For HR
For HR leaders
HR holds identity documents, bank details, family details, health information and performance records for every employee, and CVs for many people who never join.
Short answer
Employers may process employee data for employment purposes, or to safeguard themselves from loss or liability, as a legitimate use under s.7(i), without consent. Uses beyond that need another ground, and candidate data needs its own basis. Payroll, HRMS, background check and ATS vendors are processors that need valid contracts (s.8(2)), and the core duties begin on 13 May 2027.
What you own
- Candidate data, from sourcing to offer or rejection.
- Employee records, from onboarding to exit.
- Dependants' data collected for benefits.
- Contracts with HR vendors.
- Who inside the company can see HR data, and where exports go.
- Retention periods for each HR record type.
Where s.7(i) helps and where it stops
| Activity | Ground to consider | Watch for |
|---|---|---|
| Payroll, statutory deductions, leave | s.7(i) | Limit access to HR and finance. |
| Background checks on new hires | s.7(i) or s.7(a) | Check scope with counsel; candidates are not yet employees. |
| CCTV and access control | s.7(i), safeguarding from loss | Keep it to security; see the CCTV and biometric guide. |
| Optional wellness programmes | Consent (s.6) | Participation must be free. |
| Partner offers to staff | Consent (s.6) | Not an employment purpose. |
| Alumni newsletters | Consent (s.6) | Not an employment purpose. |
s.7(i) covers employment purposes and safeguarding the employer from loss or liability. Sharing beyond what employment needs, or keeping data after the purpose ends, needs another ground or should stop.
Dependants named for insurance, such as spouses, children and parents, are Data Principals in their own right. Use their data only for the benefit, and limit who sees it.
What to do this quarter
- 01Map HR systems and vendors
From application to exit: ATS, HRMS, payroll, background checks, benefits and attendance.
- 02Paper the vendors
Put processor contracts with security and breach reporting terms in place (s.8(2), Rule 6).
- 03Set retention
Pick periods for rejected candidates and leavers, and erase after them unless a law requires you to keep records (s.8(7)).
- 04Open a channel
Give employees one place to ask questions and raise grievances, and publish the Rule 9 contact.
Employee requests and grievances
Employees can raise grievances (s.13) and make requests about their data. How far the access and correction rights apply to data processed under s.7(i) rather than consent is a point to settle with counsel. Either way, answer within your published grievance period of no more than 90 days (Rule 14(3)).
Route requests through one channel and log them. Rule 9 requires each response to mention the published contact for questions about processing.
What to ask other teams
- IT: which laptops and shared drives hold HR exports, and who can reach them.
- Legal: the processor contract template and the s.7(i) record for each HR activity.
- Security: what monitoring runs on employee devices and why.
- Finance: where payroll files go after each run.
- Admin and facilities: CCTV retention and biometric attendance records.
How TruePrivacy helps
- Classification finds EPF and UAN numbers, PAN, Aadhaar and IFSC in HR stores, and the DSPM endpoint agent finds them on enrolled laptops, with masked samples.
- Vendors and processors tracks payroll, HRMS and background check contracts and assessments.
- Retention rules expire candidate and leaver data, and grievance redressal tracks staff grievances against the 90-day limit.
Do we need employee consent under DPDP?
Not for employment purposes or for safeguarding the employer from loss or liability, which s.7(i) makes a legitimate use. Other uses need another ground, usually consent.
Is CCTV in the office allowed?
Monitoring tied to safeguarding the employer from loss or liability may fall under s.7(i). Keep it to that purpose and record your reasoning.
Can employees ask for their data?
They can make requests and raise grievances (s.13). How far access and correction rights apply to data processed under s.7(i) is a point to settle with counsel.
How long can we keep candidate CVs?
Until the purpose is served, unless a law requires longer (s.8(7)). Set a period for rejected candidates and erase after it.
Your DPDP plan, starting today
Core obligations for data fiduciaries begin on 13 May 2027.
Core obligations begin