How to write an employee privacy notice under DPDP
Employers must disclose to employees what personal data they collect and why. Here is what a DPDP-compliant employee privacy notice must include.
What data categories must an employee privacy notice cover?
The notice must address: identity and contact data (name, address, emergency contacts); payroll and financial data (salary, bank account, PF, tax deductions); performance data (appraisal scores, manager feedback, PIP records); attendance and leave data; health and insurance data (if benefits are managed); disciplinary records; IT access and monitoring data (email, internet, device logs if monitoring is in place); biometric data (if biometric attendance is used); and any post-employment data retained. Each category needs its own purpose and retention period.
What lawful basis applies to different categories of employee data?
Employment contract: the lawful basis for processing data necessary to manage the employment relationship — payroll, attendance, performance management, benefit administration. Statutory compliance: tax deductions (TDS), EPF contributions, ESI, professional tax — you do not need separate consent for these statutory obligations. Consent: for discretionary uses beyond employment administration — publishing an employee's photo in company marketing, sharing data with a wellness app vendor, using biometric attendance. Use the right basis for each category and state it explicitly in the notice.
How do you address employee monitoring in the privacy notice?
If you monitor employees — email content, internet usage, device activity, CCTV, location tracking for field staff — this must be disclosed in the privacy notice with specificity. State what is monitored, at what level of granularity, for what purposes (security, productivity, compliance), how long monitoring records are retained, and who can access them. Employees must know they are being monitored — surprise monitoring, even if technically lawful, is a DPDP risk and an employment relations issue. Limit monitoring to what is necessary and proportionate.
What employee rights must be addressed in the notice?
The notice must inform employees of their rights under the DPDP Act: the right to access all personal data held about them (including performance records and disciplinary history); the right to correct inaccurate data; the right to withdraw consent for consent-based processing; and the right to file a complaint with the Data Protection Board. Tell employees how to exercise these rights — the HR contact or dedicated mechanism — and the timeline for response. Employees raising a DPDP rights request should be protected from retaliation.
How do you handle third-party data sharing in an employee notice?
Employers share employee data with multiple third parties: payroll vendors (Razorpay Payroll, Keka, greytHR), HRMS platforms, health insurance providers, EPF and ESIC authorities, income tax department, banks for salary credit, and background verification agencies. Each of these should be identified in the notice (or by category with examples). Employees should know that their health data goes to the insurance provider and their financial data goes to the tax authority — not as a surprise after the fact.
How often must an employee privacy notice be updated?
Update the notice whenever: you add a new data category to your employee processing (for example, adding biometric attendance); you introduce a new vendor who accesses employee data; you begin a new monitoring practice; there is a significant change in your payroll or HR systems; or you add new uses for existing data. When you update the notice, inform employees of what changed and when. Keep a version history of your employee privacy notices — if the Board investigates a practice from 2025, you need to show what notice was in place at that time.
Frequently asked questions
Is an employee privacy notice the same as an employment contract?
No. An employment contract covers the terms of employment — role, salary, leave, termination. An employee privacy notice covers the data protection rights under DPDP — what data is collected, why, and employees' rights over it. They serve different legal purposes. The employment contract can reference the privacy notice, or the notice can be an appendix to the contract — but they are distinct documents. Embedding DPDP disclosures in a long employment contract reduces the likelihood that employees will actually read and understand them.
What language should the employee privacy notice be in?
The notice should be in a language the employee can understand. For most corporate roles, English is appropriate. For factory workers, field staff, or blue-collar employees who communicate in regional languages, provide the notice in the relevant regional language. The DPDP Act's principle of informedness requires that employees actually understand what they are being told — a long English document handed to a Tamil-speaking factory worker does not meet this standard.
Does the employee privacy notice apply to contractors and consultants?
Yes. Contractors and consultants whose personal data you process — identity, bank details, work product, communication history, performance records — are data principals with the same DPDP rights as full employees. Issue a contractor privacy notice at onboarding covering the data you collect for the engagement, and ensure it addresses the specific data types that differ from employees (no payroll, but potentially deliverable records and IP assignment data).
Build your DPDP employee privacy notice
Niti Bharat's Employee Privacy Notice Generator creates a customised, DPDP-compliant notice for your organisation — covering payroll, performance, monitoring, health data, and employee rights.
Generate Employee Privacy Notice