Guide
Employee data under DPDP
Employee and candidate data is personal data like any other. DPDP gives employers a specific legitimate use, but it does not switch off the rest of the Act.
Short answer
DPDP applies to the digital personal data of employees and candidates. Section 7(i) lets you process personal data for employment purposes, or to safeguard the employer from loss or liability, without consent, but your s.8 duties on security, accuracy, erasure and grievance redressal still apply. Map each HR purpose to s.7(i) or to consent, tell employees plainly what you do, set retention by purpose, and seek counsel for edge cases such as monitoring.
Which DPDP rules apply to HR data
The Act covers digital personal data, including data collected on paper and later digitised (s.3). HR systems, payroll, recruitment tools, chat, email and device logs all fall within it; paper files that are never digitised do not.
Section 7(i) is a legitimate use for employment purposes or for safeguarding the employer from loss or liability. The general obligations in s.8 still apply: accuracy when data is used for decisions (s.8(3)), security safeguards (s.8(5)), breach intimation (s.8(6)), erasure when the purpose is served (s.8(7)) and grievance redressal (s.8(10)).
Map each purpose to a ground
| HR purpose | Ground to assess first | Notes |
|---|---|---|
| Payroll, attendance, statutory filings | s.7(i), employment purposes | Keep the scope to what employment needs |
| Performance and promotion records | s.7(i) | Accuracy matters where data drives decisions (s.8(3)) |
| IT security logging on company systems | s.7(i), safeguarding the employer | Keep it proportionate and transparent; seek counsel on monitoring |
| Optional wellness or social programmes | Consent (s.6) | Employees must be free to say no |
| Employee photos in marketing | Consent (s.6) | A purpose separate from employment |
| Candidate CVs for a specific opening | Assess with counsel | Keeping CVs for future roles is a separate purpose |
| Background verification | Assess with counsel | Tell candidates what is checked and by whom |
Tell employees what you do
The s.5 notice duty attaches to consent requests. Where you rely on s.7(i), a clear employee notice is still good practice: it sets expectations and makes requests and grievances easier to handle. Write it in plain language, in the languages your workforce reads.
Give candidates a short notice when they apply, saying how long you keep CVs and whether you will consider them for other roles. Update the employee notice whenever you add an HR system or a new purpose.
Steps to bring HR data under control
- 01Inventory HR systems
List the HRIS, payroll, recruitment, learning, chat, email and endpoint tools, and the vendors behind them.
- 02Map purposes and grounds
Use the table above, and record the reason for each choice.
- 03Write the employee notice
Cover the data, purposes, grounds, who receives the data, retention and how to raise a grievance.
- 04Contract HR vendors
Put payroll, HRIS and background check providers under processor contracts (s.8(2), Rule 6).
- 05Limit access
Restrict HR files to people who need them, and log access (Rule 6).
- 06Set retention
Decide how long to keep each record after exit, guided by employment, tax and other laws, then erase (s.8(7)).
- 07Route requests
Send employee requests and grievances through your normal process.
Requests and monitoring
Handle requests from employees and former employees through the same intake and identity check as customer requests. The scope of each right can depend on whether you processed the data with consent or under s.7(i), so check with counsel before you refuse a request.
Email, screen, location or keystroke monitoring, and CCTV, raise questions of proportion that the Act does not settle in detail. Seek counsel before you start or expand monitoring, and see the CCTV and biometrics guide.
- HR systems and vendors inventoried
- Each purpose mapped to s.7(i) or consent
- Employee and candidate notices published
- Processor contracts with HR vendors
- Access to HR files restricted and logged
- Retention set for each record type
- Request and grievance route open to staff and former staff
- Monitoring reviewed by counsel
How TruePrivacy helps
Data discovery connects to sources such as Google Drive, Slack and SQL databases, and the DSPM endpoint agent scans local files on enrolled devices and reports findings with masked samples, not the raw files. Together they show where HR data has spread.
Records of processing holds the HR purposes, retention applies rules per data category, and staff requests run through Data Principal requests. Related template: the DSR request form.
Do we need employee consent under DPDP?
Not for everything. Section 7(i) covers processing for employment purposes or to safeguard the employer from loss or liability; optional purposes outside employment need consent (s.6).
Can employees make requests about their data?
Employees are Data Principals and can use your request and grievance process. What each right covers can depend on the ground you rely on, so check any refusal with counsel.
Is workplace monitoring allowed under DPDP?
Section 7(i) covers safeguarding the employer from loss or liability, but monitoring raises questions of proportion. Seek counsel before you start or expand it.
How long can we keep former employees' data?
Until the purpose is served, unless a law requires you to keep it (s.8(7)). Set periods for each record type with counsel.
Your DPDP plan, starting today
Core obligations for data fiduciaries begin on 13 May 2027.
Core obligations begin