DPDPA Supportby Cynor Sense
Free sample
HR & employee data

DPDP Act for HR and people teams: job applicants, payroll vendors and workplace data

Indian automotive and electronics manufacturing plant floor with engineers and HR supervisors using digital tablets.

Every Indian employer is a Data Fiduciary for workforce data from 13 May 2027. While the Act allows processing employee data without consent for employment purposes, workplace security and employee benefits, employers still need consent notices for pre-hire job applicants, valid contracts with payroll and background-check vendors, security safeguards, and 90-day grievance handling.

By Arun R M, Cynor SenseLast checked against the official text: Updated 4 min read

On this page
  1. Where the employment legitimate use applies, and where you still need consent
  2. Why legitimate use does not excuse security, vendor contracts or breach reporting
  3. Recruitment pipelines, background checks and rejected candidate resumes
  4. Our view: six practical controls for HR and people operations
  5. Common questions
  6. In the news
  7. Sources

When business owners think about data protection, they usually think of customer data first. Yet every employer in India—even a B2B manufacturer, logistics depot, consulting firm or engineering centre that never sells to consumers—collects digital personal data about job applicants, full-time staff, contract workers and former employees. Under the Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025, an employer is a Data Fiduciary for its workforce data.

Where the employment legitimate use applies, and where you still need consent

The Act provides a specific ground under "certain legitimate uses" that allows an employer to process an employee's personal data without obtaining fresh consent for every HR task. Specifically, a Data Fiduciary may process personal data for the purposes of employment, or those related to safeguarding the employer from loss or liability—such as prevention of corporate espionage, maintenance of confidentiality of trade secrets, intellectual property and classified information, or provision of any service or benefit sought by an employee.

However, HR and people teams must understand the exact boundaries of this employment ground so they do not stretch it where it does not reach:

HR stage and activityExamples of personal dataLawful ground under the ActOperational requirement
Job applicants and recruitmentCVs, interview notes, salary slips from past jobs, background check forms before hiringConsent (an applicant is not yet an employee,unless voluntarily provided for a narrow response)Display an itemised recruitment privacy notice on career portals and job forms; set a clear retention period for rejected CVs
Onboarding, payroll and statutory filingsBank account, tax identifiers, provident fund details, attendance, salary ledgerLegitimate use for employment and legal obligationsRestrict access to HR and finance staff; bind payroll bureaus and accounting firms under processor contracts
Employee benefits and group insuranceFamily dependants' names, dates of birth, medical reimbursement billsLegitimate use for providing a service or benefit sought by the employeeShare only required fields with the insurer or third-party administrator; keep medical files encrypted
Workplace security and DLP monitoringLaptop endpoint logs, badge access, email data-loss prevention alertsLegitimate use to safeguard the employer from loss, liability or corporate espionageDocument the security policy clearly; keep access logs for at least one year under reasonable security safeguards
Optional marketing or public profilesPutting employee photos in ad campaigns, sharing staff phone numbers with partner brandsConsent (outside core employment necessity)Ask for separate, free consent with an easy way to withdraw without workplace penalty
Offboarding and alumni recordsFull-and-final settlement, relieving letters, tax records, old laptop backupsRetain statutory tax and labour records; erase non-essential personal copiesRevoke system access on exit; archive statutory payroll files and purge temporary HR folders

Why legitimate use does not excuse security, vendor contracts or breach reporting

Relying on the employment legitimate use means you do not have to run a consent banner for payroll processing or endpoint security monitoring. It does not exempt the employer from the general obligations of a Data Fiduciary. You must still:

A people-operations coordinator wearing a headset at an open-office workstation with an employee directory on her monitor.
  • Protect all HR, payroll, biometric attendance and recruitment databases with reasonable security safeguards, including encryption, access controls, backups and one-year access logs.
  • Engage recruitment portals, background verification (BGV) agencies, cloud HRMS platforms and outsourced payroll providers only under a valid Data Processor contract.
  • Notify the Data Protection Board of India and every affected employee or applicant without delay—and file the 72-hour detailed report—if a ransomware attack, misconfigured cloud bucket or payroll vendor leak exposes staff data.
  • Publish the business contact of your Data Protection Officer or designated privacy contact and operate a grievance redressal channel that responds within 90 days.

Recruitment pipelines, background checks and rejected candidate resumes

Hiring pipelines are one of the biggest sources of unmanaged personal data in Indian companies. Resumes arrive via job boards, recruitment agencies, employee referrals, email attachments and WhatsApp messages, and often sit in shared folders for years. When a candidate is not hired, the purpose for which their resume and interview assessment were collected has ended unless the candidate has explicitly consented to remain in your talent pool for future openings.

Our view: six practical controls for HR and people operations

In our view, HR heads, people-ops teams and founders preparing for 13 May 2027 should put six controls in place:

  1. Add a clear, itemised consent notice to your careers page, applicant tracking system and background-check authorisation forms.
  2. Set an automated retention rule in your recruitment system that deletes rejected candidate CVs and interview documents after a defined window unless the candidate opts into your future-roles talent pool.
  3. Issue a concise employee data handling notice at onboarding that explains what workplace, payroll, benefit and security-monitoring data the company processes and how staff can raise a privacy grievance.
  4. Sign Data Processing Agreements with your cloud HRMS, payroll processor, background verification agencies and recruitment consultants.
  5. Lock down salary sheets, appraisal notes and background-check reports with role-based access control and encryption, and stop circulating unencrypted payroll spreadsheets over email or chat.
  6. Build an offboarding checklist that separates statutory labour and tax records (kept for the legally required period) from routine operational files that can be erased after full-and-final settlement.

Common questions

Do employers need consent from employees to run monthly payroll and attendance?

No. The Act includes a legitimate use for the purposes of employment, safeguarding the employer from loss or liability, and providing a service or benefit sought by an employee.

Does the employment legitimate use cover job applicants and rejected resumes kept for future roles?

A candidate applying for a role is not yet an employee. Collecting resumes on a career portal or keeping rejected applications for future openings should be backed by a clear notice and affirmative consent.

Does relying on the employment legitimate use exempt HR databases from security or breach rules?

No. Even when processing under a legitimate use, the employer must maintain reasonable security safeguards, keep one-year access logs, bind payroll and HRMS vendors under contract, and report any personal data breach within 72 hours.

Are background verification agencies and outsourced payroll firms Data Processors?

Yes. When they verify candidate documents or process salary disbursements on the employer’s instructions, they act as Data Processors and must be engaged under a valid contract.

Next steps

In the news

Videos

Sources

Every section, rule and date above was checked against the official text on 22 Oct 2026.

Digital Personal Data Protection Act, 2023 (No. 22 of 2023)

  • Section 2(i)Data Fiduciary
  • Section 2(j)Data Principal
  • Section 2(k)Data Processor
  • Section 4(1)Grounds for processing: consent or certain legitimate uses
  • Section 5(1)Itemised consent notice
  • Section 6(1)Consent conditions
  • Section 7(a)Voluntarily provided personal data for a specified purpose
  • Section 7(i)Legitimate use for the purposes of employment, safeguarding the employer from loss or liability (such as corporate espionage or IP confidentiality), or providing a service or benefit sought by an employee
  • Section 8(1)Responsibility for Data Processors
  • Section 8(2)Valid contract with Data Processors
  • Section 8(5)Reasonable security safeguards
  • Section 8(6)Breach intimation
  • Section 8(7)Erasure when purpose ends unless retention is necessary for compliance with any law
  • Section 8(9)Publish business contact of DPO or person able to answer questions
  • Section 8(10)Effective grievance redressal mechanism
  • Section 13Right of grievance redressal

DPDP Rules, 2025 (G.S.R. 846(E), 13 November 2025)

  • Rule 3Notice contents
  • Rule 6Security safeguards and one-year access logs
  • Rule 7Breach intimation and 72-hour Board report
  • Rule 9Published contact information
  • Rule 14(3)Grievance response period not exceeding ninety days

Notifications

  • G.S.R. 843(E), clause (c)Core duties in force eighteen months from 13 November 2025 (13 May 2027)

A drafting aid. Get legal advice for your situation. This article explains the published text of the Act and the Rules.

All articles →

₹2,999 incl. GSTper sector · instant ZIP
Buy toolkit · ₹2,999