Employee Data Under DPDP: When You Need Consent and When You Don't

Who this is for: HR, legal and privacy teams deciding the lawful basis for employee data.

Many employers responded to earlier privacy rules by adding a consent clause to the offer letter: "I consent to the company processing my personal data for all purposes." Under the DPDP Act, that approach is both unnecessary and unreliable. Unnecessary, because the Act gives employers a specific legitimate use for employment. Unreliable, because blanket consent from someone who needs the job is unlikely to meet the standard of free, specific consent.

This explainer sets out how to choose the right basis for employee data.

Section 7(i): what it covers

Section 7(i) permits processing without consent:

• for the purposes of employment, and
• for purposes related to safeguarding the employer from loss or liability, such as preventing corporate espionage, maintaining the confidentiality of trade secrets, intellectual property and classified information, and
• for providing any service or benefit sought by an employee.

Why consent is a poor default for employees

Consent under Section 6(1) must be free and unconditional. When an employer asks for consent as a condition of employment, the employee has little real choice. And consent can be withdrawn at any time under Section 6(4): an employee who withdraws consent to payroll processing would leave you unable to pay them.

Use consent only where the activity is genuinely optional and the employee can say no without any effect on their job.

What changes for employee rights

The access and correction rights in Sections 11 and 12 apply to personal data processed on consent, including data voluntarily provided under Section 7(a). Data processed only under Section 7(i) may fall outside these specific rights. But:

• the grievance right under Section 13 applies regardless, with a 90-day response limit
• security, retention and breach obligations apply in full
• good practice, and often employment law and policy, still favour giving employees access to their own records

Do not treat the narrower rights as a reason to refuse reasonable requests. Refusals tend to become grievances.

Sensitive employee data

The DPDP Act has no special category for health, biometric or financial data, but these are where employee harm is greatest. For medical examinations, disability accommodations, health insurance claims and maternity records:

• collect only what employment, insurance or law requires
• restrict access to the people who need it
• keep it separate from general HR files
• set strict retention periods

Interns under 18

If you hire interns or apprentices under 18, they are children under the Act. For any processing that relies on consent, you need verifiable consent from a parent or guardian, and tracking or targeted advertising directed at them is prohibited. See verifiable parental consent.

Practical steps

1. List every employee data activity in your ROPA with its basis.
2. Remove blanket consent clauses from offer letters and replace them with a clear employee privacy notice.
3. Build separate, optional consent for activities outside employment.
4. Set up an employee grievance route that meets the 90-day limit.

Common mistakes

• Blanket consent in offer letters. Unlikely to be free; creates withdrawal problems.
• Stretching "employment" to everything. Optional and commercial uses need their own basis.
• Refusing access because the right doesn't strictly apply. It damages trust and invites grievances.

How ConsentifyAI helps

ConsentifyAI records the lawful basis for every employee data activity, including the specific Section 7 clause, and captures separate, withdrawable consent for optional programmes. Employee notices are versioned, and grievances are tracked against the 90-day limit.