Does the DPDP Act apply to employee data?
HR, payroll and recruitment data are all in scope — here's what that means.
What employee data is covered
Names, contact details, identifiers like PAN and Aadhaar, bank and salary details, performance records, biometric attendance, CCTV footage and recruitment data are all personal data. Whether the employee is current, former or merely a candidate, the moment you hold it in digital form it falls under the Act.
Consent vs legitimate use at work
The Act recognises certain employment-related 'legitimate uses' — for example processing needed for employment, to prevent corporate espionage, or to provide services or benefits. Where these apply you may not need fresh consent, but you still must be transparent, minimise what you collect, secure it, and delete it when no longer needed.
Practical steps for HR
Issue an employee privacy notice, lock down access to HR systems, set retention periods for resumes and exited-employee records, and have a process for access and correction requests. An employee data audit is the fastest way to find where you are over-collecting or over-retaining.
Frequently asked questions
Do I need employee consent for payroll?
Often not — core employment processing such as payroll can rely on a legitimate use rather than consent. You must still give a clear notice and protect the data.
How long can I keep ex-employee records?
Only as long as a purpose or a law requires. Statutory records (e.g. PF, tax) have their own retention periods; everything else should be deleted once its purpose ends.
Does DPDP cover background checks?
Yes. Background-check and verification data is personal data, often sensitive, and needs a lawful basis, minimisation and strong safeguards.
Find your employee-data gaps
Run the Employee Data Audit to see where HR is over-collecting, over-retaining or under-protecting personal data.
Run an Employee Data Audit