DPDP for HR Leaders: What You Own and What to Do First
TL;DR
HR holds more personal data than almost any other function: candidates, employees, contractors, interns and former staff, much of it sensitive. Under the DPDP Act, most employment processing can rely on the Section 7(i) legitimate use rather than consent, but notices, security, vendors, retention limits and breach reporting all still apply. HR leaders should map their data, separate employment needs from extras, tighten vendor contracts and set retention schedules before 13 May 2027.
Who this is for: CHROs, HR heads, HR operations and HR technology leaders.
Ask where an organisation keeps its most sensitive personal data, and the answer is often HR. Identity documents, bank details, salaries, health records, performance reviews, disciplinary files, background checks, family details for insurance and nominations: HR holds all of it, for every candidate, employee, contractor and former employee.
The DPDP Act applies to all of it. The good news for HR is that the Act recognises employment as a legitimate reason to process data. The challenge is that "employment purposes" has limits, and every other obligation still applies. This guide explains what HR owns and what to do first. For the general law, see The DPDP Act, Explained.
The data HR is responsible for
| Group | Typical data | Notes |
| Candidates | CVs, interview notes, assessments, background checks | Includes unsuccessful applicants. See [candidate data under DPDP](/blog/candidate-data-dpdp) |
| Employees | Identity, bank, salary, tax, attendance, performance, health, family and nominee details | See [employee data under DPDP](/blog/employee-data-dpdp) |
| Contractors and gig workers | Identity, payments, site access | Roles can be shared with staffing agencies |
| Interns | As employees, sometimes including under-18s | Section 9 applies to children |
| Former employees | Records kept for legal reasons, references | See [employee exits under DPDP](/blog/employee-offboarding-data) |
| Employees' dependants | Names, dates of birth, health insurance details | Often forgotten in data maps |
The good news: Section 7(i)
Section 7(i) allows personal data to be processed without consent "for the purposes of employment or those related to safeguarding the employer from loss or liability", including preventing corporate espionage, protecting trade secrets, intellectual property and confidential information, and providing services or benefits an employee asks for.
That covers the core of HR: payroll, attendance, statutory filings, performance management, access control and benefits administration. See legitimate uses under DPDP for the full list.
The limits
- Employment means employment. Optional wellness apps, social features, using employees in marketing, or sharing data with partners for non-employment purposes need consent or another basis.
- Necessity still matters in practice. Intrusive monitoring that goes beyond what employment requires is hard to justify. See employee monitoring under DPDP.
- Everything else applies. Security safeguards, breach notification, vendor contracts, retention limits and grievance redressal apply to employment data in full.
Five things HR should do first
- Map HR data. Add every HR processing activity to your Record of Processing Activities: purpose, data, systems, vendors, retention and lawful basis.
- Separate the core from the extras. Mark which activities rely on Section 7(i) and which need consent. Build consent flows for the extras.
- Issue a clear employee notice. Even where consent is not needed, employees should know what is collected and why. See the employee privacy notice guide.
- Fix HR vendors. HRMS, payroll, background-check, recruitment and benefits vendors need DPDP-ready contracts. See data processing agreements in India.
- Set retention. Map each HR record to the law that requires it, and erase what no law requires. See HR records retention.
The areas that carry most risk
- Background verification: third-party sources, criminal record checks and identity documents. See background verification under DPDP.
- Monitoring: email, device, CCTV and productivity tracking.
- Biometrics: fingerprint and face-recognition attendance. See biometric attendance under DPDP.
- Breaches: a leaked salary sheet is a personal data breach that must be reported to affected employees and the Data Protection Board. See the Rule 7 playbook.
- Global HR systems: HR data hosted abroad must not go to restricted countries under Section 16.
A 30-60-90 plan for HR
| Window | Actions |
| Days 1–30 | Map HR data and vendors; assign lawful basis per activity; identify consent-based extras |
| Days 31–60 | Issue employee and candidate notices; build consent for extras; update vendor contracts; review monitoring and biometrics |
| Days 61–90 | Approve retention schedule and erasure; set up employee grievance route; train HR and managers; test a payroll-leak breach scenario |
Common mistakes
- Asking employees to "consent" to everything. Consent from employees is hard to call free, and it creates a withdrawal right you cannot honour for payroll.
- Treating HR data as low-risk. It is among the most sensitive data you hold.
- Keeping CVs forever. Unsuccessful candidates' data needs a retention limit.
- Forgetting dependants and interns. Both are Data Principals too.
How ConsentifyAI helps HR teams
ConsentifyAI's ROPA module maps every HR processing activity with its lawful basis, vendors and retention period. Consent for optional programmes is captured per purpose, employee and candidate notices are versioned, and retention rules drive erasure of data that no law requires you to keep.
Sources & references
- DPDP Act, 2023 — Section 7(i)
- DPDP Act, 2023 — Section 8(1), 8(2), 8(5), 8(6), 8(7)
- DPDP Act, 2023 — Sections 9, 11–13, 16
- DPDP Rules, 2025 — Rules 6, 7, 8, 14
Frequently asked questions
Does the DPDP Act apply to employee data?
Yes. Employee, candidate and contractor data is personal data. Section 7(i) allows much employment processing without consent, but other obligations still apply.
Does HR need employee consent for payroll?
Generally no. Payroll, attendance and statutory compliance fall within employment purposes under Section 7(i), and some also within legal obligations.
Which HR processing needs consent?
Processing that goes beyond genuine employment needs, such as optional wellness programmes, marketing employee stories, sharing data with partners for non-employment purposes, or talent pools for future roles.
Who owns DPDP compliance for HR data?
The organisation as Data Fiduciary, with HR as the business owner of employee and candidate processing, working with the DPO or privacy lead, IT and legal.
Are HR software vendors our responsibility?
Yes. HRMS, payroll, background-check and recruitment vendors are processors, and the employer remains responsible for them under Section 8(1).
Related reading
Employee Data Under DPDP: When You Need Consent and When You Don't
Section 7(i) of the DPDP Act lets employers process employee data without consent for employment purposes and to protect the business from loss or liability. Consent is still needed for anything beyond that, and consent from employees is hard to call free, so use it only for genuinely optional activities. Because access and correction rights attach to consent-based data, many employment records fall outside them, but security, retention, breach and grievance duties still apply.
ReadRecruitment Under DPDP: Handling Candidate Data From Application to Talent Pool
Candidates are Data Principals too. CVs and assessments submitted for a role can be processed for that recruitment, but keeping them in a talent pool for future roles, sourcing profiles from portals and running AI screening each raise separate questions. Give candidates a clear notice, get consent for talent pools, check vendors and AI tools, and erase unsuccessful candidates' data on a fixed schedule.
ReadHR Records Retention in India: How Long to Keep Employee Data Under DPDP
The DPDP Act requires personal data to be erased once its purpose ends, unless a law requires it to be kept (Section 8(7)). For HR, many records are covered by such laws: wage and attendance registers under the Labour Codes (five years under the central rules), tax, provident fund and insurance records. Everything else, from unsuccessful candidates' CVs to old monitoring data, needs its own limit. A record-by-record schedule with automated deletion is the answer.
Read