DPDP for employers and HR teams

Every employer is a Data Fiduciary. HR holds more personal data about each person than most businesses hold about customers: identity and address proofs, bank accounts, salary, tax, family members, health, biometrics, performance reviews, disciplinary records and, increasingly, a log of everything the person does on a work laptop. Unlike customers, employees cannot easily walk away, so the balance of power is uneven and the Board is likely to look hard at whether processing is fair.

The Act helps employers with section 7(i): processing “for the purposes of employment” and to safeguard the employer from loss or liability needs no consent. That is a wide door, but it is not unlimited. The risk sits at the edges: candidates who never became employees, family members on insurance policies, monitoring that goes beyond protecting the business, health data, and records kept long after people leave. This guide applies the Data Fiduciary playbook to people processes.

Are you a Data Fiduciary, a processor, or both?

• Employer: you are the Data Fiduciary for candidates, employees, interns, former employees, and the family members and nominees employees tell you about. Your HRMS, payroll provider, attendance system vendor, background verification (BGV) firm, recruitment platform, learning platform and cloud host are usually your Data Processors.
• Group companies: each employing entity is a fiduciary. A shared-services centre that runs HR for the group is a processor for the other entities, and needs a contract with each.
• Insurers and TPAs: for group health insurance, the insurer is a separate fiduciary for claims. You are a fiduciary for the enrolment data you send.
• Background verification firms: usually your processor when they check what you ask. Some keep a database of past checks for their own use, which makes them a separate fiduciary for that database. Find out which model your vendor runs.
• Staffing and contractor agencies: the agency is the employer and fiduciary for its workers’ employment records. You are a separate fiduciary for what you collect yourself: site access, attendance at your premises, and your own system accounts.
• EPFO, ESIC and the tax department: you disclose to them under law (7(d)); they are not your processors.

The data you hold

Data category	Where it usually lives	Typical purpose	Sensitivity	Typical retention
Candidate CVs, applications, interview notes, assessments	ATS, recruiter email, agencies, job portals	Hiring	Medium	A short fixed period for unsuccessful candidates
Identity and address documents, PAN, masked Aadhaar, photographs	HRMS, BGV vendor, shared drives	Onboarding, statutory compliance	High	During employment, then as labour and tax laws require
Bank details, salary, tax declarations, Form 16, loans and advances	Payroll system, accounts	Payroll, tax	High	As tax and wage laws require
PF, ESI and other statutory registrations	Payroll, government portals	Social security compliance	High	As social security laws require
Family members, dependants and nominees	HRMS, insurer and TPA portals	Insurance, gratuity and PF nominations	High (includes children’s data)	While the benefit runs
Attendance and leave, including biometric templates	Biometric devices, attendance vendor, HRMS	Attendance, wages	High (biometrics)	Attendance as wage law requires; biometric templates only while employed
CCTV and access-card logs	Security vendor, access control system	Security, safety	Medium to high	Short, rolling
Device, email, browsing and DLP logs, screen captures	IT, endpoint and DLP tools, SIEM	Security, preventing leaks	High	Short; longer only for investigations
GPS and field-force tracking	Field-force app	Field work, safety, travel claims	High (location)	Short; working hours only
Medical certificates, fitness checks, disability accommodations, EAP use	HR, occupational health, insurer	Leave, safety, accommodations	Very high	Only as long as needed; restrict access
Performance reviews, promotions, PIPs, disciplinary records	HRMS, manager files	Performance management	High	During employment, then for legal claims
POSH complaints and inquiry records	Internal Committee files	Inquiry under the POSH Act	Very high	As the POSH Act and legal claims require
Exit records, full and final settlement, references, alumni contacts	HRMS, alumni portal	Exit, references, alumni relations	Medium	Statutory records kept; alumni use on consent

Risk hotspots

1. Treating 7(i) as covering everything. HR teams read “employment” as “anything HR does”. Failure: marketing to employees’ families, sharing staff data with partners, or using employee photos in ads with no basis. Control: test each purpose against the words of 7(i): employment, protecting the employer from loss or liability, or a service or benefit the employee asked for. Put everything else on consent.
2. Candidates and recruitment. Candidates are not yet employees, and CVs pile up across recruiters’ inboxes, agencies and job portals. Failure: CVs kept for years, shared across group companies, or used to build talent-marketing lists. Control: a notice at application, consent for keeping the CV for future roles, and a fixed erasure period for unsuccessful candidates.
3. Background verification. BGV firms collect education, employment, address, criminal record and sometimes credit and social media checks. Failure: checks beyond what the role needs, and BGV firms keeping data for their own database. Control: a role-based check matrix, a notice that tells the candidate what will be checked and by whom, consent before the check, and a processor contract that forbids the vendor’s own use.
4. Biometric attendance. Fingerprint and face recognition devices are cheap and common. Failure: raw images stored on devices or in a vendor’s cloud, no erasure on exit, and a breach that cannot be fixed because nobody can change a fingerprint. Control: store templates, not images; encrypt; erase on exit; and offer an alternative such as cards or mobile check-in where a biometric is not essential.
5. Employee monitoring and DLP. Endpoint monitoring, screen capture, keystroke logging, email scanning and productivity scoring. Failure: monitoring that goes beyond protecting the business, such as continuous screenshots, personal accounts captured on BYOD, or webcam checks at home. Control: a written monitoring policy, a proportionality note for each tool, no keystroke logging or webcam capture as a default, and access to monitoring data only for named investigations.
6. Health data. Sick-leave certificates, pre-employment medicals, disability accommodations, insurance claims and EAP sessions. Failure: managers see diagnoses; claim details flow from the TPA to HR. Control: HR receives only fitness or leave outcomes; diagnoses stay with the doctor, insurer or occupational health team; EAP providers give only aggregate reports.
7. Family members and dependants. Spouses, parents and children enrolled in insurance are separate Data Principals; children are under 18. Failure: no notice reaches family members, and children’s data is processed without any thought to section 9. Control: ask the employee to share the notice with dependants, collect only what the policy needs, and record the employee’s consent as the parent for child dependants.
8. Payroll and HR vendors. Payroll, HRMS and benefits platforms hold the whole workforce. Failure: a vendor breach exposes salaries, bank details and PAN. Control: section 8(2) contracts, SSO and MFA, field-level encryption for bank details and identity numbers, and a breach notice clause with a short deadline.
9. POSH inquiries. These records combine allegations, witness statements and sexual details. Failure: inquiry files on shared drives, or details shared beyond the Internal Committee. Control: a restricted repository, POSH Act confidentiality, and erasure only after the legal-claims period.
10. Exit and alumni. Accounts stay live, data stays in every tool, and alumni get marketing. Failure: access by former employees, and processing after the purpose ends. Control: an exit checklist that closes access and starts retention timers, and consent for alumni networks and rehire marketing.

Legal basis, purpose by purpose

Purpose	Basis	Notes
Receiving applications and assessing candidates	7(a) where the candidate voluntarily applies for a role, or consent	Candidates are not employees; do not assume 7(i).
Keeping a CV for future roles or a talent pool	Consent	A separate, optional choice.
Background verification	Consent, collected before the check	7(i) may support checks a role legally requires; consent is the safer basis for the rest.
Onboarding, contract, identity and statutory registration	7(i), and 7(d) for statutory filings	Use masked Aadhaar where Aadhaar is legally needed; do not keep copies otherwise.
Payroll, tax deduction, PF, ESI and other statutory contributions	7(i) and 7(d) / retention required by law	Share only what the statutory forms need.
Attendance and leave, including biometrics	7(i)	Keep biometrics to attendance; erase templates on exit.
Security monitoring, DLP and access logs	7(i) (safeguarding against loss or liability, such as leaks of trade secrets)	Proportionate monitoring only; document each tool.
Investigating misconduct or suspected offences	7(i), and section 17(1)(c) where an offence is suspected; section 17(1)(a) for legal claims	Sections 8(1) and 8(5) still apply under section 17(1).
Group health insurance and voluntary benefits	7(i) (a benefit sought by the employee)	Dependants’ data only as the policy needs; for child dependants, the employee consents as parent.
Health data for leave, fitness and accommodations	7(i) for what employment needs; consent for anything beyond	Keep diagnoses out of HR files.
POSH inquiries	7(i) and the POSH Act; section 17(1)(a) for legal claims	Whether an Internal Committee falls under section 17(1)(b) is unsettled. Confirm with counsel.
Employee photos and stories in marketing and social media	Consent	Revocable; not a condition of employment.
References for former employees	Consent of the former employee, or 7(a) where they named you as a referee	Keep references factual (section 8(3) accuracy applies when shared).
Alumni networks, rehire campaigns and events	Consent	Not 7(i); the employment has ended.

The limits of 7(i), and a gap in the rights

Section 7(i) covers “the purposes of employment or those related to safeguarding the employer from loss or liability, such as prevention of corporate espionage, maintenance of confidentiality of trade secrets, intellectual property, classified information or provision of any service or benefit sought by a Data Principal who is an employee”. Three limits follow from the text:

• It is about employees. Candidates, alumni and the agency’s contract workers are not your employees, so look for another basis for them.
• “Benefit sought by” the employee means benefits the employee asks for. It does not cover products you choose to market to staff.
• Protection from loss or liability must be real and proportionate. Monitoring a laptop for data exfiltration fits; tracking an employee’s location at weekends does not.

Two technical points matter. The section 5 notice is tied to consent requests, and the rights to access and correction in sections 11 and 12 attach to data given with consent or under 7(a). Processing that rests only on 7(i) is therefore outside the strict wording of those sections. Do not rely on this gap. Labour laws, fairness and employee trust all point the same way: give every employee a notice, and answer their requests. The grievance right in section 13 and your security and breach duties apply whatever the basis.

Notices and consent: getting the screens right

Channel	Do	Don’t
Careers page and job portals	Show a short notice at application: what you collect, who sees it, how long you keep it. Make the talent-pool option a separate, unticked choice.	Ask for date of birth, marital status, religion or a photo at the application stage.
Recruitment agencies	Require the agency to give your notice, or its own, before forwarding CVs, and to tell you the source.	Accept CVs the agency scraped from job sites.
BGV authorisation	Tell the candidate which checks, which vendor, and which data sources, and get consent before starting.	Run checks before the offer is accepted, or check social media without telling the candidate.
Onboarding portal and HRMS	Give the employee privacy notice at onboarding, in the employee’s language where needed. Collect only the fields each statutory form needs.	Upload full Aadhaar copies for every employee.
Biometric and attendance devices	Put a notice at the device and in the policy. Offer an alternative where a biometric is not essential.	Use the attendance camera for other monitoring.
Company laptops, email and BYOD	Publish a monitoring policy that says what is captured and when. Separate personal and work profiles on BYOD.	Install monitoring on personal devices without a clear, limited policy.
Field-force apps	Track only during working hours and tell employees when tracking is on.	Track location 24 hours a day.
Factory, warehouse and branch floors	Use printed notices in the local language and briefings by supervisors for staff without email.	Assume a notice on the intranet reaches shop-floor or contract workers.
Exit interviews and alumni portals	Ask for alumni and rehire-marketing consent as separate choices at exit.	Move every leaver into a marketing list.

Every notice must stand on its own, itemise the data and purposes, and give a link or other means to withdraw, exercise rights and complain to the Board (rule 3). Employees must be able to read it in English or any of the 22 Eighth Schedule languages (section 5(3)). For a multi-state workforce, start with Hindi and the languages of your largest sites.

Other laws you must line up with

• The four labour codes (Code on Wages, 2019; Industrial Relations Code, 2020; Code on Social Security, 2020; Occupational Safety, Health and Working Conditions Code, 2020) and state rules: registers, wage records, attendance, social security and health checks that you must keep for prescribed periods. These replace older laws such as the EPF, ESI and Factories Acts as they take effect. Confirm the current status and periods in your state with counsel.
• Employees’ Provident Funds and ESI schemes: member data and nominations shared with EPFO and ESIC (7(d)).
• Shops and Establishments Acts: registers of employees and hours for shops, offices and establishments, set state by state.
• Income-tax Act: TDS, Form 16 and investment declarations; tax records override erasure for those records only.
• Sexual Harassment of Women at Workplace (Prevention, Prohibition and Redressal) Act, 2013 (POSH Act): confidentiality of the identity of the complainant, respondent and witnesses, and of inquiry proceedings.
• Rights of Persons with Disabilities Act, 2016: reasonable accommodation and equal-opportunity duties; disability records need careful access control.
• Aadhaar Act, 2016: private employers should not require Aadhaar unless a law permits it. Use masked Aadhaar or offline e-KYC where it is legally needed.
• Contract Labour laws and the OSH Code: the principal employer’s duties for contract workers, such as attendance and wage registers.
• Companies Act, 2013: registers and disclosures about directors and key managerial staff.
• IT Act, 2000 and CERT-In Directions (2022): cyber incidents must be reported to CERT-In on a much shorter clock than the DPDP 72 hours. Confirm the current requirement with counsel.
• Sector rules: banks, insurers and listed companies have extra rules on staff screening, trading-window monitoring and call recording. Confirm with counsel.

Retention and erasure

1. When the purpose ends (section 8(7)): a candidate is rejected, an employee leaves, a benefit ends, or an investigation closes. Stop using the data. Keep only what labour, tax and social security laws require, and what you need for legal claims (section 17(1)(a)).
2. The one-year minimum (rule 8(3)): keep personal data, traffic data and processing logs for at least one year from the processing, then erase them unless another law requires longer. HRMS and payroll access logs fall here too (rule 6(1)(e)).
3. Legal holds: wage and attendance registers, PF and ESI records, tax records, POSH files, disciplinary records under challenge, and anything subject to a court or labour authority order. Tag these in the HRMS so retention jobs skip them.
4. Short-lived data: unsuccessful applications, BGV reports after onboarding, biometric templates after exit, CCTV, GPS history and routine DLP logs. Set a short, fixed period for each.
5. The Third Schedule: it does not apply to employers as such. It covers large e-commerce, online gaming and social media platforms.
6. Processors and backups: make your HRMS, payroll, BGV, attendance and recruitment vendors erase on instruction and confirm it. Document backup retention, and make sure restored backups replay erasures.

Rights requests and grievances

• Channels: the HRMS self-service portal, an HR helpdesk address, and a route for former employees and candidates who no longer have a login. Publish them with the identifier you need: employee ID, application reference number or registered email (rule 14).
• Identity: use the employee’s SSO login or an OTP to the registered contact. For former employees, use the details you already hold. Do not ask for new identity documents.
• Access (section 11): give a summary of the data you hold and how you process it, and list the other fiduciaries and processors you shared with: payroll, HRMS, BGV firm, insurer and TPA, EPFO and ESIC. Even where section 11 does not strictly apply to 7(i) processing, answer it.
• Correction (section 12): correct names, bank details, addresses and family details promptly. Performance ratings and inquiry findings are opinions; record the employee’s disagreement alongside them rather than rewriting them.
• Erasure (section 12(3)): erase talent-pool CVs, alumni and marketing data, photos and optional data. Refuse erasure of statutory registers, tax and PF records, and data needed for legal claims, and say which law or purpose.
• Grievances: publish a response period inside the 90-day ceiling (rule 14(3)); 15–30 days is good practice. Name your DPO or contact person in every reply (rule 9). Keep DPDP grievances separate from POSH complaints and general HR grievances, but route them to each other where they overlap.
• Nomination (section 14): let employees nominate someone to exercise their DPDP rights. This is separate from PF and gratuity nominations; make that clear on the form.

Breach readiness

Likely scenarios:

• a payroll or HRMS vendor breach exposing salaries, bank details and PAN
• a salary sheet emailed to the wrong distribution list
• a recruiter’s mailbox compromised, exposing thousands of CVs
• a biometric attendance database exposed on the internet
• an insider downloading employee data before leaving
• POSH or disciplinary files on an open shared drive

Run-book:

1. Contain within hours: recall emails where possible, revoke access and vendor keys, take exposed systems offline.
2. Assess: which data, how many people (including candidates, former employees and dependants), and which consequences: fraud with bank details and PAN, identity theft, reputational harm for POSH and health records.
3. Notify affected people without delay through their registered contact, covering every point in rule 7(1): what happened and when, the likely consequences, what you are doing, what they can do (for example, watch bank accounts and report phishing calls), and a contact.
4. Notify the Board without delay, then send the detailed report within 72 hours (rule 7(2)).
5. Report to CERT-In where its directions apply, and tell banks or insurers where their data or systems are involved.
6. Learn: fix the root cause, review the vendor contract, and retrain the teams involved.

The checklist

Phase 1: discover (days 0–30)

• [Leadership] Appoint a DPDP owner for people data and a working group: HR, payroll, IT, security, legal, admin and facilities.
• [HR] Map every people process: hiring, BGV, onboarding, payroll, attendance, leave, benefits, performance, monitoring, POSH, exit and alumni.
• [Eng] Inventory every system: ATS, HRMS, payroll, attendance, biometric devices, LMS, DLP and endpoint tools, CCTV, shared drives, backups.
• [HR] Find the shadow data: recruiters’ mailboxes, spreadsheets of salaries, managers’ personal files, WhatsApp groups.
• [Legal] List every HR vendor (HRMS, payroll, BGV, recruitment agencies, job portals, insurers, TPAs, EAP) and collect their contracts.
• [Security] List every monitoring tool and what it captures: screenshots, keystrokes, email, web, location, webcam.
• [HR] Find where you hold health, disability, biometric and dependants’ data, including children.
• [Legal] Map the records labour codes, Shops and Establishments Acts, tax and social security laws require you to keep, by state.
• [HR] List contract, agency and gig workers on your premises and which entity employs them.
• [HR] Find any candidates, interns or apprentices under 18, whose data needs verifiable parental consent under section 9.

Phase 2: design and build (days 31–90)

• [Legal] Assign a basis to every purpose using the table above, and move anything outside 7(i) to consent.
• [Legal] Write an employee privacy notice, a candidate notice and a contractor notice.
• [HR] Translate the notices into Hindi and the languages of your largest sites; make all 22 available on request.
• [HR] Add a separate, unticked talent-pool consent to the careers page and the ATS.
• [HR] Set an erasure period for unsuccessful candidates and configure the ATS to apply it.
• [HR] Build a role-based BGV matrix, and a BGV consent form that names the checks and the vendor.
• [Legal] Make BGV contracts forbid the vendor’s own use and require erasure after the report.
• [HR] Remove application-stage questions on religion, marital status, photos and date of birth unless a law requires them.
• [Eng] Replace full Aadhaar copies with masked Aadhaar where Aadhaar is legally needed, and delete stored copies.
• [Security] Write a monitoring policy and a proportionality note for each monitoring tool; turn off keystroke logging and webcam capture by default.
• [Security] Limit field-force GPS tracking to working hours, with a visible indicator.
• [Eng] Store biometric templates, not images; encrypt them; erase them on exit; offer an alternative where possible.
• [HR] Route medical certificates and diagnoses away from managers; HR sees outcomes only.
• [Finance] Limit dependants’ data sent to the insurer and TPA to what the policy needs; give employees a notice to share with dependants.
• [HR] Set up a restricted repository for POSH and disciplinary files, with Internal Committee-only access.
• [Security] Encrypt bank details, PAN and identity numbers in the HRMS and payroll; enforce SSO and MFA.
• [Eng] Keep HRMS and payroll access logs for at least one year.
• [Legal] Add DPDP clauses to HR vendor contracts: security, breach notice, erasure, one-year logs, sub-processors, audit.
• [Legal] Set terms with staffing agencies stating who is the fiduciary for which contractor records, and who answers their requests.
• [Marketing] Ask for separate, revocable consent before using employee photos, videos or stories in marketing.
• [HR] Build an exit checklist that closes access, erases optional data and starts retention timers.
• [HR] Ask for alumni and rehire-marketing consent separately at exit.
• [HR] Publish the HR privacy page: contact person, request channels for current and former staff and candidates, identifier needed, grievance period.
• [Ops] Set up the rights workflow in the HR helpdesk, with SLA timers and a correction procedure for opinions.
• [Security] Write the breach run-book for HR data, including misdirected salary emails.

Phase 3: operate (ongoing)

• [DPO] Review new HR tools, monitoring features and AI hiring tools before rollout.
• [HR] Train recruiters, HR business partners and managers every year on candidate data, health data and confidentiality.
• [Security] Review who can see monitoring data every quarter, and log every investigation that uses it.
• [HR] Check every quarter that unsuccessful applications, BGV reports and leavers’ biometric templates are erased.
• [Security] Check every month that leavers’ accounts were closed on their last day.
• [Marketing] Before each campaign, check employee-photo consents and remove content where consent was withdrawn.
• [Legal] Review HR vendor contracts and renewals every quarter.
• [Security] Run a breach tabletop drill every year, for example a payroll vendor breach, against the 72-hour clock.
• [HR] Review rights and grievance timelines every month.
• [Legal] Re-check labour code rules and state registers with counsel every year.
• [DPO] Keep evidence: notices, consents, BGV authorisations, erasure confirmations, training records.

Where myconsentapp comes in

You need to	With myconsentapp	You still own
Record which purposes rest on 7(i) and which need consent	Define purposes (payroll, attendance, monitoring, talent pool, BGV, photos in marketing, alumni) once, each tagged consent or legitimate use, with sensitivity and retention.	Deciding the basis for each purpose.
Ask candidates and employees for consent	The hosted consent page (link or QR code), the widget in your careers page, or the SDKs in your HR app. Each purpose is a separate toggle, off by default.	Choosing the moment in the journey.
Record paper forms from the shop floor	Record consent captured elsewhere, marked as not verified by the person.	Keeping the paper form.
Prove consent, for example for BGV or marketing photos	Every choice is signed and hash-chained against the exact notice version, with a receipt and an evidence pack.
Stop using a photo or alumni contact after withdrawal	The verify API returns not permitted immediately; signed webhooks reach your systems; overdue alerts flag misses.	Removing the photo or contact in your tools.
Notices in workers’ languages	English and all 22 Eighth Schedule languages, with machine-translation drafts flagged for review.	Reviewing the translations.
Make HR vendors stop and erase	A processor registry with contract dates and expiry flags; processors confirm withdrawals and erasures.	Signing the contracts.
Keep statutory registers while erasing the rest	Retention obligations (legal holds) shown in the notice; a retention job and erase-on-withdrawal per purpose.	Deleting records in your HRMS.
Handle employee requests	A rights inbox with SLA timers and nomination; erasure closes with a structured proof.	The answers and the HR records.
Manage a breach	A breach register with the 72-hour clock, Rule 7 notices (English and Hindi) and Board documents.	Detecting and investigating.

Not included: myconsentapp does not connect to your HRMS or payroll out of the box (integration is through the API and webhooks), and it is not a monitoring, DLP or security tool.

Common mistakes

• Reading section 7(i) as covering candidates, alumni and marketing to staff.
• Keeping every CV ever received, in recruiters’ inboxes and the ATS.
• Collecting full Aadhaar copies from every employee and contractor.
• Running background checks before telling the candidate what will be checked and by whom.
• Storing raw fingerprint or face images on attendance devices and never erasing them.
• Turning on continuous screenshots or keystroke logging “because the tool can”.
• Letting managers see diagnoses on medical certificates and insurance claims.
• Leaving POSH inquiry files on a shared drive.

Frequently asked questions

Do we need employee consent to run payroll? No. Section 7(i) covers processing for the purposes of employment, and paying wages, deducting tax and filing PF and ESI returns are at its core. Statutory filings also rest on 7(d). Give a notice anyway.

Does 7(i) cover job applicants? Candidates are not employees yet. Where they apply voluntarily for a role, 7(a) can cover assessing them for that role. Keeping CVs for future roles, or running background checks, is safer on consent.

Can we monitor employees’ laptops and email? Section 7(i) covers safeguarding the employer from loss or liability, such as leaks of trade secrets. Monitoring must be proportionate to that aim, disclosed in a policy, and limited in who can see the results. Continuous screenshots, keystroke logging and webcam checks are hard to justify.

Is biometric attendance allowed? It can rest on 7(i) as an attendance purpose. Store templates rather than images, secure them, erase them on exit, and offer an alternative where a biometric is not essential. A biometric breach cannot be fixed by a password reset.

Do we need to answer an access request from an employee? Strictly, section 11 attaches to data given with consent or under 7(a), so pure 7(i) processing falls outside its words. Answer anyway: it is fair, it builds trust, labour law may require similar access, and the grievance right still applies.

What about dependants on our group health insurance? They are separate Data Principals. Collect only what the policy needs, give the employee a notice to share with them, and for child dependants record the employee’s consent as the parent.

Can we give a reference for a former employee? Yes, where the former employee asked you to or named you as a referee. Keep it factual and accurate, because section 8(3) applies when you disclose data to another fiduciary.

Are we likely to be a Significant Data Fiduciary because of employee data? Unlikely for employee data alone. SDF status depends on volume, sensitivity and risk across all your processing. Employers that are also large consumer platforms should assess their customer data separately.