Employee data under DPDP: hiring, payroll, CCTV and exit

Employers can process their staff's personal data without consent "for the purposes of employment", to safeguard themselves from loss or liability, and to provide a service or benefit an employee asks for (s. 7(i)). That ground starts with most of the Act on 13 May 2027. It covers employees only. Candidates, consultants, contract workers, many interns and visitors fall outside it, and for them you need consent or another clause of section 7. The ground is a basis for processing and exempts you from nothing else: security (s. 8(5)), breach notice (s. 8(6)) and erasure (s. 8(7)) apply to all HR data, and penalties for a security failure reach ₹250 crore (Schedule, item 1). We recommend processor contracts for every HR vendor, though whether s. 8(2) strictly requires them for HR is debatable.

Like the Act (s. 2(y)), we say "she" and "her" for every person.

Jump to what you need:

• HR heads: The lifecycle table, Candidates, Background checks, Employee privacy notice, Exit and retention.
• Admin, security and IT: Monitoring and CCTV, Monitoring policy, Biometrics.
• CFOs and procurement: Payroll and other vendors, HR systems hosted abroad.
• Legal: Employee rights, Where the law is unclear.

Until May 2027, the SPDI Rules apply

The DPDP duties, including section 7(i), start on 13 May 2027 (commencement notification G.S.R. 843(E)). Until then section 43A of the IT Act and the SPDI Rules, 2011 bind body corporates. Those Rules treat biometric information, medical records, and bank and other financial details as sensitive personal data. A body corporate must take consent in writing, by letter, fax or email, before collecting it, and must tell the person the purpose, the intended recipients and the name and address of the agency collecting and keeping it (SPDI Rules, rules 3, 5(1) and 5(3)). Section 44(2) deletes section 43A from 13 May 2027.

Illustrative written-consent wording for biometric attendance, for a body corporate before 13 May 2027:

"I consent to [Company], [address], collecting and storing a template of my fingerprint [or face] to record my attendance and control entry to [site]. The template will be held by [Company] and its attendance system provider [name, address], used only for these purposes, and deleted when I leave. I may withdraw this consent by writing to [contact]; I will then use [card or PIN] instead. Signed or emailed by: [name, date]."

The CERT-In Directions of 28 April 2022 also apply now. A stolen HR laptop or a compromised HRMS account may be a reportable cyber incident, with a six-hour clock, and ICT logs must be kept for 180 days (CERT-In Directions).

What section 7(i) covers, and where it stops

The Act does not define "employment" or "employee". Our reading is that the ground fits people engaged under a contract of employment with you, which matches the third limb's words, "a Data Principal who is an employee".

The text sets limits of its own.

• Other laws. The purpose must be lawful (s. 4(2)), and the DPDP Act adds to other laws rather than replacing them (s. 38(1)). Confidentiality rules elsewhere still apply, for example the bar on publishing or making known to the public, press and media the contents of a sexual harassment complaint or inquiry (Sexual Harassment of Women at Workplace (Prevention, Prohibition and Redressal) Act, 2013, s. 16).
• Children. An apprentice or intern under eighteen is a child (s. 2(f)). Section 9(1) requires a parent's verifiable consent "before processing any personal data of a child", and section 9(3) bars tracking and behavioural monitoring of children. No Fourth Schedule Part A class covers employers, but some Part B purposes can: creating an email-only account (item 3), real-time location tracking for her safety (item 4), and duties under law in a child's interest (item 1), each limited to what the purpose needs (Rule 12(2)).

No notice is required by law for processing under section 7(i), because the notice duty attaches to consent requests (s. 5(1)). We recommend an employee privacy notice anyway: it is the cheapest evidence that staff knew what was collected and why, and it is where you publish the contact person the Rules require (s. 8(9), Rule 9).

A basis for each stage of employment

The basis column is our view of the best fit; record the reason for each in your data map.

Candidates are not employees yet

A candidate who sends you her CV for a role has voluntarily given her data for a specified purpose, so section 7(a) can cover assessing her for that role. We would not stretch 7(a) to keeping her CV in a talent pool for two years, sharing it with a group company, or adding her to a newsletter. Each needs consent. Whether section 7(i) reaches recruitment is unsettled; see Where the law is unclear.

Recruitment agencies and job portals. A portal or agency searching its own database is a fiduciary for it; an agency running your campaign on your forms and instructions is your processor. Settle which in the contract.

Interview scores. If an AI tool scores interviews or ranks CVs, the data feeds a decision about her and must be complete, accurate and consistent (s. 8(3)). Have a person review any automated rejection.

An illustrative talent-pool request, shown beneath the application form and separate from it:

"Keep my CV on file? We would like to keep your name, contact details, CV and interview notes for 24 months to consider you for other roles at [Company]. This is optional and does not affect this application. You can withdraw at any time at [link] or by emailing [address]; we will then delete these details, except what the law requires us to keep. You can also ask to see or correct your data, or raise a grievance, at [link]. If we do not resolve your grievance, you can complain to the Data Protection Board of India; how to do so is explained at [link to your page]. Read this in Hindi or another Scheduled language: [link]. [ ] Yes, keep my CV for 24 months."

This is illustrative. Under section 5(1) and Rule 3 the notice must itemise the data, give the purpose, and explain withdrawal, rights and the route to the Board, before or with the question; the box must not be pre-ticked (s. 6(1)).

Background verification, with a sample notice

Basis. The candidate is not yet an employee, and many checks reach beyond what she supplied: past employers, education boards, court-record databases, address visits. Our position is to take consent at the offer stage, with a notice that lists each check, the agency and how long results are kept. Consent tied to an offer is less free than consent elsewhere, but the purpose is clear and refusable, and the data is limited to it (s. 6(1)). Once she has joined, re-checks for a role change or a regulated function can sit under section 7(i).

What is checked. Only what the role needs: a criminal-records search fits a driver or cash handler better than every intern. Prefer masked copies or verification results to full identity documents.

The agency. If it checks on your instructions and keeps nothing for its own use, it is your processor: contract it with security terms (Rule 6(1)(f)), erasure at the end (s. 8(7)(b)), breach notice and a list of its subcontractors. If it keeps results to sell or reuse, it is a fiduciary for that.

Past employers. A former employer who answers a reference request is disclosing her ex-employee's data. Our view: that disclosure serves the ex-employee's job search, which lies outside the old employer's employment purposes, so careful employers will ask for proof of her consent. Send it with the request.

An illustrative background-check notice and consent:

"Background checks for your offer from [Company]. Before your joining date, [Company] will verify: your identity (name, date of birth, a masked copy of [ID]); your education (degree certificates, with the issuing university); your last two employers (dates, designation, reason for leaving, by contacting the HR contacts you give us); and [for this role only] a court-records search. [Agency name], our verification provider, will carry out the checks on our behalf and will not use your data for anything else. We will keep the result of each check for [period] after you join, or [period] after the offer is withdrawn, and the agency will delete its copies within [30] days of completing the checks. You can withdraw this consent at any time at [link] or by emailing [address]; we will stop the checks, but we may then be unable to proceed with the offer. You can ask to see or correct your data, or raise a grievance, at [link]. If we do not resolve your grievance, you can complain to the Data Protection Board of India; how to do so is explained at [link to your page]. Read this in Hindi or another Scheduled language: [link]. [ ] I agree to these checks."

This is illustrative. The consequences of withdrawal fall on her (s. 6(5)), but each check must be one the role needs (s. 6(1)).

An illustrative employee privacy notice

The law does not require this notice for section 7(i) processing; any consent it asks for needs a full Rule 3 notice.

How [Company] uses your personal data as an employee

What we hold. Your name, contact details, date of birth, photo; identity, tax and social-security numbers; bank details; salary, benefits and deductions; attendance and leave; performance reviews and training; disciplinary and grievance records; health information you give us for sick leave, fitness for role or adjustments; your dependants' and emergency contacts' details; access logs, CCTV images and records from work devices and accounts, as described in our monitoring policy.

Why. To employ and pay you, meet our legal duties to tax and social-security authorities, keep people and premises safe, protect our confidential information, and provide benefits you ask for. We rely on the employment ground in section 7(i) of the Digital Personal Data Protection Act, 2023, and on section 7(d) for disclosures the law requires. We ask for your separate consent for anything else, such as photos on our website.

Who receives it. Our payroll provider [name], HR system [name], attendance system [name], insurer [name] and bank [name], and the authorities the law requires. [Name the group companies, if any, and why.] Our HR system is hosted in [country].

How long. For your employment, then for the periods in our retention schedule [link], including what the law requires us to keep.

Your rights and questions. Ask to see or correct your data, raise a grievance, or nominate someone to act for you, at [link] or with [name, role, email, phone]. We respond to grievances within [period, no more than 90 days]. If we do not resolve a grievance, you can complain to the Data Protection Board of India; how to do so is explained at [link to your page].

Monitoring: at the office, at home and on CCTV

The safeguarding limb of section 7(i) names corporate espionage, trade secrets, intellectual property and classified information. That supports security monitoring of work devices and accounts: endpoint protection, data-loss prevention, access logs, and investigations into suspected leaks. The Act sets no proportionality test for legitimate uses; we apply one anyway, because the type of data and the gravity of a breach count in a penalty (s. 33(2)(a)–(b)).

Remote work and personal devices. We recommend: monitor the work device and work accounts only; no webcam capture, ambient audio or screenshots of the screen as routine; on a personal phone, manage only a work profile or container, never the whole device; and no location tracking of remote staff beyond security alerts.

CCTV of staff in work areas is processing for safety and safeguarding under section 7(i). Put no cameras where people change or wash, limit who can view and export footage, and log every export. Section 7(i) does not cover visitors; our position on them is in Where the law is unclear.

How long to keep footage and monitoring data. Rule 6(1)(e) requires a year of logs and personal data for investigating unauthorised access, and Rule 8(3) requires personal data, associated traffic data and logs to be kept "for a minimum period of one year from the date of such processing", for the Seventh Schedule purposes, then erased unless another law requires more. Read literally, that reaches the footage itself, which would end the common 30-day overwrite cycle. Until guidance narrows it, our position is to keep 30 days of footage available for routine review and move the rest to an encrypted archive that only the security lead can open, erased after a year. Keep monitoring and access logs for a year as well, and the 180 days of ICT logs the CERT-In Directions require. Settle this with counsel and your CCTV vendor now.

An illustrative entrance sign:

"CCTV in operation. [Company] records video here for the safety of people and property. Only authorised staff view footage; it is kept for up to one year. Questions, or to ask about your data: [name or role], [phone], [email]. Full notice, your rights and how to complain: [short link or QR code]."

A one-page monitoring policy

Illustrative. Adapt it to what you actually run.

1. Purpose. We monitor work devices, accounts and premises to protect people, premises, customer data and our confidential information, and to investigate suspected misuse. We rely on section 7(i) of the DPDP Act.

2. What we monitor. Sign-ins and access to systems; email and file transfers through our data-loss prevention tool; malware and security alerts on work devices; CCTV in [areas]; entry and exit records. On personal phones, only the work profile.

3. What we do not do. Read personal accounts; capture keystrokes, webcams or ambient audio; track location outside working hours; monitor staff or interns under eighteen beyond what the law allows.

4. Who looks. Automated tools first. A person may review an individual's activity only with a written reason and approval from [role], and every review is logged.

5. How long. Security and access logs and CCTV, as in our retention schedule [link]. Investigation files for the duration of the matter and any legal claim.

6. Your rights. Questions and grievances to [name, role, contact]. We respond within [period, no more than 90 days]. We review this policy every year.

Biometric attendance and access

From 13 May 2027, fingerprint or face attendance for employees can rest on section 7(i). The DPDP Act has no "sensitive data" category, but biometrics deserve the highest tier of control: a compromised fingerprint template cannot be reissued.

• Store encrypted templates, never raw images (Rule 6(1)(a)).
• Prefer templates kept on the reader or a card over a central cloud database.
• Contract the attendance vendor as a processor, with erasure at the end of the contract (s. 8(7)(b)).
• Delete a leaver's template on her last day.
• Offer a card or PIN alternative for anyone who cannot or prefers not to enrol. The Act does not require this; it removes the strongest objection.

Health data and dependants

Fitness medicals, sick-leave certificates and occupational health records sit under section 7(i); a medical emergency at work under section 7(f). Keep health data apart from the general HR file, viewable by a named few.

Insurance and benefits. Group health insurance she enrols in is a benefit sought by an employee (s. 7(i)); the insurer is a fiduciary in its own right for underwriting and claims. Ask for no more claim data than whether a claim was made, and no individual data from counselling services.

Dependants. Spouses, children and parents named for insurance are Data Principals too. Our view: section 7(i) covers their details to the extent needed for the benefit the employee sought. For dependants under eighteen, section 9(1) requires a parent's verifiable consent before processing. The employee enrolling her own child is that parent: show her a notice under section 5, record her consent, and record that the identity and age details you already hold for her are "reliable details of identity and age" establishing that she is an adult (Rule 10(1)(a)).

Payroll vendors, insurers and other processors

For each HR vendor, decide whether it is your processor or an independent fiduciary.

You stay responsible for what processors do for you, "irrespective of any agreement to the contrary" (s. 8(1)). Whether section 8(2) strictly requires a contract for HR processing is debatable; our answer, and the clause set, are in the processor contracts guide. For tiering vendors and sharing data across a corporate group, see DPDP for large companies.

HR systems hosted abroad

Many employers run a global HRIS, or let regional HR teams abroad view Indian staff records. From 13 May 2027, personal data may go to any country the government has not restricted by notification (s. 16(1)), subject to any requirements it specifies about making data available to a foreign State (Rule 15). Stricter sector rules still apply (s. 16(2)). Until then, the SPDI Rules let a body corporate transfer sensitive personal data, in India or abroad, only to an entity that ensures the same level of protection, and only where necessary for a lawful contract with the person or with her consent (SPDI Rules, rule 7).

List each country where HR data is stored or viewed, contract the HRIS provider as a processor, and name the hosting country in the privacy notice. For the 180-day ICT logs: Direction (iv) of the CERT-In Directions requires these logs to be kept within Indian jurisdiction; CERT-In's FAQs of 18 May 2022 (Q35) suggest a copy may be held abroad if it can be produced in reasonable time, and financial-transaction records must stay in India (Q36). The FAQs are guidance, not binding law; the Directions govern. Commentators differ, so we recommend keeping a copy in India.

Consultants, interns and contract staff

None of these is clearly an employee, so section 7(i) is a weak basis for them.

• Consultants and freelancers. Section 7(a) for what she gives you for the engagement; consent for extras such as a profile on your website.
• Interns. 7(i) may fit an intern under a contract of employment; a student intern is closer to 7(a). If she is under eighteen, see What section 7(i) covers.
• Contract staff through a manpower agency. The agency is usually the employer; 7(a) covers what the worker gives you to work at your site. Put roles in the agency contract.

Volunteers and community workers, and the WhatsApp rule for teams, are covered in the NGO guide.

WhatsApp groups and AI tools at work

WhatsApp. A work group is the employer's processing, covered by section 7(i) for work purposes. Give groups a named admin who removes leavers on their last day, and keep salary, medical, disciplinary and identity information out of them. The NGO guide has a sample WhatsApp rule that works for any employer.

Staff using AI tools with personal data. Pasting an employee's appraisal, a candidate's CV or a customer's complaint into a consumer AI tool shares personal data with a third party without a processing contract. That can be unauthorised processing, which is within the definition of a personal data breach (s. 2(u)). Approve and contract the tools staff may use, and say which data may go into them.

HR using AI on employees. CV screening, attrition prediction and productivity scoring use employee data to make decisions about her, so section 8(3) accuracy applies. Contract the vendor as a processor, forbid training on your data, and keep a human decision-maker. The DPDP and AI guide covers model training and chatbots.

Exit, ex-employees and retention

On her last day, the exit checklist should cover data as well as assets:

• Revoke system access and remove her from WhatsApp groups and shared drives.
• Recover devices, or wipe the work profile on a personal phone.
• Ask her to confirm, in writing, that she holds no work data on personal devices or accounts.
• Delete her biometric template.
• Tell her what you will keep, for how long and why. The law does not require this step; we recommend it.

Retention. Erase personal data when the purpose ends unless a law requires you to keep it (s. 8(7)). Many HR records have statutory periods under tax, labour and social-security laws; get the current list from your chartered accountant and employment counsel. Tax references should now be to the Income-tax Act, 2025, which applies from 1 April 2026. Then apply the Rule 8(3) floor: keep personal data, traffic data and logs for at least a year from the processing, for the Seventh Schedule purposes.

An illustrative schedule, with periods that are our recommendations except where a law sets them:

What employees can ask for

The text limits some employee rights.

• Access (s. 11) and correction and erasure (s. 12) apply to data she gave by consent, "including consent as referred to in clause (a) of section 7". On the text, data processed under section 7(i) is outside them. We recommend answering employees' access requests anyway.
• Erasure requests have no prescribed deadline. Where she raises a grievance, your published response period applies, which can be no longer than 90 days (Rule 14(3)). You may keep what the specified purpose or another law requires (s. 12(3), s. 8(7)); tell her what you kept and why.
• Accuracy (s. 8(3)) applies whatever the basis to data used to decide about her, such as appraisal ratings used for pay or promotion.
• Grievance (s. 13) applies to any act or omission in your obligations. She must use it before going to the Board (s. 13(3)).
• Nomination (s. 14) lets her name someone to exercise her rights on death or incapacity.

Where the law is unclear on employee data

Until the Board or a court rules, we work to the positions below, with our reasons.

Does section 7(i) cover recruitment? We do not rely on it. Why: "purposes of employment" is broad enough to include hiring, but the ground's last limb refers to "a Data Principal who is an employee", and 7(a) plus consent covers candidates cleanly. Would change if: the Board reads 7(i) to include candidates. Confidence: medium.

Is consent at the offer stage "free" for background checks? Free enough, if the checks are limited to the role and explained. Why: the alternative bases are weaker, and section 6(1) is concerned with consent beyond what is necessary for the specified purpose. Would change if: the Board treats consent given as a condition of a job offer as not free. Confidence: low.

What basis covers CCTV of visitors? Unclear. Why: section 7(i) covers employees, not visitors, and the Act has no implied consent. Our practice is a clear notice at the entrance with the purpose, contact person and a link to the full notice; treating entry as consent only where entering is a genuine choice; and short live-review access. Would change if: guidance or a case addresses visitor CCTV. Confidence: low.

Does Rule 8(3) require a year of CCTV footage? Possibly. Why: it covers "such personal data, associated traffic data and other logs" of any processing, with no exception for video, and Rule 6(1)(e) also asks for a year of logs and personal data. Would change if: the government clarifies that the floor reaches logs and records of processing rather than all underlying data. Confidence: low.

Can employees' children be enrolled for insurance on the employee's consent? Yes, with the employee as the verified parent. Why: section 9(1) requires a parent's verifiable consent; you already hold reliable identity and age details for her (Rule 10(1)(a)). Would change if: the Board expects verification against a government-issued document or token in every case. Confidence: medium.

Are under-18 apprentices caught by the ban on behavioural monitoring? Productivity and behaviour-tracking tools, yes. Why: section 9(3) bars "tracking or behavioural monitoring of children", no Part A class covers employers, and the Part B purposes (an email-only account, real-time location for safety, duties under law in her interest) do not extend to productivity monitoring. General site CCTV is less clearly "behavioural monitoring". Would change if: Part B is extended under s. 9(4). Confidence: low.

A 90-day plan for HR

Starting 2 November 2026, this leaves time before 13 May 2027.

Days 1 to 30.

1. Map HR data: every system, vendor, spreadsheet and WhatsApp group, using our data mapping method.
2. Write the basis for each activity, using the lifecycle table.
3. If you are a body corporate, check the SPDI written consents you need now for biometrics, medical records and bank details.

Days 31 to 60.

4. Issue the employee privacy notice and the monitoring policy.
5. Separate the talent-pool consent from the application form; set candidate retention.
6. Re-paper payroll, HRMS, attendance, BGV and cab vendors as processors.
7. Decide CCTV retention with counsel and your vendor; list where HR data is hosted and viewed.

Days 61 to 90.

8. Add data steps to the exit checklist and run it for every leaver.
9. Approve AI tools and publish what data may go into them.
10. Train managers on what not to post in WhatsApp groups, and test the HR breach route with a lost-laptop drill.

How we wrote this guide. We worked from the Digital Personal Data Protection Act, 2023, the Digital Personal Data Protection Rules, 2025 (G.S.R. 846(E), as corrected by G.S.R. 892(E)), the commencement notification G.S.R. 843(E), the SPDI Rules, 2011, the CERT-In Directions of 28 April 2022 and CERT-In's FAQs of 18 May 2022, last checked 25 October 2026. Retention periods, monitoring limits, the lifecycle bases and the sample texts are our recommendations; statutory record-keeping periods under employment and tax laws are not covered here and should be confirmed with your advisers. This guide explains the law; it is not legal advice.