HR teams hold some of the most sensitive personal data in any organisation: identity documents, bank details, salary, health insurance information, performance reviews, disciplinary records and background check reports. The Digital Personal Data Protection Act, 2023 (DPDP Act) and the DPDP Rules, 2025 apply to all of it, from the first job application to records kept long after an employee leaves.

The good news for employers is that the Act recognises employment as a legitimate reason to process personal data without consent in many cases. The catch is that this exemption has limits, and the other obligations, such as security, retention, breach response and rights handling, still apply. This guide explains how the DPDP Act applies to employee data and what HR teams should put in place before the main obligations take effect in May 2027.

The Legitimate Use for Employment: Section 7(i)

Section 7 lists “certain legitimate uses” for which consent is not required. Clause (i) covers processing:

• for the purposes of employment, or
• related to safeguarding the employer from loss or liability, such as prevention of corporate espionage and maintaining the confidentiality of trade secrets, intellectual property or classified information, or
• to provide any service or benefit sought by a Data Principal who is an employee.

This covers much of day-to-day HR: payroll, attendance, statutory deductions, performance management, benefits administration and security controls. But the wording raises practical questions that the Act does not fully answer, as commentators have noted:

• Job applicants: it is not settled whether recruitment, shortlisting and pre-employment checks fall within “purposes of employment,” since a candidate is not yet an employee.
• Former employees: keeping data after exit may need another basis, such as a legal obligation to retain records.
• Contractors, interns and consultants: they may not be “employees” for this clause, so a separate basis may be needed.
• Optional programmes: wellness apps, social events or marketing uses of employee photos are harder to justify as employment purposes.

Where the legitimate-use basis is uncertain, consent with a proper notice is often the safer route. Other clauses of Section 7, such as compliance with a legal obligation, may also apply, for example to statutory registers and tax records.

The HR Data Lifecycle Under the DPDP Act

Swipe the table sideways to see all columns.

The “likely basis” column is a starting point, not a legal conclusion. Each organisation should document its own assessment.

Obligations That Apply Even Without Consent

Purpose Limitation

Data collected for employment should be used for employment. Using HR data for unrelated purposes, such as marketing a group company’s products to employees, needs its own basis.

Security Safeguards

Section 8(5) requires reasonable security safeguards. Rule 6 sets minimum measures, including encryption, masking or tokenisation, access controls, logging and monitoring, backups, and appropriate contract terms with Data Processors. For HR, that means restricting who can open salary, health and disciplinary data, and removing access promptly when HR staff leave.

Retention and Erasure

Section 8(7) requires erasure once the purpose is no longer served, unless retention is necessary to comply with law. Labour, tax and company laws require some records to be kept for set periods, so HR needs a retention schedule by data category, not a blanket “keep everything” policy. Rule 8 also requires certain data and logs to be kept for at least one year for specified purposes.

Breach Notification

Once the breach provisions apply in May 2027, Rule 7 requires informing affected individuals without delay, and informing the Data Protection Board without delay with a detailed report within 72 hours of becoming aware. A leaked salary sheet or a compromised HRMS account is a personal data breach.

Data Principal Rights

Employees have rights under Sections 11 to 14: to access information about their personal data, to correction, completion, updating and erasure, to grievance redressal, and to nominate another person. Rule 14 requires grievances to be addressed within a reasonable period not exceeding 90 days. Some erasure requests can be declined where the law requires retention, but the response should explain why.

Vendors and Processors

Payroll providers, HRMS platforms, background verification agencies, insurers and recruitment portals often process employee data. Under Section 8(2), a Data Fiduciary can engage a Data Processor only under a valid contract, and remains responsible for compliance. Review these contracts for security, breach notification, sub-processing and deletion terms.

Children’s Data

If you hire or offer internships to anyone under 18, Section 9 requires verifiable consent of a parent or lawful guardian before processing their data, along with restrictions on tracking and monitoring. Check age at the application stage.

Employee Monitoring: Where Is the Line?

Monitoring of company systems, email and devices can fall within safeguarding the employer from loss or liability, but it should be proportionate to a clear risk and disclosed in an IT or acceptable-use policy. Broad, undisclosed monitoring of personal devices, location or social media is harder to justify and raises other legal questions. Document the purpose, scope and access rules for any monitoring tool.

Penalties

The Schedule to the Act sets maximum penalties per instance. Failure to take reasonable security safeguards can attract up to ₹250 crore; failure to notify a breach, or breach of children’s data obligations, up to ₹200 crore each; and other breaches of the Act or Rules up to ₹50 crore. The Data Protection Board decides the amount based on factors set out in the Act. Our DPDP Act penalties guide explains how these are applied.

Timeline: When Do These Obligations Apply?

Swipe the table sideways to see all columns.

HR processes such as HRMS contracts and retention schedules take time to change, so starting now leaves room to fix gaps before May 2027.

DPDP Checklist for HR Teams

• Map all employee, candidate, contractor and former-employee data, and where it is stored
• Record the lawful basis for each purpose: employment legitimate use, legal obligation or consent
• Update job application forms and portals with a clear notice
• Review background verification consent and the vendor contract
• Restrict access to salary, health and disciplinary data by role
• Review contracts with payroll, HRMS, insurance and recruitment vendors
• Set a retention schedule by data category, tied to legal requirements
• Define a process for employee access, correction and erasure requests
• Publish a grievance contact and respond within 90 days
• Add HR scenarios, such as a leaked payroll file, to the breach response plan
• Document monitoring tools and update the IT policy
• Check age for interns and young hires
• Train HR staff and managers who handle employee data

Frequently Asked Questions

Build Privacy Into HR Processes

The employment legitimate use makes DPDP compliance manageable for HR, but it is not a blanket exemption. Map your HR data, document the basis for each use, tighten access and vendor contracts, and set a retention schedule well before May 2027. For the full picture, see our DPDP Act 2023 compliance guide and 12-point readiness checklist.

This article provides general information and is not legal advice. The interpretation of several DPDP provisions is still developing; obtain advice on your organisation’s specific processing.

Sources: Ministry of Electronics and Information Technology (DPDP Act, 2023 and DPDP Rules, 2025)