DPDP for HR teams: handling employee data from hiring to exit

The Digital Personal Data Protection (DPDP) Act, 2023 applies to employee data much as it applies to customer data, with one important difference: section 7(i) lets an employer process an employee’s personal data without consent “for the purposes of employment”. That covers routine HR work such as payroll and attendance, but it does not switch off the duties to keep data secure and accurate, report breaches and erase data that is no longer needed. It also does not clearly cover job applicants, contractors or former employees.

Most of these duties start on 13 May 2027. Until then, the IT Act’s 2011 rules on sensitive personal data still apply to companies; they treat bank details, medical records and biometrics as sensitive and require written consent before collection.

What does section 7(i) actually allow?

Section 7(i) permits processing:

“for the purposes of employment or those related to safeguarding the employer from loss or liability, such as prevention of corporate espionage, maintenance of confidentiality of trade secrets, intellectual property, classified information or provision of any service or benefit sought by a Data Principal who is an employee.”

That gives three grounds: employment itself (salary, attendance, appraisals, statutory filings), protecting the business (such as investigating a suspected leak), and benefits the employee asks for.

It is not a blank cheque. In a May 2026 note, Economic Laws Practice argues that “purposes of employment” needs a close link to the job and is likely to be tested for necessity and proportionality. Where section 7(i) is unclear, the firm advises relying on notice and consent.

The Act requires a formal notice only when you ask for consent (section 5), but an employee privacy notice is still good practice. And the rest of section 8 applies in full: accuracy for data used in decisions (8(3)), security safeguards (8(5)), breach intimation (8(6)), erasure (8(7)) and grievance redressal (8(10)).

What applies at each stage of the employee lifecycle?

Do you need consent to collect candidate data?

Section 7(i) speaks of “a Data Principal who is an employee”, and a candidate is not one yet. Commentators including NovoJuris Legal and Sansa Legal treat recruitment as outside, or at least not clearly inside, the employment ground.

One arguable route is section 7(a), which covers data a person voluntarily provides for a specified purpose, such as a CV sent for a named vacancy. That is our reading, not settled law, and it would not stretch to keeping CVs for future roles or checking social media. The safer course is a standalone recruitment notice that, as Rule 3 requires, itemises the data and purpose and explains how to withdraw consent and complain to the Board, plus a separate opt-in for any talent pool.

Ask only for what each stage needs. And a CV from a job portal database is not automatically “publicly available” data outside the Act: that exclusion, in section 3(c)(ii), covers data the person herself made public.

Can you run background checks without the candidate’s consent?

Commentators urge caution here. In a September 2026 analysis, King Stubb & Kasiva cautioned employers against assuming that section 7(i) “automatically authorises every form of pre-employment screening”. Its recommendations translate into a simple process:

• Give a clear notice before verification starts, not a clause buried in the application form.
• Check only what the role needs; a delivery executive and a finance controller need different checks.
• Avoid catch-all questions to referees, such as whether the candidate had “any issues”.
• Bind the BGV agency by a contract covering security, confidentiality and deletion.
• Set a retention period so reports do not sit in HR inboxes indefinitely.

Because a BGV report drives a decision, section 8(3) requires the data to be complete, accurate and consistent. Letting a candidate explain a discrepancy before withdrawing an offer helps show you met that duty.

What should onboarding collect, and how should it be stored?

Onboarding brings in PAN, Aadhaar, bank details, UAN and ESI numbers, emergency contacts and often fingerprints or face scans. Collecting what payroll, tax and social security filings need is clearly an employment purpose; the risk lies in storage and access.

• Mask where you can. Rule 6 lists encryption, masking and virtual tokens among the minimum safeguards. If you only need to verify identity, ask for a masked Aadhaar and keep scans out of shared drives.
• Limit access. A recruiter does not need bank details, and a line manager does not need PAN.
• Treat biometrics carefully. The DPDP Act has no separate “sensitive data” category, but a leaked fingerprint cannot be reissued. Offer a card or app alternative where practical.
• Dependants. Spouse and children’s details for insurance or PF nomination belong to other people, while section 7(i) refers to the employee, and children’s data needs verifiable parental consent under section 9. This is unsettled; recording the employee’s consent at enrolment is sensible, but take advice.
• Interns and apprentices under 18. The Rules’ exemptions for children’s data do not include employment. You need verifiable consent from a parent or guardian, and section 9(3) bars tracking or behavioural monitoring of children.

How far can HR go during employment?

Monitoring

The “loss or liability” limb supports security monitoring such as data loss prevention on company email and CCTV at entrances. In a September 2026 note, King Stubb & Kasiva warned that section 7(i) “should not be treated as a blanket authorisation for unrestricted employee surveillance”. The firm calls keystroke logging particularly high-risk, says CCTV should not ordinarily cover places such as washrooms, and cautions against tracking location outside working hours. Write a policy saying what is monitored, why, who reviews it and for how long.

Performance and investigations

Appraisal ratings, improvement plans and disciplinary files drive decisions about people, so the section 8(3) accuracy duty applies. Restrict investigation files to the people running the investigation.

Health and leave

Medical certificates for sick leave or maternity benefit serve an employment purpose. Optional wellness programmes, counselling apps and engagement surveys usually do not: run them on consent and share only aggregated results with HR.

What do you need from payroll, insurance and BGV vendors?

Under section 8(1), you remain responsible for processing your data processors do on your behalf. Section 8(2) requires a valid contract, and Rule 6(1)(f) requires it to provide for security safeguards. Check that each HR vendor contract covers:

• the purpose and data shared, with a ban on other uses;
• security measures, access logging and keeping logs for at least one year;
• breach alerts fast enough for you to report to the Board within 72 hours;
• erasure on instruction or at contract end, which section 8(7)(b) requires you to ensure;
• sub-processors and any transfer outside India.

Insurers and the EPFO generally process data for their own legal purposes rather than as your processor. Share only what they need and record why.

How long can you keep employee data after exit?

Section 8(7) requires erasure once the purpose is no longer served, unless a law requires retention. After an exit, three rules interact:

• A one-year floor. Rule 8(3) requires every data fiduciary to keep personal data, traffic data and processing logs for at least one year from the date of processing, then erase them unless another law requires longer.
• Labour and tax law. The Code on Wages (Central) Rules, 2026, for example, require employee, wage and attendance registers to be preserved for five years from the last entry. Check state rules, PF, gratuity and tax periods with your advisers.
• Disputes. Section 17(1)(a) exempts processing necessary to enforce a legal right or claim from most of the Act’s duties, though security safeguards still apply. That may support keeping records for a live or likely dispute, not everything “just in case”.

The Third Schedule’s three-year deletion rule covers only large e-commerce, gaming and social media platforms, not employers. Build a retention schedule by record type and disable access on the last working day.

What rights can employees exercise?

This is less clear than many guides suggest. Sections 11 (access) and 12 (correction and erasure) apply to data processed on consent, “including consent as referred to in clause (a) of section 7”. They do not mention section 7(i). Sansa Legal and others read this to mean employees may have no statutory right of access or correction for data processed purely for employment; SNG & Partners, among others, describe employees as having these rights. The Board has not yet ruled.

What is not in doubt: section 13 gives employees a right to grievance redressal, which they must use before approaching the Board, and Rule 14(3) caps the response time at 90 days. Section 14 lets an employee nominate someone to act on death or incapacity.

In practice, run one route for all employee data requests and explain any refusal. Section 12(3) lets you decline erasure where retention is needed for the purpose or required by law.

What counts as an HR data breach?

The Act’s definition of a personal data breach includes “accidental disclosure”, not just hacking or loss, and has no size or harm threshold. Typical HR examples (illustrations, not reported cases):

• a salary sheet or appraisal file emailed to an all-staff list;
• an offer letter or BGV report sent to the wrong candidate;
• a lost laptop holding an unencrypted payroll export;
• a former employee whose HRMS login was never disabled.

Under Rule 7, you must tell each affected employee without delay what happened, its likely consequences and what they can do, and inform the Board without delay, with a detailed report within 72 hours of becoming aware. The Schedule to the Act allows penalties of up to ₹250 crore for failing to take reasonable security safeguards and up to ₹200 crore for failing to notify a breach.

A practical checklist for HR teams

1. Map every HR data set, including shared drives and email.
2. Record the basis for each: section 7(i), consent or legal obligation.
3. Publish an employee privacy notice and a separate candidate notice.
4. Rewrite BGV consent forms so checks are specific to the role.
5. Mask Aadhaar, restrict bank and PAN fields, and review biometric attendance.
6. Write a proportionate monitoring policy and share it with employees.
7. Add security, breach notice, log retention and deletion clauses to HR vendor contracts.
8. Build a retention schedule: one-year minimum, statutory periods, then deletion.
9. Set up one channel for requests and grievances, with a 90-day ceiling.
10. Identify interns or apprentices under 18 and get verifiable parental consent.
11. If you are notified as a Significant Data Fiduciary, include HR systems in the annual impact assessment and audit under Rule 13.
12. Run a breach drill on a misdirected salary file and train recruiters and payroll staff on the steps.

Where should HR start?

Most HR teams already hold the right data for the right reasons. The work before May 2027 is recording why, tightening access, fixing vendor contracts and deciding when to delete. Much of the risk sits with individuals choosing who receives an attachment, which is why training matters. The DPDP framework provides no official certification for such training.

AuditDPDP runs DPDP awareness sessions for HR teams, BPOs and staffing firms and for staff who use HRMS and payroll systems. Try our readiness test, or contact us to plan sessions.

This article is general information, not legal advice. AuditDPDP is an independent training provider and is not affiliated with MeitY or the Data Protection Board of India. The legal position is stated as of 24 October 2026.