DPDP Act Compliance for HR: Employee Data, Background Checks and Payroll Vendors

Last reviewed: 27 August 2026. Basis: DPDP Act, 2023 and DPDP Rules, 2025 (notified November 2025).

Employee data is the one dataset the DPDP Act touches in every Indian organisation, regardless of sector or size. Section 7 lets employers process personal data for employment purposes without consent, but that legitimate use is narrower than most HR teams assume and does not cover third-party background checks, non-essential biometrics, wellness health data or intrusive monitoring. Retention after exit is set by labour, provident fund and income tax laws first, and by the DPDP erasure duty for everything else. This guide gives HR and compliance leads a data inventory checklist, a consent-versus-legitimate-use decision table and a sample retention schedule to work from before May 2027.

Why dpdp act employee data is the compliance problem every company shares

A ten-person startup and a 40,000-person manufacturer differ in almost everything except this: both hold PAN, Aadhaar copies, bank details, salary history, medical certificates and performance records for every person they employ. Customer data varies by business model. Employee data does not.

HR data is now almost entirely digital, so it sits squarely within the Act. Under Section 4, every item must be processed either with consent under Section 6 or for a legitimate use under Section 7. There is no third option, and unlike the GDPR there is no legitimate interests balancing test to fall back on (see our DPDP 101 explainer). HR therefore needs to know, for each category of employee data, which basis it relies on, and be able to show that answer to the Data Protection Board. Most organisations we review cannot do that today.

What dpdp hr compliance requires under the Section 7 employment purpose

Section 7 lists situations in which a data fiduciary may process personal data without consent. The one HR relies on covers processing for purposes of employment, or for safeguarding the employer from loss or liability, including prevention of corporate espionage, confidentiality of trade secrets, and provision of any service or benefit sought by the employee.

In our reading, this covers the core of the relationship: onboarding, payroll and statutory deductions, leave and attendance, performance management, misconduct investigations, access control, and benefits the employee has asked for.

Where the employment purpose stops

Three boundaries recur in practice. First, the purpose must actually be employment: using employee contacts for marketing is not. Second, necessity is the operative test; blood group, religion, caste and marital status often sit in onboarding forms with no employment justification. Third, Section 7 does not switch off other duties. Section 8 security safeguards and erasure once the purpose is served, and the Section 11 to 14 rights, apply whether or not consent was taken. The Section 5 notice is tied to consent-based processing, but in practice a clear HR privacy notice is the simplest way to evidence purpose limitation for legitimate-use processing too. See our Section 7 lawful basis explainer.

When is employee consent dpdp compliant, and when is it still needed?

Employers routinely take a blanket consent signature at offer stage. Under Section 6 that consent is close to worthless: consent must be free, specific, informed, unconditional and unambiguous, with withdrawal as easy as giving it. A candidate who must sign to receive an offer is not consenting freely, and one line covering “all HR purposes” is not specific.

The better approach is to rely on Section 7 for what it genuinely covers and take separable consent only where the employment purpose does not reach. The table reflects our practice view.

Anything on the consent side must be operationally reversible: an employee who withdraws consent to the wellness app must keep their job without detriment. For every category on the legitimate-use side, keep a short written record of why it is necessary. That record is your defence.

Biometric attendance and necessity

A fingerprint or face template cannot be changed once compromised. We covered the detail in our biometric attendance blog post, and the conclusion holds: an employer that considered alternatives, limited the template to attendance, encrypted it, kept it off the device vendor’s cloud unless a processor contract exists, and set a deletion date at exit is defensible. One that let the vendor’s app upload templates to an unknown server is not. The Act has no sensitive data categories, but the Board’s view of reasonable security safeguards under Section 8 will in practice be stricter for data that causes permanent harm if leaked.

Background verification consent dpdp requirements and candidate data

Candidates are data principals from the moment a CV arrives. In our reading the Section 7 employment purpose extends to prospective employment, so evaluating a CV is covered. Keeping every rejected CV for five years is not: the purpose is served when the requisition closes. A workable rule is six to twelve months tied to a documented purpose such as defending process complaints, then deletion. For a talent pool, ask for consent and honour withdrawal.

Background verification is the sharpest edge because three parties are involved: the employer, the BGV vendor, and the sources the vendor contacts (former employers, universities, courts, neighbours). The vendor is a data processor that must be engaged under a valid contract, and the employer remains responsible for what it does. The consent should name the vendor, the checks, the sources, the retention period for the report, and the candidate’s right to see and correct it. In regulated sectors, the RBI Master Direction on KYC and the RBI cyber security framework for banks push towards documented staff screening; that does not remove the need for consent, it strengthens the case for doing it properly.

Payroll, HRMS and BGV vendors as data processors

The average mid-sized Indian company we review has employee data in six to ten external systems: cloud HRMS, payroll bureau, PF and ESI consultants, insurance broker and TPA, BGV vendor, biometric device vendor, learning platform, and an offshore parent’s global HR system. Each is a processor engaged under what must be a valid contract, and the Rules list contractual measures with processors among the reasonable security safeguards, so a purchase order with no data protection terms is a gap.

Minimum contract terms in practice: processing only on documented instructions, safeguards matching the Rules (encryption, access control, one-year log retention, backups), breach notification fast enough for you to meet your own 72-hour duty to the Board, sub-processor and cross-border disclosure, and deletion at contract end. Our vendor remediation guide covers the renegotiation sequence. For subsidiaries whose global HRMS sits abroad, Section 16 permits the transfer except to countries restricted by Central Government notification; the missing contract and the missing notice to employees are usually the real problem.

HR data inventory checklist

You cannot assign a basis, a retention period or a processor to data you have not listed. Complete one row per data category, not per system.

Employee data retention india: statutory holds versus DPDP erasure

Section 8 requires erasure when the purpose is served, unless retention is necessary for compliance with law. For HR data the second half does most of the work, because labour, provident fund and income tax laws impose retention periods that outlast the employment. The Rules’ three-year inactivity erasure rule applies to specified large platforms, not to employers as such.

The schedule below is indicative and should be validated by labour counsel against the statutes applicable to your state and sector; periods differ across state Shops and Establishments rules and the labour codes as they come into force.

“Retain for tax” does not mean retain everything: keep the payroll ledger, delete the Aadhaar scan. Retention must also be enforced at each vendor, so the exit checklist needs a line per processor.

Handling employee rights requests

Employees and former employees have the same Section 11 to 14 rights as customers: access to a summary of their data and the processors it went to, correction and erasure, grievance redressal within a published period (the Rules cap it at 90 days), and nomination. The access and correction rights are framed around consent-based processing, but in practice we advise treating every employee request as if the rights apply, because most HR data is a mix of both bases anyway.

The requests that actually arrive are predictable. A former employee asking for their file during a dispute should receive a summary and the underlying documents, minus third-party data. A request to correct a performance rating can be declined with reasons where the rating is an evaluative opinion, not a factual error. A request to erase a disciplinary record can be declined while the dispute defence purpose is live, with the reason recorded. Our DSAR workflow guide covers intake and response, and Your DPDP Rights is the version you can point employees to.

The exposure for getting this wrong sits in Section 33 and the Schedule: up to Rs 250 crore for security safeguard failures, which is what a leaked payroll file or biometric database represents, and up to Rs 50 crore for most other breaches. The Penalty Exposure Estimator lets you model your own numbers.

Frequently Asked Questions

Does an employer need consent from employees under the DPDP Act?

Not for the core of the employment relationship. Section 7 allows processing for employment purposes and for safeguarding the employer from loss or liability without consent. Consent is still needed for processing outside that purpose, such as wellness programmes, third-party background checks on candidates, biometrics where alternatives exist, and use of employee photos in marketing.

Is a signed consent clause in the offer letter valid under Section 6?

In our reading, no. Section 6 requires consent to be free, specific and unconditional, and a clause that must be signed to receive an offer is neither free nor specific. Rely on Section 7 for what it covers, and take separate, withdrawable consent only for the categories that fall outside it.

How long can we keep employee data after an employee leaves?

As long as a law requires, and no longer than the purpose needs. Income tax, provident fund and labour statutes set retention periods for payroll and statutory records that typically run three to eight years. Data with no statutory driver, such as biometric templates and background verification reports, should be deleted at exit or within a short documented buffer.

Are payroll and background verification vendors data processors under the DPDP Act?

Yes. Any vendor processing employee data on your behalf is a data processor, must be engaged under a valid contract, and you remain responsible for its compliance. The contract should cover security safeguards, breach notification timing, sub-processors, cross-border transfers and deletion at contract end.

When do these HR obligations become enforceable?

Most substantive obligations under the DPDP Act, including notice, consent, security safeguards, breach notification and data principal rights, become enforceable 18 months after the November 2025 notification of the Rules, which is May 2027. Employee data inventories, vendor contracts and retention schedules take months to fix, so the work should start now.

Related explainers

• Data Fiduciary vs Data Processor under the DPDP Act

• DPDP Act vs IT Act SPDI Rules

Next step

The fastest way to close the transparency gap is a clear HR privacy notice that tells employees and candidates what you collect, on what basis, which vendors see it and how long you keep it. Download the HR privacy notice template, part of the 16 DPDP Starter Templates, and adapt it to the inventory you have just built.