Employee data under the DPDP Act: a practical guide for HR

HR teams hold some of the richest personal data in any organisation: bank details, PAN and Aadhaar, family members, medical certificates, performance reviews, even biometric attendance. The DPDP Act applies to all of it.

The good news: section 7(i)

Employers don’t need consent for everything. Section 7(i) allows processing for the purposes of employment or to safeguard the employer from loss or liability, such as:

• preventing corporate espionage,
• maintaining confidentiality of trade secrets, intellectual property and classified information, and
• providing a service or benefit sought by an employee.

That covers most core HR processing: payroll, statutory deductions, attendance, leave, appraisals, and IT security.

Where to be careful

Section 7(i) is not a blanket licence. Think carefully about:

• Family members’ data (dependants for insurance, emergency contacts). They are Data Principals too.
• Health data beyond what’s needed, such as sharing medical certificates widely.
• Monitoring: keystroke logging, screen capture and location tracking. Is it really needed to protect the business, and is it proportionate?
• Social media checks on current employees.
• Using employee data for unrelated purposes, such as marketing a group company’s products.

Where you go beyond employment purposes, consider consent. Remember that consent from an employee must be free, which is hard when your job depends on it.

Duties that still apply

• Notice: even without consent, tell employees what you process and why. An employee privacy notice is good practice and avoids disputes.
• Security: payroll files and HR systems are breach magnets. Restrict access.
• Breach reporting: a leaked salary sheet is a personal data breach.
• Accuracy: data used for promotions or terminations must be accurate.
• Retention: keep records for as long as labour, tax and PF laws require, then delete. Set a schedule for ex-employees and rejected candidates.
• Rights: employees can ask for a summary of their data and corrections.

Vendors

Payroll processors, HR software, background verification agencies, insurance brokers and wellness apps are Data Processors (or sometimes fiduciaries). Each needs a contract covering security, breach reporting and deletion.

A one-page HR checklist

1. List every HR system and spreadsheet.
2. Tag each purpose as employment (s.7(i)), legal obligation, or consent.
3. Write an employee privacy notice.
4. Review monitoring tools for proportionality.
5. Set retention periods for employees, ex-employees and candidates.
6. Lock down access to payroll and medical files.
7. Sign processor contracts with HR vendors.

Go deeper

Our courses include an HR module with sample notices. Browse the courses.

This article is for education and is not legal advice.