An HR head told me something during a consultation that I’ve heard in different words many times since. “We’ve been so focused on customer data compliance, we honestly never thought about our own employee records.” Fair enough, honestly. Most DPDP Act conversations center around customers, and employee data quietly gets treated as somehow separate, exempt, internal-only.
It isn’t. And that assumption is exactly where a lot of HR teams are currently exposed.
Employee Data Isn’t a Special Category, It’s Fully Covered
Here’s the core point worth sitting with. Every employer in India, whether a five-person startup or a company with 50,000 employees, is a Data Fiduciary under the DPDP Act the moment it collects a job applicant’s resume, stores an Aadhaar number for EPFO purposes, processes salary through payroll, or shares health insurance data with an insurer. That’s not a narrow reading of the law. That’s the law applying exactly as written.
Yet according to a recent EY India readiness survey, only around 23% of Indian employers have actually assessed their HR data processing activities for DPDP compliance. The remaining majority are essentially operating on an assumption that employment data sits outside the Act’s scope. It doesn’t, and that gap is becoming a genuine liability.
The Good News: Most Core HR Processing Doesn’t Need Fresh Consent
Here’s where the picture gets more manageable than people initially fear. Under Section 7 of the Act, employment-related processing qualifies as a “legitimate use,” meaning core HR functions, payroll, benefits administration, attendance tracking, statutory deductions like PF and ESI, workplace safety, generally don’t require separate, explicit consent from employees for each activity.
However, this legitimate use exemption has real limits. Processing that falls outside genuine employment purposes, using employee data for marketing, sharing it with third parties for their own separate purposes, or repurposing it beyond what employment reasonably requires, does require proper, specific consent. The exemption covers running your business as an employer. It doesn’t cover everything you might want to do with the data you happen to hold.
Where HR Teams Are Genuinely Exposed
A few specific areas deserve particular attention, since they’re where compliance gaps show up most often in practice.
Background verification processes. Indian employers routinely send candidate data, Aadhaar, PAN, educational certificates, previous employment records, to third-party BGV companies, who then contact multiple downstream sources themselves. This chain of data sharing needs proper contractual protection at every link, not just an informal arrangement with your verification vendor.
Vendor relationships without signed Data Processing Agreements. If your payroll provider, HRMS platform, or insurance partner can’t show you a signed DPA outlining their security obligations, breach notification timelines, and data handling practices, that’s a compliance gap, and importantly, it’s your liability as the employer, not theirs.
Data collected but never mapped. A lot of HR data ends up scattered, resumes in one system, biometric attendance data in another, performance reviews somewhere else entirely, insurance details with a third-party administrator. You genuinely cannot protect what you haven’t inventoried in the first place.
Retention that runs indefinitely by default. The days of keeping every HR record forever in an old spreadsheet are effectively over, legally speaking. The Act expects defined retention periods tied to actual statutory or business need, not indefinite storage out of habit.
What Rights Do Employees Actually Have
Employees hold the same core Data Principal rights as customers under this Act. They can request access to their personal data, ask for correction of inaccurate records, withdraw consent where consent was the actual basis for processing, and raise a grievance if they believe their data has been mishandled.
One nuance worth understanding here. The right to erasure isn’t absolute. An employer generally can’t delete payroll records simply because a former employee requests it, if those records are still needed for Income Tax Act compliance or other statutory retention obligations. The erasure right yields to legitimate legal retention requirements, but HR teams still need a defined, documented process for handling these requests properly, rather than either ignoring them or over-complying beyond what’s actually required.
Importantly, if an employee’s grievance goes unresolved through your internal process, they can escalate directly to the Data Protection Board of India. That creates a direct regulatory pathway from an individual employee straight to the regulator, which makes this a genuine governance risk, not just an HR policy detail.
What a Practical HR Compliance Approach Looks Like
Given all this, here’s where HR and legal teams should realistically focus their energy.
Map your actual employee data estate first. Internal systems like your HRMS, payroll software, and attendance trackers, alongside external vendors like BGV agencies, insurance providers, and IT service providers, all need to be identified before anything else makes sense to fix.
Get signed DPAs with every vendor touching employee data. This should be standard practice, not an afterthought, and each agreement should clearly cover breach notification timelines, security obligations, and what happens to data upon contract termination.
Review your consent language honestly. A generic clause buried in an employment agreement signed years ago almost certainly doesn’t meet the Act’s standard of consent being free, specific, informed, and unambiguous, for the processing activities that actually require consent in the first place.
Build a real process for employee rights requests. Access, correction, and grievance requests need clear channels, verification steps, and defined timelines, not an ad-hoc response scrambled together whenever someone happens to ask.
Set actual retention and deletion policies. Define how long different categories of employee data genuinely need to be kept, and build deletion into your process rather than treating it as optional cleanup nobody gets around to.
Why HR Can’t Treat This as Someone Else’s Problem
Penalties under the DPDP Act can reach up to ₹250 crore for serious violations, and employee data breaches carry the same exposure as customer data breaches under this framework. Given how much sensitive information HR departments typically hold, salaries, health records, biometric data, performance reviews, government ID numbers, this function often represents one of the highest-risk areas in an entire organization, even though it rarely gets treated that way.
With full enforcement expected by May 2027, HR teams genuinely have a window to close these gaps properly rather than scrambling once regulators start paying closer attention. Given that fewer than a quarter of Indian employers have even assessed their HR data practices so far, getting ahead of this now is a real competitive advantage, not just a compliance checkbox.
If your HR team isn’t sure whether your employee data practices would hold up under scrutiny, it’s worth finding out now. I help businesses across Delhi NCR build proper DPDP compliance frameworks, including the HR and vendor side of things, through my DPDP Act Compliance Consulting services. For ongoing support, take a look at DPO services as well. Book a free consultation — Advocate Nitin Kumar Vashista, DPDP Act & GDPR Compliance Consultant, Gurgaon.