DPDP Act for HR: handling employee and candidate data

Audience: HR leaders, people operations, founders, IT and security · Last reviewed: October 2026

HR teams hold more personal data per person than almost any other function: identity documents, bank details, salary, performance notes, health information and device logs. The DPDP Act, 2023 gives employers a specific ground for this processing, but it does not switch off the rest of the Act. This guide explains what applies and what to do about it.

Does the DPDP Act cover employee data?

Yes, where it is digital. “Personal data” is any data about an individual who is identifiable by or in relation to it (s.2(t)). The Act applies to personal data collected in digital form, or collected on paper and digitised later (s.3(a)). A scanned offer letter or a joining form typed into an HRMS is covered. Employees and candidates are Data Principals; the employer is the Data Fiduciary because it decides the purpose and means of processing (s.2(i), s.2(j)).

The employment ground: section 7(i)

Section 4(1) allows processing only with consent or for “certain legitimate uses” under section 7. Clause (i) of section 7 covers processing:

“for the purposes of employment or those related to safeguarding the employer from loss or liability, such as prevention of corporate espionage, maintenance of confidentiality of trade secrets, intellectual property, classified information or provision of any service or benefit sought by a Data Principal who is an employee.”

In practice, payroll, attendance, leave, appraisals, access control and benefits an employee asks for sit comfortably here. Other legitimate uses may also apply: disclosures an employer is legally obliged to make to the State (s.7(d)), compliance with court orders (s.7(e)) and responding to a medical emergency involving a threat to life or an immediate threat to health (s.7(f)). Our lawful uses guide covers all nine clauses.

Where section 7(i) is less clear

• Candidates. The Act does not say whether recruitment before an offer counts as “the purposes of employment”. Section 7(a) covers data a person voluntarily provides for a specified purpose where she has not said she does not consent. Decide which ground you rely on and record it.
• Optional programmes. Wellness apps, photos for marketing or employee referral campaigns are hard to fit within “purposes of employment”. Consent is the safer ground, and it must be free, specific, informed, unconditional and unambiguous (s.6(1)).
• Monitoring. Security monitoring linked to preventing espionage or protecting trade secrets is named in s.7(i), but section 8 still requires the data to be secured and erased when no longer needed.

Consent and notice for HR

Where you rely on consent, the request must be preceded or accompanied by a notice (s.5(1)) that meets Rule 3: an itemised description of the data, the specific purpose, and how to withdraw consent, exercise rights and complain to the Board. Employees can withdraw consent as easily as they gave it (s.6(4)); you then stop that processing, and make your processors stop, within a reasonable time unless the law requires or authorises it to continue (s.6(6)). See consent under DPDP.

Employee rights requests

The rights to access a summary of personal data (s.11) and to correction and erasure (s.12) are framed around data for which the person “has previously given consent, including consent as referred to in clause (a) of section 7”. The text does not extend them expressly to processing under s.7(i) alone. Many employers will answer such requests anyway, and the right to grievance redressal under section 13 covers any act or omission concerning the employer's obligations. Take advice before refusing a request on this basis.

Obligations that apply whatever the ground

• Accuracy for decisions. Where data is used to make a decision that affects the employee, such as a promotion or termination, or is disclosed to another Data Fiduciary, you must ensure it is complete, accurate and consistent (s.8(3)).
• Security. Reasonable security safeguards, including encryption or masking, access control and logging, are required (s.8(5), Rule 6(1)). Keep logs for one year (Rule 6(1)(e), Rule 8(3)).
• Breach intimation. A leak of payroll or ID documents must be reported to each affected employee without delay and to the Board, with a detailed report within seventy-two hours (s.8(6), Rule 7(1) and 7(2)). See the incident response playbook.
• Erasure. Erase data once the purpose is no longer served, unless another law requires you to keep it (s.8(7)). For leavers, separate records you must keep from those you merely prefer to keep. Our retention and deletion checklist helps.
• Contact point. Publish the business contact of a person who can answer questions about processing (s.8(9), Rule 9).

HRMS, payroll and background-check vendors

You remain responsible for processing done on your behalf by a Data Processor, whatever the contract says (s.8(1)). Engage processors only under a valid contract (s.8(2)) that provides for reasonable security safeguards (Rule 6(1)(f)). If your HR platform stores data outside India, section 16 and Rule 15 apply; see cross-border data transfer. For the vendor's side of this relationship, see DPDP obligations for Data Processors.

Interns and trainees under 18

A “child” is anyone under eighteen (s.2(f)). Section 9(1) requires verifiable consent of a parent before processing a child's personal data, and section 9(3) bars tracking or behavioural monitoring of children. The Fourth Schedule exemptions do not list employers, so review device monitoring and onboarding for under-18 interns. See children's data rules.

HR checklist

1. Inventory HR systems: HRMS, payroll, ATS, email, shared drives, device management.
2. Record the ground for each use: s.7(i), another s.7 clause, or consent.
3. Move optional programmes onto separate, withdrawable consent.
4. Set retention per record type and an erasure routine for leavers.
5. Review vendor contracts for Rule 6(1)(f) security terms.
6. Add HR data to your breach runbook and intimation templates.

These obligations come into force eighteen months from 13 November 2025 (commencement note under s.1(2); Rule 1(4)).

Frequently asked questions

Do employers need employee consent under the DPDP Act?

Not for everything. Section 7(i) allows processing without consent for the purposes of employment or to safeguard the employer from loss or liability. Uses outside that, such as optional programmes, generally need consent that meets section 6(1).

Does the DPDP Act apply to job applicants' CVs?

Yes, if the CV is processed in digital form or digitised (s.3(a)). The Act does not say expressly whether pre-hire processing falls under section 7(i), so record whether you rely on section 7(a), section 7(i) or consent.

Can an employer monitor employees under the DPDP Act?

Section 7(i) names safeguarding the employer from loss or liability, such as preventing corporate espionage and protecting trade secrets. Monitoring data must still be secured (s.8(5)) and erased when no longer needed (s.8(7)). Tracking or behavioural monitoring of anyone under eighteen is barred by section 9(3).

How long can we keep former employees' data?

Until the purpose is no longer served, unless another law requires retention (s.8(7)). Separately, Rule 8(3) requires processing logs and associated data to be kept for at least one year.

Is a payroll provider a Data Processor?

Usually yes, if it processes employee data on your behalf (s.2(k)). You remain responsible for its processing (s.8(1)) and must engage it under a valid contract (s.8(2)) that provides for security safeguards (Rule 6(1)(f)).