Every employer holds more personal data about its own staff than about almost anyone else it deals with. An employee data privacy policy is the document that explains what is collected, why, who sees it and when it is destroyed, and under the Digital Personal Data Protection Act 2023 it is becoming a compliance document rather than an HR courtesy.

The Act treats the employer as a data fiduciary in respect of its employees, and the Digital Personal Data Protection Rules notified in November 2025 bring the core obligations into force on a phased timetable, with most of them currently scheduled for May 2027, subject to any change the government makes to the transition period. Our note on compliance obligations and penalties under the DPDP framework covers the general position. This note applies it to the employment relationship.

Key Takeaways

  • An employer that processes digital personal data of applicants, staff and former staff is a data fiduciary for that data under the Act.
  • Section 7(i) permits processing for the purposes of employment without consent, but the purpose still has to be genuinely related to employment.
  • Monitoring of email, devices, CCTV and location should be proportionate to a stated purpose and disclosed in advance.
  • Retention periods should be set by category, and data should be erased once the purpose is served and no law requires it to be kept.
  • Payroll processors, HRMS providers and background check agencies act on the employer's behalf, and the employer remains answerable for them.

What HR Data an Employer Actually Holds

The volume is easy to underestimate because it accumulates across the whole employment lifecycle. At hiring, there are applications, CVs, interview notes, assessment results and reference reports, many of them about people who were never hired. Background checks add identity documents, address verification, education and previous employment records, and sometimes credit or criminal record checks.

During employment, payroll holds bank details, tax identifiers, salary history and statutory deductions. Benefits administration adds family details for nominations and insurance. Attendance systems may hold biometric records. Leave files and medical certificates hold health information, and the internal committee under the POSH law holds some of the most sensitive records an organisation keeps.

Performance management adds appraisals, disciplinary notes and investigation files. At exit, there are resignation correspondence, full and final settlement records, exit interviews and the relieving and experience letters that a former employee may need years later.

The Act does not create a separate category of sensitive data in the way some foreign laws do, but health, biometric and disciplinary records still warrant tighter access and shorter retention. A sound approach to HR data protection in India begins by mapping all of this, system by system, before a word of policy is drafted.

Employee data privacy policy across the HR lifecycle

The Employment Legitimate Use and Its Limits

Section 4 of the Act allows personal data to be processed either with consent or for certain legitimate uses. Section 7(i) lists one of those uses as processing for the purposes of employment or those related to safeguarding the employer from loss or liability, such as prevention of corporate espionage, maintenance of confidentiality of trade secrets, intellectual property and classified information, or provision of any service or benefit sought by an employee.

That provision does most of the work for routine HR processing. Running payroll, administering leave, complying with labour and tax filings, managing performance and protecting confidential information all fall comfortably within it, and the employer does not need to collect consent for each.

The limits matter as much as the permission. The processing must actually be for an employment purpose. Using staff data to market products to employees' families, sharing it with a group company for unrelated analytics, or retaining applicants' files indefinitely to build a talent database are difficult to fit within the provision.

There is also a practical reason not to rely on consent where the legitimate use applies. Consent under section 6 must be free, specific, informed and unambiguous, and it can be withdrawn. In an employment relationship the balance of power makes it hard to show that consent was truly free, and a withdrawal would leave the employer with no basis for processing it still needs.

Notice, Consent and the Policy Document

The legitimate use route removes the need for consent, not the need to be open. Employees should be told, in clear language, what categories of data are held, for what purposes, with whom they are shared and how they can raise a concern. That is what the policy is for.

Where processing falls outside employment purposes, consent becomes the basis and must meet section 6. Typical examples are voluntary wellness programmes, optional photographs for marketing material, and processing of family members' data beyond what is needed to deliver a benefit the employee asked for. Each needs a separate, itemised request with a clear notice, and refusal should carry no consequence.

The policy should be referenced in the appointment letter and in the employment contract clauses that govern confidentiality and conduct, and acknowledged on joining. Acknowledgement is not consent, and the documents should not pretend that it is.

Finally, the policy must name a point of contact. The Act requires a data fiduciary to publish the business contact information of a person who can answer questions about processing, and to provide an effective means of grievance redressal. For most employers that is a named role in HR or compliance with a dedicated mailbox.

Workplace Monitoring Without Overreach

Monitoring is where policy most often runs ahead of law. Employers monitor company email, laptops, phones and network traffic for security; they run CCTV for safety; and field teams may be tracked by location. Each of these can be lawful, and each can become a problem when it is broader than its purpose.

Section 7(i) expressly mentions safeguarding the employer from loss or liability, which supports security monitoring of company systems. It does not authorise everything that is technically possible. Workplace monitoring stays on safer legal ground when it is tied to a stated purpose, limited to what that purpose needs and disclosed in advance.

The policy should address each form of monitoring separately.

  • Email and devices: what is logged, whether content is reviewed or only metadata, and who may authorise a review.
  • CCTV: where cameras are placed, with no coverage of washrooms or changing areas, and how long footage is kept.
  • Location: tracking limited to working hours and work devices, with no tracking of personal phones outside duty.
  • Personal devices: what the employer can access on a device used under a bring your own device arrangement.

Access to monitoring data should be restricted, logged and reviewed. An investigation that relies on records gathered outside the disclosed policy is harder to defend, whether before an internal committee or in court.

Workplace monitoring legal checks for employers

Retention, Deletion and Former Employees

Section 8(7) requires a data fiduciary to erase personal data once the data principal withdraws consent or the specified purpose is no longer being served, unless retention is necessary for compliance with law. In HR, that principle collides with a great many statutory record keeping duties, and the policy has to reconcile the two.

The workable answer is a retention schedule by category. Payroll and statutory registers are kept for the periods that labour and tax laws prescribe. Records needed to defend a likely claim are kept for the relevant limitation period. Unsuccessful applicants' data is kept for a short, stated period and then deleted unless the applicant asks to be considered for future roles.

Deletion has to happen in practice, not only on paper. That means deleting from the HRMS, from shared drives, from email archives and from vendors' systems, and keeping a record that it was done. Backups are the usual weak point, and the schedule should say how they are handled.

Former employees retain their rights under the Act, including the right to access a summary of their data and to seek correction or erasure where no basis for retention remains. A request from a departing employee in a dispute is common, and the employer should be able to answer it from a known map of where the data sits.

Vendors, Breaches and Accountability

Most employers do not run their own payroll engine or HR platform. Payroll processors, HRMS providers, background verification agencies, insurers and recruitment firms all handle employee data on the employer's behalf. Under section 8(2) the employer may engage a data processor only under a valid contract, and the employer remains responsible for what the processor does.

Those contracts should set out the permitted purposes, security standards, restrictions on onward transfer and subcontracting, audit rights, deletion or return at the end of the engagement, and immediate notice of any breach. Our note on data protection agreements with vendors sets out the clauses in more detail.

Section 8(5) requires reasonable security safeguards, and section 8(6) requires a data fiduciary to intimate a personal data breach to the Data Protection Board and to each affected data principal. Rule 7 of the DPDP Rules adds an initial intimation without delay and a detailed report within seventy two hours, unless the Board allows longer. An HR breach is often discovered through a vendor, so the vendor's notice obligation has to be tight enough for the employer to meet its own.

A matter involving a healthtech data breach shows how quickly the response depends on having these arrangements in place beforehand. The background to the Act is a useful reference for the wider framework.

Conclusion

For employers, the DPDP employer obligations are less about new paperwork than about knowing what they hold and being able to justify it. A clear map of HR data, a defensible reliance on the employment legitimate use, proportionate monitoring, a retention schedule that is actually applied and tight vendor contracts together cover most of the ground.

The phased commencement gives employers time to get this right before the core obligations apply, and that time is best used on a review by a data privacy lawyer of the policy, the contracts and the systems together. The employment contracts practice page sets out how that review is normally scoped.