Does DPDP apply to employee data — what HR teams must know
Employee data is among the most sensitive personal data an organisation holds. Here is exactly what DPDP requires of HR teams.
What employee data is covered by DPDP?
All personal data of employees is covered: identity and contact data (name, address, PAN, Aadhaar, passport); financial data (salary, bank account, TDS, form 16, bonuses, incentives); attendance and leave records; performance appraisal data; health data (medical certificates, insurance enrolment and claims, disability records); biometric data (fingerprint, face templates for attendance); emergency contact details; disciplinary records; and training and certification records. Each category has different retention and security requirements under DPDP.
What is the lawful basis for processing employee data?
Most core HR processing is on the contract or statutory basis: payroll and salary processing — contract of employment; TDS, EPF, ESIC, gratuity — statutory obligation; attendance and leave management — contract of employment; performance management — contract of employment; bank account and payment — contract; statutory reporting to labour departments — statutory obligation. Consent is required for: biometric attendance (if an alternative method is available); participation in optional wellness or wellbeing apps; use of employee photos in external marketing; sharing data with third-party rewards platforms.
What employee privacy notice must HR issue?
Under DPDP, employees must receive a privacy notice covering: all categories of data collected from or about them; the purpose of each data category; the legal basis for processing; retention periods for each category; whether data is shared with third parties (insurance companies, payroll processors, background check agencies) and for what purpose; and data principal rights and how to exercise them. Issue this notice at onboarding, and update it when significant changes occur. Keep a record that each employee received and acknowledged the notice.
How must HR handle employee data rights requests?
Set up an internal mechanism — an HR helpdesk ticket category or a dedicated email — for employee data rights requests: access requests (employee wants to see their appraisal scores, attendance records, or salary history); correction requests (employee wants to correct an incorrect appraisal entry or attendance record); and erasure requests (employee wants data deleted after resignation or termination). Respond within the prescribed period (expected 30 days). Some records cannot be erased — EPF, TDS, and other statutory records must be retained for mandated periods regardless of erasure requests.
What must HR do when an employee leaves?
On termination: delete all data that has no ongoing lawful basis — biometric templates, health data beyond insurance claim purposes, personal device access records; retain only what statutory requirements mandate (EPF records — 5 years, TDS records — as per IT Act, gratuity records — until the gratuity obligation is discharged); revoke system access within 24 hours; remove the former employee from active HR systems and archive their records in a secure, access-controlled archive; and confirm deletion of any biometric data to the former employee on request.
What background check and pre-employment data obligations exist?
Data collected during recruitment — CVs, interview notes, assessment scores, reference check responses — is personal data subject to DPDP. Candidates who are not selected must have their recruitment data deleted within a defined period (best practice: 90 days after the role is filled). Background check data collected from third-party agencies requires a DPA with the agency. Reference check responses (from former employers) must be used only for the verification purpose. Do not retain rejected candidate data for future recruitment without explicit consent for that purpose.
Frequently asked questions
Can employers monitor employee emails and devices under DPDP?
Monitoring employee work emails and company-owned devices is permissible if: the employer has a clear, written policy disclosed to employees before monitoring begins; the monitoring is proportionate to the business purpose (security, compliance); and employees are aware that monitoring occurs. Covert monitoring (secret access to employee emails without notice) is a serious privacy violation. Personal emails, personal devices used for work, and private communications through personal accounts remain private even if accessed through company infrastructure.
Do employee performance appraisal records have any special protection?
Performance appraisal data — rating scores, manager feedback, PIP documentation — is personal data subject to DPDP. Employees have the right to access their own appraisal data. If an appraisal rating is factually inaccurate (for example, a rating entered with a clerical error), employees can request correction. However, employees cannot request erasure of a legitimately recorded performance score — it is data about a real event, retained for legitimate HR and legal purposes. The distinction: correction of inaccuracies is a right; erasure of unfavourable but accurate records is not.
Does the DPDP Act change anything about the Employee Provident Fund data we hold?
EPF data — employee PF numbers, contributions, employer contributions, UAN numbers — is processed both on the statutory obligation basis (compliance with the EPF Act) and the employment contract basis. DPDP does not change your EPF compliance obligations — you still must collect PAN, Aadhaar (for UAN), bank account, and salary data. What DPDP adds: security obligations for how this data is stored and shared; breach notification if EPF data is compromised; and the obligation to delete EPF data beyond the statutory retention period when it is no longer needed.
Build your HR DPDP compliance programme
Niti Bharat's HR DPDP Policy Pack covers the employee privacy notice, HR data retention schedule, biometric consent framework, and data rights intake process — fully tailored for Indian HR teams.
Get the HR DPDP Policy Pack