Employee Exits Under DPDP: Offboarding, Ex-Employee Requests and Data Leakage

Who this is for: HR, IT security and legal teams who manage employee exits.

When an employee leaves, two kinds of personal data are in play: the data they had access to, and the data you hold about them. The DPDP Act affects both. A leaver who walks out with a customer list can trigger a breach-notification obligation. A former employee who writes in two years later asking what you still hold about them is exercising rights you must handle properly.

Part 1: Data the leaver had access to

Revoke access on time

Access should end on or before the last working day, across email, HRMS, CRM, cloud storage, code repositories, SaaS tools and any shared accounts. Late revocation is one of the most common causes of insider incidents.

Check for data exfiltration

For roles with access to significant personal data, review activity in the notice period: unusual downloads, forwarding to personal email, uploads to personal cloud storage or USB transfers. Monitoring for this purpose falls within safeguarding the employer from loss under Section 7(i), provided it is proportionate and disclosed in your monitoring policy.

If data has left

If a departing employee has taken or used personal data without authorisation, that is a personal data breach under Section 2(u). Rule 7 requires notice to affected individuals and the Data Protection Board without delay, and a detailed report within 72 hours. Follow your breach response plan; recovering the data does not remove the reporting duty.

Recover devices and records

Collect laptops, phones and access cards, wipe or reassign devices securely, and make sure work files are not left only on personal devices.

Part 2: Data you hold about the leaver

Retention

Former employees' records are kept only as long as a law requires or a genuine purpose remains: wage and attendance registers, tax and PF records, and records needed for possible disputes. Delete the rest, including biometric templates, monitoring data and optional programme data. See HR records retention.

Requests from former employees

Former employees remain Data Principals. They may ask what you hold, ask for corrections, ask for erasure, or raise grievances. Route these through your rights request process:

• verify identity using details you already hold, such as employee ID and registered contact
• apply the scope rules: access and correction rights attach to consent-based and voluntarily provided data, but grievances can be raised about anything
• where a law requires retention, keep the record and explain which law and until when
• respond within the 90-day grievance limit, and much faster for simple requests

References

Provide references when the former employee asks or names you as a referee. Keep them factual and limited to what is relevant. Avoid sharing sensitive information such as health or disciplinary details unless the person has agreed and it is necessary.

Alumni networks and rehiring

Keeping in touch for alumni events, rehiring campaigns or marketing is a new purpose. Ask for opt-in consent at exit, separate from the exit paperwork, and make it easy to leave.

Exit interviews

Exit interview responses are personal data. Tell leavers how responses will be used, aggregate them for analysis, and delete individual responses after a short period.

Offboarding checklist

How ConsentifyAI helps

ConsentifyAI sets retention flags on a leaver's records based on your HR retention schedule, triggers deletion tasks for data no law requires, records alumni consent separately, and runs former employees' requests through the same verified, tracked rights process as everyone else.