DPDP Act for HR & Employee Data: Employers' Guide
Every employer is a Data Fiduciary. Recruitment files, appointment letters, payroll, attendance, performance notes, health and insurance details, background checks and exit records all contain personal data about the people who work for you. The Act applies to all of it, with a specific legitimate use for employment.
Section 7 allows an employer to process personal data without consent for employment purposes and to protect the business from loss or liability, such as preventing leaks of trade secrets. That is a purpose-bound permission, not a blanket one. Wellness programmes, monitoring beyond security, social-media checks and sharing data with partners still need a proper basis, usually genuinely free consent. Most duties take effect on 13 May 2027.
Who this covers
Employers of every size are Data Fiduciaries for staff, contractors, interns and applicants.
HR and recruitment teams run the systems holding the most sensitive records in the company.
Payroll, HRMS, background-verification and insurance vendors are usually Data Processors.
Staffing and recruitment agencies are fiduciaries for candidate data and often processors for client employers.
Employees, contractors and candidates are Data Principals with rights to correction, erasure, grievance redressal and nomination.
Personal data you are likely to hold
Key provisions for HR & Employee Data
The parts of the Act and Rules that matter most here. Select a reference to read the full explanation.
Employment is a legitimate use. So is processing a person voluntarily provides for a stated purpose, and compliance with laws that require disclosure.
Where you rely on consent, give an itemised notice and a free choice.
Accuracy, security, breach intimation, erasure and written contracts with processors.
Employees can ask for correction and erasure, use the grievance process and nominate someone.
Applies to interns, trainees or apprentices who are under 18.
Legal claims and investigation of offences can be exempt in limited circumstances.
Penalty ceilings apply to employers like any other fiduciary.
01What the employment legitimate use covers
Section 7 lets you process personal data without consent for the purposes of employment, and for safeguarding the employer from loss or liability, such as protecting trade secrets, IP and confidential information. It also covers providing a service or benefit an employee asks for.
This covers the ordinary working relationship: hiring decisions, contracts, payroll, statutory filings, leave, performance management and access control. It does not cover everything an employer might want to do with the data.
- Needs more than the legitimate use: optional wellness programmes, sharing data with partners for their own marketing, monitoring unrelated to security or work, and staff photos in public campaigns. Ask for free, withdrawable consent, make refusal costless, and consider whether you need the data at all.
- Stay within purpose. Data collected for payroll should not drift into profiling employees for unrelated decisions.
02Candidates, background checks and referees
Applications. Candidates give CVs voluntarily to be considered, which is a legitimate use. Use the CV for that purpose, tell candidates how long you will keep it, and erase unsuccessful applications when the hiring cycle ends unless the candidate agrees to stay on file.
Background verification. Identity, education, employment and criminal-record checks are data-heavy and often use a vendor. Tell candidates what is checked and by whom, collect only what the role needs, sign a written contract with the vendor and ensure the vendor deletes data after the check.
Referees and social media. These bring in third parties' data. Limit to what is relevant to the role and be transparent.
03Monitoring, biometrics and remote work
Employers have real reasons to protect systems and confidential information, and the Act recognises that. Keep monitoring proportionate to those reasons.
- Write a monitoring policy that says what you log (email, devices, access, location) and why, and share it with staff.
- Prefer security-focused logging to continuous screen capture or keystroke tracking.
- Biometric and face-based attendance collect highly personal data. Use the least intrusive method that works and secure it carefully. Aadhaar authentication has its own legal limits.
- For field and gig workers, tell them when location is tracked, limit it to working hours and keep history only as long as needed.
- Processing logs and traffic data must be retained for at least a year under Rule 8, with proper access control.
04Employee records, rights and retention
Employment and tax laws require you to keep certain records for set periods after employment ends. Keep those for as long as the law demands, restrict access, and erase the rest. Marketing lists, old interview notes and files of unsuccessful candidates should not be kept indefinitely.
Employees can ask for correction and erasure (Section 12), use the grievance process (Section 13) and nominate a person (Section 14). The right to a summary of data (Section 11) is framed around data processed with consent or voluntarily provided, so its reach for employment-basis processing is a question for your counsel. In practice, giving staff a straightforward way to see their own records avoids disputes.
Have a named HR contact for DPDP questions and publish the details required by Rule 9.
05Payroll, HRMS, insurance and other vendors
Payroll providers, HR software, benefits brokers, insurers, training platforms and travel agents hold staff data on your behalf. Section 8 requires a written contract with each, and you stay responsible. Include purpose limits, security, breach notice, sub-processors and deletion at the end.
Sharing staff details with an insurer for group cover is typically needed to provide a benefit. Sharing the same data with a partner for promotions is not, and needs consent.
06Security and breaches
HR systems hold salary, bank, ID and health information, and are a favourite target for phishing and insider misuse. Apply the Rule 6 baseline: encryption, access control, logging, backups and processor contracts. Limit access by role, and remove it quickly when people leave or change jobs.
A payroll leak or an HR mailbox compromise is a personal data breach. Tell affected employees and the Board as Rule 7 requires, including a detailed report within 72 hours.
Penalties
The Data Protection Board decides actual penalties after an inquiry. These are the maximum amounts in the Schedule to the Act and apply to every Data Fiduciary, whatever the sector.
A breach of a voluntary undertaking accepted by the Board carries the penalty applicable to the matter the undertaking covered.
Common situations
Keep what employment, tax and other laws require for the required periods, restrict access, and erase the rest. Explain in writing what you retained.
That goes beyond the employment legitimate use. Seek free, specific consent, make participation optional and keep the data away from managers.
Check your monitoring policy and legal basis. Security reviews with a stated reason differ from curiosity. Document why access is necessary.
You may use them for the role they were sent for. Agree retention with the agency and erase CVs of those not selected when the cycle ends.
Treat it as a possible breach. Assess exposure, tell affected staff and the Board as required, and review device encryption.
Compliance checklist
Common mistakes to avoid
Treating the employment legitimate use as permission to do anything with staff data.
Keeping unsuccessful candidates' CVs forever.
Leaving salary and ID files in shared drives anyone can open.
Using wellness, engagement or monitoring tools that send data to vendors without contracts.
Sharing employee data with partners for promotions.
Common questions
Do we need employee consent to process their data?
Not for processing within the employment legitimate use in Section 7, such as payroll, statutory filings and managing employment. For other uses you need consent that is free, specific and informed.
Can employers monitor employees?
Employers can protect systems, confidential information and their business from loss. Monitoring should be proportionate, explained in a policy and limited to those purposes. Intrusive monitoring beyond them needs a stronger basis.
How long can we keep ex-employee records?
For as long as employment, tax, social security and similar laws require, plus any period needed for legal claims. After that, erase them.
Does the Act apply to contractors, interns and candidates?
Yes. Anyone whose personal data you process is a Data Principal. Interns under 18 are children under the Act.
Is a payroll vendor responsible for a leak?
The employer, as Data Fiduciary, stays responsible for processing done on its behalf, whatever the contract says. The contract should allocate costs and duties between you.
Who handles an employee's complaint?
The employer's grievance process first, then the Data Protection Board if the issue is not resolved. Labour-law remedies remain separate.