Who this page is for
Indian employers, HR leaders, staffing agencies, and payroll teams managing job applicants, employees, contractors, BGV vendors, and HRMS platforms.
The personal data typically processed in this sector
These categories are typical for organisations in this sector. Your data record (Step 03) is where you map your exact data flows and systems.
Job applicant resumes, interview notes & talent pipelines
- Where it comes from:
- Career pages, ATS platforms, recruitment agencies, and LinkedIn sourcing
- What the Act says:
- Pre-employment candidate screening happens before the employment relationship begins and requires a clear Section 5 notice and Section 6 consent.
Employee onboarding, EPFO/ESIC, salary & tax declarations
- Where it comes from:
- HRMS, payroll software, statutory filing portals, and finance desks
- What the Act says:
- Covered under Section 7(i) legitimate use for employment purposes and statutory compliance (Income Tax, EPF, POSH, maternity benefits).
Biometric attendance, CCTV, laptop DLP & monitoring logs
- Where it comes from:
- Access control terminals, office security systems, and IT endpoint tools
- What the Act says:
- Document clear workplace security and attendance purposes under Section 7(i) and apply Section 8(5) safeguards and 1-year log retention.
Background verification (BGV), health insurance & payroll vendors
- Where it comes from:
- Third-party BGV agencies, group mediclaim TPAs, and cloud HRMS processors
- What the Act says:
- Bind every BGV agency, payroll vendor, and HRMS provider under a written Section 8(2) Data Processing Agreement.
Which documents to start with
- Step 01: Start here. Confirm the Act applies and see which duties you already cover.
- Step 03: Know your data. List every item above, where it sits and which vendor or processor holds it.
- Step 05: Ask properly. The itemised notice shown with or before a consent request under Section 5(1) and Rule 3.
- Step 04: Set the rules. The governance policy behind your notices, retention, and vendor controls.
- Step 06: Keep only as long as needed. Erasure when the purpose ends unless another law requires retention, plus 1-year minimum log retention under Rule 8(3) and Seventh Schedule.
- Step 07: Answer people on time. Rights requests and grievance replies within the period you publish, up to 90 days under Rule 14(3).
- Step 09: Control your vendors. Your cloud, SaaS, payment, communication, and analytics processors.
- Step 09b: Sign the vendor contract. The mandatory Data Processing Agreement under Section 8(2).
- Step 11: When something goes wrong. Personal data breach notification to the Data Protection Board (within 72 hours under Rule 7) and each affected Data Principal.
Statutory timeline, SLA, and penalty ceiling
The DPDP Act, 2023 (9 Chapters, 44 Sections, 1 Schedule) and DPDP Rules, 2025 (G.S.R. 846(E), notified 13 Nov 2025: 23 Rules, 7 Schedules) enforce core Data Fiduciary obligations from 13 May 2027. Grievance redressal must complete within 90 days (Rule 14(3)), processing logs must be retained for at least 1 year (Rule 8(3) + Seventh Schedule), and failure to maintain reasonable security safeguards carries a statutory ceiling of up to ₹250 crore.
The documents are a drafting aid. Get legal advice for your situation.