Employee Privacy Notice Under DPDP: What to Tell Your People
TL;DR
Section 5 of the DPDP Act requires a notice when consent is requested, and most employee data relies on the Section 7(i) employment use instead. A clear employee privacy notice is still essential: it defines the purposes you rely on, explains monitoring and vendors, sets expectations on retention and rights, and replaces outdated blanket consent clauses. Use separate, Rule 3-compliant notices for any optional, consent-based programmes.
Who this is for: HR and legal teams writing or updating the privacy information given to employees.
Many Indian employers' approach to employee privacy is a paragraph in the offer letter asking new joiners to consent to "all processing of personal data by the company and its affiliates". Under the DPDP Act, that paragraph does more harm than good. It is unlikely to be valid consent, and it hides the information employees actually need.
A good employee privacy notice replaces it. This guide explains what to include, with a template.
Why you need one, even without consent
Most employment processing relies on Section 7(i), not consent, so Section 5's notice requirement does not strictly attach to it. But a notice still matters:
- it defines your purposes, which sets the limits of what you can do with the data
- it builds trust, especially around monitoring and biometrics
- it reduces grievances, because employees know what to expect
- it supports consent for optional programmes, which do require Section 5 notices
What to include
| Section | Content |
| Who we are | The employer entity and a contact for privacy questions, such as the DPO or HR privacy lead (Section 8(9)) |
| What we collect | Itemised categories: identity, contact, bank, salary, tax, attendance, performance, health (where applicable), dependants, IT and access logs, CCTV, biometrics |
| Why | Each purpose: payroll, statutory compliance, performance management, security, benefits, workplace safety |
| Basis | Employment purposes under Section 7(i); legal obligations; consent for optional programmes |
| Monitoring | What is monitored, why, and who sees it (see [employee monitoring](/blog/employee-monitoring-dpdp)) |
| Who receives it | Payroll, HRMS, insurers, BGV vendors, auditors, group companies, authorities |
| Transfers | Whether data is stored or accessed outside India |
| Retention | How long each category is kept (see [HR records retention](/blog/hr-data-retention-india)) |
| Security | A short description of safeguards |
| Your rights | How to ask about, correct or raise a grievance about your data, and how to complain to the Data Protection Board |
| Changes | How the notice will be updated and communicated |
Template
Separate notices for optional programmes
For anything that relies on consent, such as wellness apps, employee photos in marketing or optional surveys, give a standalone, itemised notice under Rule 3, with an unticked opt-in and an easy way to withdraw. See how to write a DPDP privacy notice.
Common mistakes
- Blanket consent in offer letters. Remove it.
- Hiding monitoring. Undisclosed monitoring erodes trust and invites disputes.
- English only for a multilingual workforce. Provide versions employees can read.
- Never updating it. New tools and vendors change what you do with data.
How ConsentifyAI helps
ConsentifyAI generates employee and candidate notices from your ROPA, so they list exactly the data, purposes and vendors recorded there. Notices are versioned and multilingual, and optional programmes get their own consent flows with withdrawal built in.
Sources & references
- DPDP Act, 2023 — Section 5, 6(3)
- DPDP Act, 2023 — Section 7(i)
- DPDP Act, 2023 — Section 8(9), 13
- DPDP Rules, 2025 — Rule 3
Frequently asked questions
Is an employee privacy notice required under the DPDP Act?
Section 5 attaches notice to consent requests. Where you rely on Section 7(i) for employment, a notice is not strictly required by Section 5, but it is strongly recommended and needed for consent-based activities.
Can the notice be part of the employee handbook?
The general employee notice can sit alongside the handbook. Notices for consent-based activities must be standalone and itemised under Rule 3.
Should we remove consent clauses from offer letters?
Yes, for blanket consent to all processing. Replace them with the notice and use specific, optional consent only where needed.
Who should receive the notice?
Employees, interns, and, in adapted form, candidates and contractors. Update it when processing changes.
Which languages should the notice be in?
English and the languages your workforce reads. For consent-based activities, individuals must be able to access notices in English or any Eighth Schedule language.
Related reading
Employee Data Under DPDP: When You Need Consent and When You Don't
Section 7(i) of the DPDP Act lets employers process employee data without consent for employment purposes and to protect the business from loss or liability. Consent is still needed for anything beyond that, and consent from employees is hard to call free, so use it only for genuinely optional activities. Because access and correction rights attach to consent-based data, many employment records fall outside them, but security, retention, breach and grievance duties still apply.
ReadHow to Write a DPDP Privacy Notice People Actually Read
Under Section 5 of the DPDP Act and Rule 3, every request for consent must come with a notice that stands on its own, uses clear and plain language, and itemises the personal data, the specific purpose and what it enables. It must explain how to withdraw consent, exercise rights and complain to the Data Protection Board, and be available in English or any Eighth Schedule language. A privacy policy alone does not meet this standard.
ReadEmployee Monitoring Under DPDP: What's Lawful, What's Risky
The DPDP Act allows employers to process employee data to safeguard the business from loss or liability, which covers proportionate security monitoring of company systems. It does not make every form of surveillance lawful. Keystroke logging, constant screen capture, webcam monitoring and tracking personal devices are hard to justify as necessary. Define the purpose, tell employees, collect the minimum, restrict access and set short retention.
Read