and producing a single validated "compliance universe" document that both the client's legal team and LexComply's practitioners signed off on. Only once that universe was confirmed complete did tracking, ownership, and automation even begin, because a perfectly efficient system for tracking the wrong (or incomplete) list of laws is not a compliance programme, it is a false sense of security.

• For an ITES enterprise specifically, this is not just a legal risk, it is a commercial risk. A client conducting vendor due diligence or a security audit does not just check whether you are compliant; they check whether you can prove it, on demand, across every centre servicing their account. Losing that argument does not cost you a penalty, it can cost you the contract.

This is a quantified problem across the sector:

• India's IT-BPM industry generated $315.4 billion in revenue in FY2026, with $246 billion in exports, the BPM/BPO segment alone accounts for $59 billion, roughly 18.7% of the total (IBEF / industry estimates, 2026)

India now hosts 2,117 Global Capability Centres (GCCs), employing 1.9 million professionals and generating $98.4 billion in revenue, nearly half of the entire global GCC talent base sits in India (2026 industry data)

72% of executives say rising compliance complexity has already hurt their company's profitability, and 73% say it slows down launching new products or services (PwC Global Compliance Survey, 2025)

60% of GRC teams globally still run compliance manually on spreadsheets (Coalfire), the exact practice that breaks down first when a client audit lands with a two-week notice period

A data breach flagged with a regulatory non-compliance finding costs $174,000 more on average than one without, a particularly sharp risk for any company holding client PII or PHI under outsourcing contracts (IBM Cost of a Data Breach Report, 2025)

86% of Indian firms say cross-border operations have grown more complex in the past year alone, and 40% have already faced unexpected fines or audits as a result (Cross-Border Trade Survey, 2025)

How Do You Build an AI-Driven Compliance Universe in Five Phases?

• Rather than a one-size-fits-all software rollout, LexComply's onboarding was built as a genuine change-management journey, because a compliance system spanning subsidiaries in 20 countries only works if delivery leads, HR, and legal actually trust and use it.

Phase 1: What Does Business Understanding Cover?

• Mapped every subsidiary, delivery centre, and client-dedicated unit across all 20 countries

Identified applicable business categories, IT services, BPM, KPO, since each carries a different compliance overlay (SEZ/STPI for export units, data-processing rules for KPO handling client PII, sector-specific rules for healthcare or BFSI process clients)

Defined the exact compliance geography, state, national, and international, for every delivery centre and client engagement

Shortlisted the regulatory authorities and primary law categories in play, including SEZ/STPI authorities, labour departments, and data protection regulators

• Output: an approved, board-ready "compliance universe" document, the single source of truth for what the Group must comply with, in every delivery location

Phase 2: What Does Application Setup Involve?

• Configured the organisational hierarchy: legal entities, delivery centres, business units, and client-dedicated teams, mirrored inside the platform

Set up role-based access, Performer, Reviewer, Approver, and Champion, so delivery leads, HR, and legal each own what they are accountable for

Built escalation matrices and notification timelines specific to each law and each delivery centre

Mapped every compliance line item to a named responsible person and due date

Configured management dashboards giving leadership a client-ready view of compliance health by entity and geography

• Output: a live, fully configured application, ready to be loaded with the compliance checklist

Phase 3: How Is the Compliance Checklist Built?

Loaded every applicable compliance from the validated universe, for the Group, this meant plugging into a library of 80,000+ compliances across 4,000+ laws

• Mapped each item to an owner, a frequency, and a due date

Assigned criticality, High / Medium / Low, so SEZ export obligations and data-breach notification deadlines were never mistaken for routine renewals

Validated the entire checklist with the Group's in-house legal and compliance team

• Ran a parallel-run review before go-live cutover, so nothing was live without a dry run
• Output: an approved, fully loaded compliance checklist, the operational backbone of the system

Phase 4: What Do Training and Review Deliver?

• Delivered role-based training for Performers, Reviewers, and Heads of Department across delivery centres in different time zones
• Walked every user through evidence upload, proof submission, and reporting workflows, the same evidence trail that client audit teams would later inspect
• Simulated real compliance cycles during training itself, not just in theory

Resolved queries and customised workflows based on live feedback from delivery and HR teams

Ran a full parallel compliance cycle to validate accuracy before switching off the old process

• Output: trained users and a formally signed-off, system-ready organisation

Phase 5: What Does Ongoing Support Include?

Auto-updates to the compliance library every time a law changes, no manual monitoring required across 20 jurisdictions

• Fortnightly alerts on new, amended, and discontinued compliance items

Dedicated email-based support for both system and legal clarifications

Periodic review calls to add newly applicable compliances as new delivery centres or client mandates come online

Continuous platform upgrades and new feature rollouts at no extra onboarding cost

Monthly meetings on updates.

• Output: an always-on compliance programme that stays current without the Group lifting a finger
• Why this matters for other Indian ITES companies: most compliance software failures are not a technology problem, they are an onboarding problem. A platform loaded with the wrong universe of laws, or rolled out without training and parallel runs, gets abandoned within two quarters, right around the time the next client security audit lands. The 5-phase discipline is what makes 150,000+ compliance items actually usable by delivery teams under contractual pressure.

How Large Is the Compliance Universe for a 20-Country ITES Group?

Numbers that put the Group's compliance footprint in perspective:

• 13 areas of law covered, Corporate Secretarial, Direct Taxation, Indirect Taxation, Capital Markets, FEMA & Banking/EXIM, IPR (Intellectual Property), Regulatory (business-specific laws, including SEZ/STPI), HR/Labour & Employment, Marketing & Communications, Information Technology, Data Privacy & Security, Environment/Health & Safety (EHS), and Anti-Corruption & Ethics

6 compliance categories, Registrations/Approvals/Renewals, Returns & Taxes, Internal Compliances, Modifications & Renewals, Records/Displays/Policy & Practices, and Third-Party Compliances

4,000+ laws tracked, with 80,000+ individual compliances in the active library

20,000+ legal updates issued to the client base and counting

6,000+ forms and formats ready to use, so no team starts from a blank page, including SOFTEX, STPI, and export-obligation formats specific to the ITES sector

• For an ITES enterprise, IPR, Data Privacy & Security, and Anti-Corruption & Ethics carry outsized weight, client contracts routinely bind them to confidentiality, IP assignment, and anti-bribery standards (FCPA, UK Bribery Act) that exceed the statutory minimum, and this compliance universe is built to track both.

How Does AI Compliance Software Replace Manual Effort?

This is where the engagement stopped looking like "software" and started looking like a genuine AI transformation. Six AI capabilities did the heavy lifting the Group's legal, HR, and delivery teams used to do by hand:

• 1. AI Summary of Compliances, every obligation gets a plain-English, AI-generated summary of what is required, who is accountable, and what evidence is needed. Delivery leads act without reading raw SEZ notifications or labour code amendments.
• 2. AI-Driven Notifications, AI analyses due dates, historical default patterns, and regulatory urgency across every delivery centre, then routes the right alert to the right person automatically.
• 3. Auto-Reporting from Proof, upload a SOFTEX certificate, a filing receipt, or a labour registration, and the AI reads it, auto-marks the compliance complete, and extracts every key field. Zero manual data entry, zero transcription error.

Auto Testing of Proofs - AI cross-checks every uploaded document against the compliance requirement automatically; no reviewer has to manually inspect each proof.

How Does AI Summarise Regulatory Notifications?

Every regulatory notification touching the Group's delivery centres is run through this engine before a human ever reads it:

• Instant Clarity, complex regulatory circulars distilled into a one-line action summary in under 10 seconds, no legal expertise required

Structured Output, every update auto-organised into Synopsis, Action Points & Impact Analysis, no manual reading required

Deadline Never Missed, critical dates are surfaced and highlighted automatically the moment a notification lands

Action-Ready, teams know exactly what to do and by when, without parsing legal language

Full Traceability, circular reference, date, category and segment captured and stored for audit

Segment-Specific Alerts, notifications filtered by business unit, entity or geography so delivery teams receive only what is relevant to them

Time Saved, what requires 30 minutes of manual legal analysis is summarised in under 10 seconds

Multilingual, the same summary available in Hindi and regional languages for wider team accessibility

How Does AI Extract Evidence and Report Compliance?

• Once a filing is made, the evidence itself does the reporting:
• Smart Document Processing, the AI reads uploaded evidence (PDF, DOCX, XLS) and extracts all key data fields automatically, no manual entry, no re-keying of data

Auto-Fetch of Compliance Data, issue date, deposit date, amount, penalty, interest and certificate number pulled directly from the uploaded document and mapped to the compliance record

Zero Manual Data Entry, eliminates the transcription errors that plague manual systems, saving hundreds of man-hours a month at the Group's scale of operations

System Date of Fulfilment, tamper-proof timestamping of when a compliance was actually completed

Evidence-Backed Status, a compliance is marked complete only after AI validates the extracted data from evidence, no rubber-stamping, no unverified closures

How Does AI Verify Proof and Prevent False Compliance?

This is the safeguard that catches what a client's own security audit is looking for, before the client does:

• Eliminates Manual Verification, AI cross-checks every uploaded document against the compliance requirement automatically; no reviewer has to manually inspect each proof

Zero False Compliance, mismatched dates, incorrect amounts and wrong certificates are detected before a compliance is closed, so the Group never carries a false-compliant status

Penalty Risk Reduction, defective or incomplete evidence is flagged before submission, not after, avoiding regulatory penalties for improper documentation at source

Audit-Ready Confidence, every proof is AI-tested and timestamped, giving auditors a verified, tamper-proof evidence trail

Early Warning System, flags missing fields (no deposit date, no certificate number) before submission, not after

Reduced Compliance Liability, the Group can demonstrate measurable due diligence: proof is not just uploaded but independently AI-verified, with a timestamped audit trail

What Does Automatic Compliance Reporting Deliver?

• Pulled together, these capabilities compress the Group's entire reporting cycle:
• Reduce Manual Compliance Effort by Up to 80%, AI auto-extracts data from every compliance document and populates records instantly, eliminating hundreds of hours of repetitive manual work each month

Accelerate Compliance Reporting, all compliance obligations across every entity and geography are processed simultaneously, enabling same-day reporting closures instead of week-long manual cycles

Improve Accuracy and Data Quality, AI extraction eliminates transcription errors and applies consistent validation rules, giving leadership confidence that compliance data is accurate and auditable

Strengthen Audit Readiness, every compliance is automatically linked to its supporting evidence with a timestamped audit trail, so the Group is audit-ready at all times, not just during inspection windows

Minimize Compliance Risk, AI flags reporting delays, missing documents and compliance gaps before they become regulatory violations, protecting the Group from penalties and reputational risk

What Does Labour Code GPT Do for Labour Law Compliance?

For a 24x7, multi-jurisdiction workforce, one more AI tool closes a very specific gap, instant, citation-backed answers to labour law questions:

• Comprehensive Coverage, all four central Labour Codes, along with the state-specific rules notified by each state

State-Wise Shop & Establishment Acts, maintained and updated for accuracy across every operating state

Zero Hallucination, responses are derived strictly from a verified legal database, no invented citations, no generic LLM guesswork

Always Current, the legal database is continuously updated to reflect fresh amendments, notifications and government orders

Conversational Interface, HR and delivery teams ask questions in plain English and get precise, cited legal answers, no need to sift through bare acts

• Instant Access, No Setup, available 24/7 via browser, no installation or IT overhead required
• Put together, these six AI capabilities, plus Labour Code GPT, deliver the numbers that matter most to the Group's leadership: up to an 80% reduction in manual compliance effort, same-day reporting closures across every delivery centre and geography simultaneously, and a tamper-proof, timestamped audit trail the Group can hand a client's due-diligence team in minutes, not weeks.

How Often Are Domestic and Overseas Compliance Changes Monitored?

Because a 20-country delivery footprint needs different monitoring speeds for different risk profiles, the legal update engine runs on two clocks:

What Is the Monitoring Cadence for India?

• Alerts on any change in compliance literature: fortnightly
• AI-driven knowledge dossier: daily for Tax, MCA, SEBI, FSSAI, RBI; thrice monthly for everything else
• New compliances introduced: fortnightly, plus a monthly discussion meeting with the client team
• Filing-date extensions: auto-updated within 48 hours of the government notification
• Discontinued/omitted compliances: flagged fortnightly to keep the library clean

What Is the Cadence Across the 19 Overseas Jurisdictions?

• Alerts on change in compliance literature: monthly
• AI-driven knowledge dossier: monthly, jurisdiction-specific summaries
• New compliances introduced: monthly
• Filing-date extensions: monthly
• Discontinued/omitted compliances: monthly

Special-priority alerts are pushed immediately to specific users whenever a new compliance carries an unusually short reporting deadline, a real risk in ITES delivery, where a data-privacy rule change in one client's jurisdiction can trigger a contractual notification obligation with a shorter clock than the statutory one.

Can a Compliance Vendor Survive a Client Security Audit?

• For an ITES company, "can our own compliance vendor survive a client security audit" is not a rhetorical question, it gets asked, literally, during vendor onboarding. The platform underpinning the Group's compliance programme is built to withstand exactly that scrutiny:
• ISO 27001 certified, independently audited and renewed annually

SOC 2 Type II compliant, with controls for security, availability, and confidentiality verified by independent auditors every year

Annual VAPT (Vulnerability Assessment & Penetration Testing) by a government-approved agency

• Cloud or on-premise deployment, fitting whichever IT governance model the enterprise, or its clients' security policies, require
• Cleared by enterprise InfoSec teams in the US, UK, Canada, Israel, and Australia, the same markets the Group's own clients operate in
• Automatic updates, zero patching overhead, no version lag, no disruption to delivery operations

What Changed for the Group?

• Beyond the operational wins, this is the platform's proven scale backing the Group's own deployment:
• 20,000+ active users on the platform globally

450+ corporate clients, including Grant Thornton and 2 of the Big 4 accounting firms

30+ countries with live, active compliance mandates

1,000,000+ compliances reported through the platform to date

100,000+ legal updates issued across the client base

What Should Indian Companies With Global Operations Do Differently?

If your organisation is scaling subsidiaries internationally, or already operating across multiple geographies without a unified system, the Group's journey offers a clear playbook:

• Answer "do we know everything that applies to us?" before anything else. A tracking system is only as trustworthy as the completeness of the list behind it, verify the universe first, or you are just efficiently managing a partial view of your own risk.

Map your compliance universe before you buy software. SEZ/STPI obligations, labour law, and data-privacy rules do not overlap neatly, business understanding comes first, configuration second.

Treat client-mandated compliance the same as statutory compliance. SOC 2, ISO 27001, and contractual data-processing obligations need the same named ownership and audit trail as a GST return.

• Name an owner for every obligation, at every delivery centre. "Someone in HR will handle it" is not an audit trail, and it is the first gap a client's vendor-risk team finds.
• Treat overseas compliance monitoring as continuous, not annual. Monthly cadence on 19 jurisdictions still beats discovering a data-privacy rule change after a client's DPA requires immediate notification.
• Insist on evidence-backed closures, not self-reported ones. AI-verified proof, not a checkbox, is what actually survives a client security audit.
• Build for client-ready visibility, not just board visibility. If your compliance dashboard cannot produce an audit pack in minutes when a client asks, it is not doing its job.

Security clearance matters as much as legal coverage. If your compliance vendor cannot pass InfoSec due diligence in the US, UK, or EU, it becomes the blocker to your own client onboarding.

Why Does This Matter for Indian ITES Companies Right Now?

The numbers make the direction of travel unmistakable. India's IT-BPM sector is projected to grow from $315.4 billion toward $350 billion, contributing nearly 10% of GDP, and 2,117 Global Capability Centres already run out of India, a number that keeps climbing as global enterprises deepen their delivery footprint here. Every one of those contracts comes with a compliance clause, a data-processing addendum, and a client that will eventually ask for proof. India's RegTech and compliance-SaaS market itself is projected to grow from USD 703.5 million in 2026 to USD 2.4 billion by 2034, a 16%+ CAGR driven by exactly this pressure: regulatory and contractual complexity outpacing what manual, spreadsheet-based teams can handle.

Indian ITES companies with global delivery footprints are not choosing between "manual" and "automated" anymore. They are choosing between building AI-powered compliance infrastructure now, on their own terms, or being forced into it later, after a missed SEZ filing, a failed client audit, or a data-privacy notification deadline makes the decision for them.

The Group chose to build it now. Twenty subsidiaries, six continents, 150,000+ compliance obligations, one dashboard.

Frequently Asked Questions

How does a company know it has identified every applicable law and compliance?

Most companies cannot answer this with certainty, which is itself the biggest hidden compliance risk, a missed deadline at least means the obligation was known; an unidentified law means the risk was invisible until an audit, a regulator, or a client due-diligence review surfaced it. The fix is a structured "business understanding" exercise that maps every legal entity, business line, and geography against a maintained, continuously updated law library, rather than relying on an informally accumulated, best-effort list, and gets that universe formally validated and signed off before any tracking or automation begins.

What is a compliance management system (CMS) for an IT/ITES company?

A CMS for an ITES company is a technology platform that identifies every legal, regulatory, and client-contractual obligation applicable to its delivery centres, including SEZ/STPI filings, labour law, data privacy regimes, and IPR/anti-corruption obligations imposed by client contracts, assigns ownership and deadlines, tracks audit-ready evidence, and gives leadership real-time visibility across every entity and geography.

How does AI improve compliance management for BPO and KPO companies?

AI reduces manual effort by summarising complex regulatory text into plain-English action points, automatically extracting data from filing evidence such as SOFTEX certificates and labour registrations, verifying that submitted proof genuinely matches the requirement (preventing false compliance before a client audit finds it), and scanning government portals daily to surface only the regulatory changes relevant to a specific delivery centre.

What are the biggest compliance challenges for Indian ITES companies with global delivery centres?

• The most common challenges are tracking SEZ/STPI, labour, and data-privacy law changes across every delivery geography simultaneously; meeting client-mandated obligations like SOC 2 and GDPR data-processing addenda on top of statutory law; the absence of a single owner for cross-border obligations; evidence scattered across emails instead of an auditable repository; and the sheer volume of regulatory change, over 1,500 amendments a year in India alone, on top of monthly changes across every overseas delivery jurisdiction.

How long does it take to implement a compliance management system across multiple delivery centres?

A structured deployment typically follows five phases, business understanding, application setup, compliance checklist build-out, training and parallel-run review, and ongoing support, and can go live in a matter of weeks per entity, depending on the complexity of the compliance universe and the number of delivery geographies involved.

Is cloud-based compliance software secure enough for an ITES company handling client data?

Enterprise compliance platforms serving ITES companies should carry independent certifications such as ISO 27001 and SOC 2 Type II, undergo annual VAPT by a government-approved agency, and be cleared by InfoSec teams in regulated markets like the US, UK, Canada, and Australia, the same bar a company's own enterprise clients hold it to during vendor security reviews.

About LexComply

LexComply is India's technology-driven compliance management platform, built by practitioners, Chartered Accountants, Company Secretaries, Lawyers, and IT experts, since 2015. The platform tracks 10,000+ laws and 150,000+ compliances across 30+ countries, serving 450+ corporate clients including Grant Thornton and 2 of the Big 4 global accounting firms, with 20,000+ active users worldwide.

• Ready to see what an AI-powered, client-audit-ready compliance universe looks like for your delivery centres? Talk to LexComply about a compliance health assessment tailored to your entities and geographies.

Sources

Sources referenced: IBEF, Information Technology India industry report, 2026; Wisemonk, India IT Services Market Size 2026; PwC Global Compliance Survey 2025; Coalfire Compliance Report 2023 (via Secureframe, 2026); IBM Cost of a Data Breach Report 2025; Cross-Border Trade Survey 2025 (PR Newswire, 2026); IMARC Group, India RegTech Market Report 2026.

Legal Disclaimer: This article is for general information and reflects the engagement and market data referred to as at September 2026. It does not constitute legal advice. Confirm the obligations applicable to your organisation with a qualified adviser.