- Home
- Industries
- DPDP for HR tech and employers
Industry
DPDP for HR tech and employers
Every employer is a Data Fiduciary for its people, and HR tech vendors usually process that data for them. DPDP gives employers a legitimate use for employment, with limits worth knowing.
Short answer
Employers may process employee data without consent for employment purposes, or to safeguard themselves from loss or liability, as a legitimate use under s.7(i). Uses outside that, such as marketing partner products to staff, need another ground, usually consent (s.6). HR tech vendors that process data on an employer's behalf are Data Processors under contract (s.8(2)), and security, breach and retention duties begin on 13 May 2027.
Where personal data sits in HR
- Candidates: CVs, assessments, interview notes, references and job portal records.
- Onboarding: PAN, Aadhaar, bank account and IFSC, address proof, emergency contacts, education and past employment.
- Payroll and benefits: salary, EPF and UAN numbers, tax declarations, and insurance details of dependants.
- Background verification: address, education and past employer checks run through vendors.
- Performance and conduct: reviews, investigations and disciplinary records.
- Workplace systems: attendance, biometric access, CCTV, and laptop and email monitoring.
- Exits: full and final settlement, exit interviews and alumni records.
HR data also lives outside HR systems: offer letters in email, payroll spreadsheets on laptops, ID copies in shared drives, and interview notes in chat tools. These copies are the hardest to control and the easiest to leak.
DPDP duties that bite hardest
| Duty | Section or rule | What it means in this sector |
|---|---|---|
| Employment legitimate use | s.7(i) | Covers processing for employment, and to safeguard the employer from loss or liability. It does not cover unrelated uses. |
| Candidates | s.6, s.7(a) | Confirm with counsel whether s.7(i) reaches people not yet employed. s.7(a) may fit data a candidate voluntarily gives for an application without saying she does not consent. |
| Dependants | s.4 | Spouses, children and parents named for insurance are Data Principals too. Decide your ground and limit use to the benefit. |
| Monitoring | s.7(i), s.6 | Monitoring tied to security or loss prevention may fall under s.7(i). Broader monitoring needs a clear purpose and ground. See our CCTV and biometric guide. |
| Processor contracts | s.8(2) | Payroll, HRMS, ATS and background check vendors need valid contracts. |
| Security safeguards | s.8(5), Rule 6 | Restrict who sees salary, health and ID data; log and review access, and keep logs for a year. |
| Retention | s.8(7) | Erase rejected candidates' data and ex-employees' records when the purpose ends, unless a law requires you to keep them. |
Roles: fiduciary or processor
The employer is the fiduciary for its staff and candidates. An HRMS, payroll, ATS or background check vendor acting on the employer's instructions is a processor that needs a valid contract (s.8(2)).
HR tech vendors become fiduciaries when they use data for their own purposes, such as a job portal that keeps candidate profiles to match them with other employers. Be clear which data you hold for whom.
If you sell HR software, expect every employer customer to send a processor contract and a security questionnaire. Rule 6 requires them to put security terms in those contracts, so have your answers ready.
s.7(i) is not a blanket licence. It covers employment purposes and safeguarding the employer from loss or liability. Using employee data for unrelated purposes, sharing it beyond what employment needs, or keeping it after the purpose ends needs another ground or should stop; check edge cases with counsel.
A 90-day starting plan
- 01Days 1 to 30: map HR data
List systems and vendors from application to exit. Scan HR shared drives and laptops for ID and payroll files.
- 02Days 31 to 60: set grounds and paper
Map each processing activity to s.7(i), s.7(a) or consent, and put processor contracts in place with HR vendors.
- 03Days 61 to 90: retention and requests
Set retention for candidates and leavers. Give employees a way to ask questions and raise grievances, and publish the Rule 9 contact.
How TruePrivacy helps
- Classification detects EPF and UAN numbers, PAN, Aadhaar, IFSC and names, including names in Devanagari.
- The DSPM endpoint agent finds payroll and ID files on enrolled HR devices and reports masked samples, not the files.
- Records of processing records each HR processing activity; vendors and processors tracks payroll, ATS and background check contracts.
- Retention rules expire candidate and leaver data, and grievance redressal gives staff a tracked channel.
Do employers need consent to process employee data?
Not for employment purposes or for safeguarding the employer from loss or liability, which s.7(i) makes a legitimate use. Other uses need another ground, usually consent.
Does s.7(i) cover job candidates?
Check with counsel. s.7(a) may cover data a candidate voluntarily provides for an application, where she has not indicated that she does not consent.
Is an HRMS vendor a processor?
Usually, for data it processes on the employer's instructions. It is a fiduciary for any data it uses for its own purposes.
How long can we keep ex-employees' data?
As long as the purpose needs or a law requires (s.8(7)). Then erase it and have your processors erase it too.
Your DPDP plan, starting today
Core obligations for data fiduciaries begin on 13 May 2027.
Core obligations begin