The DPDP Act for employers

The Digital Personal Data Protection Act, 2023 (the DPDP Act) is India’s general privacy law. The DPDP Rules, 2025, notified on 13 November 2025, fill in the detail and set the dates.

Every employer holds a lot of personal data: ID numbers, bank accounts, salaries, family details, health information, attendance and performance records. In the Act’s terms, the employer is the data fiduciary and each employee, candidate or former employee is a data principal. Your payroll and HR software providers are data processors acting for you.

The dates

The Rules come in three stages, counted from 13 November 2025:

From	What applies
13 November 2025	The Data Protection Board is set up and its procedures apply (rules 1, 2 and 17 to 21).
13 November 2026	Registration and duties of consent managers (rule 4).
13 May 2027	The main duties: notice, security, breach reporting, retention, children’s data, rights, grievances and the rest (rules 3, 5 to 16, 22 and 23), with the matching sections of the Act.

So most of what follows becomes enforceable on 13 May 2027. Seven months is not long to change notices, consent flows, retention schedules and incident plans.

Unsettled: in January 2026 MeitY consulted industry on shortening the 18 months to 12, which would have brought the main duties forward to November 2026. As of 15 October 2026 we found no notified amendment, so 13 May 2027 stands. Watch the Gazette.

Do you need employees’ consent?

Usually not for core HR. Section 7 of the Act lists “legitimate uses” where you may process personal data without consent. Section 7(i) covers processing for the purposes of employment, or to protect the employer from loss or liability, for example preventing corporate espionage, keeping trade secrets confidential, or providing a service or benefit the employee asks for.

That comfortably covers payroll, statutory filings, attendance, leave and the ordinary running of employment. It does not make every use of employee data lawful:

• Use beyond employment (marketing, sharing with third parties for their own purposes, optional wellness programmes) needs consent.
• Pre-employment screening of candidates who aren’t yet employees is less clearly covered; many advisers recommend consent for background checks.
• Monitoring must stay tied to a genuine employment purpose and be proportionate.

Where you rely on consent, it must be free, specific, informed, unambiguous and given by a clear action, and as easy to withdraw as it was to give.

Notice: tell people what you hold

When you ask for consent, you must give a notice that sets out, in plain language:

• the personal data and the purpose for each;
• how the person can withdraw consent and exercise their rights;
• how to complain to the Data Protection Board.

The notice must be available in English or any of the 22 languages in the Eighth Schedule of the Constitution, at the person’s choice. Even where you rely on legitimate use and no notice is strictly required, a clear employee privacy notice is good practice and makes rights requests easier to handle.

Employees’ rights

From 13 May 2027, employees (and former employees and candidates) can:

• get a summary of the personal data you hold and the processing you do, and who you’ve shared it with;
• have it corrected, completed or updated;
• have it erased once it’s no longer needed, unless a law requires you to keep it;
• nominate someone to exercise their rights if they die or can’t act;
• have grievances answered: the Rules cap your response time at 90 days.

You must publish how people can make these requests and who answers them.

Keep it only as long as you need it

Personal data must be erased once its purpose is served, unless another law requires you to keep it. For employers, many records do have a legal keep-period: wage registers under the Code on Wages, tax records under the Income-tax Act, PF and ESI records, accounting records under the Companies Act. The DPDP Act doesn’t override those.

The Rules also require you (and your processors) to keep logs of processing for at least one year.

In practice you need a retention schedule: each kind of record, the law that sets its keep-period, and when it is erased or anonymised. Hold anything under investigation or dispute until it’s resolved.

Breaches: two clocks, two regulators

If personal data is breached, you have duties under two regimes:

• CERT-In (under the IT Act): report cyber incidents within 6 hours of noticing them, under its directions of 28 April 2022.
• The Data Protection Board (under the DPDP Rules, from 13 May 2027): an initial report without delay, and a detailed report within 72 hours of becoming aware (or longer if the Board allows).
• The people affected: tell each of them without delay, in plain language, what happened, the likely consequences, what you’re doing and what they can do.

Your incident plan should run all three together. The CERT-In clock is the shortest.

Children’s data and under-18 staff

Under the Act, a child is anyone under 18. Before processing a child’s personal data you need verifiable consent from a parent or lawful guardian, and you may not track, behaviourally monitor or target advertising at children.

This matters for employers who take on apprentices or trainees under 18, and for family details (such as children’s names and dates of birth) collected for insurance or nominations.

Unsettled: how the parental-consent rule sits alongside the employment legitimate use for an employee who is under 18. Until there’s guidance, recording a guardian’s consent is the safer course.

Penalties

The Board can impose penalties of up to ₹250 crore for failing to take reasonable security safeguards, and up to ₹200 crore each for failing to report a breach or to meet the duties on children’s data. Most sources read the penalty provisions as starting with the main duties on 13 May 2027, though a few say November 2026; check the commencement notification.

What to do before May 2027

1. Map your employee data: what you hold, where (HR, payroll, attendance, email, spreadsheets), and why.
2. Decide the basis for each use: legitimate use for employment, or consent.
3. Write an employee privacy notice, in the languages your people read.
4. Set up a way to handle rights requests and grievances within 90 days.
5. Build a retention schedule with legal keep-periods, and erase what’s past its date.
6. Write an incident plan covering CERT-In (6 hours), the Board (72 hours) and the people affected.
7. Review your processors’ contracts for security, breach help, deletion and log keeping.
8. Flag under-18 staff and collect guardian consent.

How Dexta handles this

• A privacy page for every person. In Dexta Hub, each person sees the privacy notice, their consent choices, their requests and complaints, and their nominee. Former employees keep access.
• Notices in 23 languages. The notice can be published in English plus the 22 Eighth Schedule languages (your company supplies the translations), with reminders to people who haven’t seen it.
• Consent register of purposes and each person’s consent, with a CSV download.
• Requests and complaints: five request types (see my data, correct, erase, nominee, complaint) worked as a numbered queue with a legal-hold check.
• “Your data” download that gathers a person’s data from every Dexta app into one copy, and erasure across the apps once your privacy team decides.
• Retention schedule and legal holds for nine record types, with a due-for-erasure report and an optional automatic clean-up (off by default, dry run first).
• Breach register that logs an incident with its clocks (6 hours for CERT-In, 72 hours for the Board’s full report) and notifies the people affected.
• Staff under 18 are flagged and a guardian’s consent recorded.

This is general guidance, not legal advice.