Employee Data Under the DPDP Act: What HR Must Fix Before May 2027
The DPDP Rules were notified on 13 November 2025, with most obligations applying from May 2027. Employers can process employee data without consent for employment purposes, but must protect it, limit its use, set retention periods and report breaches. HR should map its data, restrict access and move it out of spreadsheets and chats.
HR holds more personal data than any other team: Aadhaar and PAN numbers, bank accounts, salaries, health records, biometric attendance and candidates' CVs. Under the Digital Personal Data Protection (DPDP) Act, 2023 and its Rules, how that data is handled is now a legal question.
The timeline
- ✓13 November 2025: DPDP Rules notified; Data Protection Board constituted.
- ✓13 November 2026: Rules on consent managers take effect.
- ✓May 2027 (18 months from notification): most obligations apply, including notices, security, breach reporting and data principal rights.
Penalties can reach ₹250 crore for serious failures, such as not protecting data.
Do you need employee consent?
Often, no. The Act allows legitimate use of personal data without consent for purposes of employment, to protect the employer from loss or liability, and to provide a benefit the employee asks for. Payroll, attendance, statutory filings and performance reviews generally fall here.
You still need to protect the data, use it only for those purposes, and delete it when no longer needed. For uses beyond employment, such as marketing to employees or sharing data with unrelated parties, you need consent.
Recruitment data
Candidates are not yet employees. Collect only what you need for hiring, tell candidates how you will use their data, and delete rejected candidates' data after a set period.
An HR data plan
- Map the data. List what you collect, why, where it is stored, and who can see it: HRMS, payroll files, Excel sheets, email, WhatsApp groups.
- Cut what you do not need. Do you need full Aadhaar numbers, or only the last four digits?
- Restrict access. Salary and health data should be visible only to those who need it.
- Move data out of spreadsheets and chats into a system with access control and logs.
- Write a privacy notice for employees that states what you collect and why.
- Set retention periods, for example payroll records for the period required by tax and labour laws, and delete after that.
- Prepare for breaches. Decide who investigates and who notifies the Board and the people affected.
- Check vendors. Payroll processors, background check agencies and HRMS providers must protect the data too.
A worked example
A 250-person Vadodara manufacturer found salary sheets in shared email folders, Aadhaar copies in a WhatsApp group used by supervisors, and biometric data stored on a device with a default password. It moved records into its HRMS with role-based access, masked Aadhaar numbers, deleted the WhatsApp copies, changed the device password and wrote a two-page employee privacy notice.
Frequently asked questions
Is biometric attendance allowed?
Yes, for employment purposes, but the data must be secured and used only for attendance.
Must we appoint a data protection officer?
Only significant data fiduciaries, as notified by the government, must appoint one. Most employers should still name a person responsible.
Can employees ask to see their data?
Yes. Data principals have rights to information, correction and erasure, subject to legal retention needs.
Sources
- ✓DPDP Rules 2025 notified, Mondaq
- ✓Do you need consent to process employee data? Tsaaro
- ✓DPDP Act 2023 and Rules 2025 simplified, KPMG
This is a summary, not legal advice. Confirm with a data protection professional.
Written by
HR Manager, Airwix Technologies (Sleet)
Nihit Dobariya is the HR Manager at Airwix Technologies in Ahmedabad, where he runs HR and payroll for the team behind Sleet. He writes about payroll, PF and ESIC, professional tax, the labour codes and everyday HR practice for Indian employers, and checks each rule against the official notification before it is published.
LinkedIn profile →