Employee Monitoring Under DPDP: What's Lawful, What's Risky
TL;DR
The DPDP Act allows employers to process employee data to safeguard the business from loss or liability, which covers proportionate security monitoring of company systems. It does not make every form of surveillance lawful. Keystroke logging, constant screen capture, webcam monitoring and tracking personal devices are hard to justify as necessary. Define the purpose, tell employees, collect the minimum, restrict access and set short retention.
Who this is for: HR, security and legal leaders who decide how employees and company systems are monitored.
Remote and hybrid work, insider threats and cheap monitoring software have made workplace monitoring far more common, and far more intrusive. Tools now on the market can log keystrokes, take screenshots every few minutes, record webcams, track location and score "productivity" from mouse movements.
The DPDP Act does not prohibit monitoring. But it requires a lawful basis, and it requires the data collected to be protected, limited and deleted. This explainer sets out where the lines fall.
What Section 7(i) allows
Section 7(i) permits processing without consent for employment purposes and for "safeguarding the employer from loss or liability", with examples including preventing corporate espionage and protecting trade secrets, intellectual property and confidential information. That supports monitoring aimed at security and protection of company assets, such as:
- access logs on company systems and applications
- data loss prevention on corporate email and file-sharing
- endpoint security on company devices
- CCTV in work areas, entrances and storage areas
- investigating specific suspected misconduct or data theft
Where monitoring becomes risky
The legitimate use covers employment and protection from loss. It does not make every technique lawful. These are hard to justify as necessary:
| Monitoring | Why it is risky |
| Keystroke logging | Captures passwords, personal messages and far more than any security need |
| Frequent screenshots or screen recording | Captures personal and third-party data continuously |
| Webcam capture during work hours | Intrudes into employees' homes and families |
| Location tracking outside working hours | Goes beyond employment |
| Monitoring personal accounts or devices | Outside the employer's legitimate interest |
| Emotion or "engagement" analysis | Speculative, intrusive and error-prone |
Consent does not rescue intrusive monitoring either. Consent from employees is hard to call free, and it can be withdrawn.
Five principles for proportionate monitoring
- Define the purpose. Security, compliance, safety or a specific investigation, written down before the tool is chosen.
- Use the least intrusive method. Aggregate data and alerts before content; system logs before screenshots.
- Tell employees. Explain what is monitored, why, and who sees the results, in your employee privacy notice and monitoring policy.
- Restrict access. Monitoring data should be visible only to the security or HR team that needs it, with access itself logged.
- Set short retention. Keep monitoring data only as long as needed; Rule 6 requires security logs for at least one year, but not content captured beyond what security needs.
CCTV
CCTV in work areas for security can generally rely on Section 7(i). Put up clear signage, avoid private areas entirely, restrict viewing and set a retention period. Visitors captured on camera are Data Principals too.
Remote work and BYOD
For remote employees, monitor company systems and data, not homes. For personal devices, use a BYOD policy that separates company apps and data (for example through containerisation) and limits monitoring to that container.
Covert monitoring
Covert monitoring should be exceptional, limited to specific, serious investigations, approved by legal, time-limited and documented. It should never be a routine practice.
Checklist
Checklist
- Each monitoring tool listed in the ROPA with purpose and basis
- Monitoring policy shared with employees
- Least intrusive method chosen for each purpose
- No keystroke logging, webcam capture or personal-device monitoring without strong justification
- Restricted, logged access to monitoring data
- Defined retention for each data type
- Vendor contracts for monitoring software
How ConsentifyAI helps
ConsentifyAI records each monitoring activity in your ROPA with its purpose, lawful basis, access and retention, so HR, security and legal share one view of what is monitored and why, and can show it if challenged.
Sources & references
- DPDP Act, 2023 — Section 7(i)
- DPDP Act, 2023 — Section 8(5), 8(7)
- DPDP Rules, 2025 — Rule 6
Frequently asked questions
Can employers monitor employees under the DPDP Act?
Yes, for employment purposes and to safeguard the employer from loss or liability under Section 7(i), such as protecting confidential information and preventing data theft. Monitoring should be proportionate to that purpose.
Do employers need consent for CCTV?
CCTV for security in work areas can generally rely on Section 7(i). Cameras in private areas such as washrooms or changing rooms are never appropriate.
Is productivity tracking software legal?
The Act does not ban it, but intrusive tools such as keystroke logging, frequent screenshots and webcam capture are hard to justify as necessary for employment. Use the least intrusive method that meets the purpose.
Can we monitor employees' personal devices?
Only within a clearly defined BYOD policy limited to company data and apps. Monitoring personal content on personal devices is very difficult to justify.
Do we have to tell employees about monitoring?
Telling employees is strongly recommended, even where consent is not needed. Covert monitoring should be limited to specific investigations with legal advice.
Related reading
Employee Data Under DPDP: When You Need Consent and When You Don't
Section 7(i) of the DPDP Act lets employers process employee data without consent for employment purposes and to protect the business from loss or liability. Consent is still needed for anything beyond that, and consent from employees is hard to call free, so use it only for genuinely optional activities. Because access and correction rights attach to consent-based data, many employment records fall outside them, but security, retention, breach and grievance duties still apply.
ReadBiometric Attendance Under DPDP: Fingerprints, Face Recognition and the Law
Biometric attendance is common in Indian workplaces, and the DPDP Act does not ban it. Attendance is an employment purpose under Section 7(i), but biometrics cannot be changed if they leak, so the bar for security and proportionality is high. Use templates rather than images, encrypt them, limit access, contract the device vendor properly, offer alternatives where practical and delete biometric data promptly when employees leave.
ReadDPDP for HR Leaders: What You Own and What to Do First
HR holds more personal data than almost any other function: candidates, employees, contractors, interns and former staff, much of it sensitive. Under the DPDP Act, most employment processing can rely on the Section 7(i) legitimate use rather than consent, but notices, security, vendors, retention limits and breach reporting all still apply. HR leaders should map their data, separate employment needs from extras, tighten vendor contracts and set retention schedules before 13 May 2027.
Read