Employee Data Under the DPDP Act: What Indian HR Teams Must Fix Before 2027
HR holds more sensitive personal data than marketing ever will — Aadhaar, bank details, medical records, background checks, CCTV, and now productivity monitoring. The DPDP Act covers all of it. The good news: much of it does not need consent. The bad news: most HR teams have no idea which parts do.
Section 7(i) of the DPDPA permits processing of personal data for "purposes of employment or those related to safeguarding the employer from loss or liability" as a legitimate use without requiring consent. However, this exemption is narrower than many HR teams assume.
Pre-employment job applicants on your Careers page are NOT yet employees — collecting their resumes and background check details requires a clear DPDPA Section 5 Notice and Section 6 Consent. Similarly, sharing employee data with third-party wellness apps, optional insurance Perks, or external AI productivity trackers requires explicit, unbundled consent.
Need help implementing this under the DPDP Act 2023?
Talk to our legal advisors at Manoj Bhagat & Associates or estimate your annual compliance cost in 30 seconds.