HR Records Retention in India: How Long to Keep Employee Data Under DPDP
TL;DR
The DPDP Act requires personal data to be erased once its purpose ends, unless a law requires it to be kept (Section 8(7)). For HR, many records are covered by such laws: wage and attendance registers under the Labour Codes (five years under the central rules), tax, provident fund and insurance records. Everything else, from unsuccessful candidates' CVs to old monitoring data, needs its own limit. A record-by-record schedule with automated deletion is the answer.
Who this is for: HR operations, payroll, compliance and legal teams responsible for employee records.
HR departments rarely delete anything. Files from employees who left ten years ago, CVs from every recruitment campaign, old attendance exports and scanned documents accumulate in HRMS platforms, shared drives and email. Under the DPDP Act, that habit becomes a liability: data kept beyond its purpose is data you are no longer allowed to have, and every extra record is extra breach exposure.
The rule: erase when the purpose ends, unless a law says keep
Section 8(7) requires a Data Fiduciary to erase personal data when consent is withdrawn or it is reasonable to assume the purpose is no longer being served, unless retention is necessary for compliance with any law. Section 12(3) applies the same exception to erasure requests. Rule 6 separately requires security logs to be kept for at least one year.
For HR, that means two categories:
- Records a law requires you to keep — keep them for the required period, then delete.
- Everything else — delete when the purpose ends.
Records the law requires
The four Labour Codes came into force on 21 November 2025, replacing 29 central labour laws and consolidating registers. Under the central rules, wage, attendance, overtime and deduction records are kept for five years, and may be kept electronically. States have their own rules for establishments in their jurisdiction, so confirm the position for each state where you employ people.
Other laws set their own requirements for payroll tax, provident fund, employee state insurance, gratuity, bonus, and statutory registers. A sample schedule might look like this, with the periods confirmed by your legal and payroll teams:
| Record | Governing requirement | Retention approach |
| Wage, attendance, overtime, deduction registers | Labour Codes and rules | Five years under central rules; check state rules |
| Payroll tax records | Income tax law | Per tax law requirements |
| PF and ESI records | Code on Social Security and schemes | Per scheme requirements |
| Employment contracts and key HR decisions | Limitation periods for claims | Defined period after exit, set with legal |
| Internal Committee (POSH) records | Sexual harassment law; confidentiality | Restricted access; defined period set with legal |
| Accident and safety records | OSH Code | Per OSH rules |
Records no law requires
| Record | Suggested approach |
| Unsuccessful candidates' CVs and interview notes | Short fixed period after the recruitment closes; talent pool only with consent |
| Background verification supporting documents | Delete once verification is complete; keep the outcome as needed |
| Biometric templates | Delete promptly on exit |
| Monitoring data (screenshots, DLP alerts) | Short period unless part of an investigation |
| CCTV footage | Short rolling period unless needed for an incident |
| Exit interview responses | Aggregate, then delete individual responses |
| Optional programme data (wellness, surveys) | End of the programme or when consent is withdrawn |
Building the schedule
- List every HR record type from your ROPA, including systems, drives and vendor platforms.
- Assign the governing law, or "none", to each one.
- Set the trigger and period: for example, "five years after the end of the wage period" or "six months after recruitment closes".
- Define the deletion method for each system, including vendors and backups.
- Allow legal holds for disputes, with documented start and end.
- Automate deletion where possible, and audit it at least annually.
Common mistakes
- One blanket period for every HR record. Different records have different legal requirements.
- Keeping the whole personnel file because one document must be kept. Keep the required record, not everything around it.
- Forgetting vendors and shared drives. HRMS, payroll and recruitment vendors hold copies too.
- Legal holds that never end. Every hold needs an owner and an end date.
How ConsentifyAI helps
ConsentifyAI records the retention period, trigger and governing law for every HR processing activity in your ROPA, applies legal holds, and generates deletion tasks across internal systems and vendors when records reach the end of their life, with evidence of each deletion.
Sources & references
- DPDP Act, 2023 — Section 8(7), 12(3)
- DPDP Rules, 2025 — Rule 6, Rule 8
- Other — Code on Wages, 2019; Code on Social Security, 2020; Industrial Relations Code, 2020; OSH Code, 2020 (in force 21 November 2025)
Frequently asked questions
How long must employers keep wage and attendance records?
Under the Labour Codes in force since 21 November 2025, the central rules set five years for wage, attendance, overtime and deduction records. State rules may add requirements, so confirm the rules for each state.
Can employees ask us to delete their HR records?
Erasure gives way to retention required by law (Sections 8(7) and 12(3)). Records a law requires must be kept for that period; everything else should be erased when no longer needed.
How long should we keep unsuccessful candidates' data?
Only as long as needed for that recruitment and any likely dispute, unless the candidate consented to a talent pool.
Do we have to delete data from backups?
Backups should follow the retention schedule through defined backup rotation, so deleted data expires from backups within a known period.
What about records needed for litigation?
Data relevant to an actual or reasonably expected dispute can be preserved under a documented legal hold, then deleted when the hold ends.
Related reading
Employee Exits Under DPDP: Offboarding, Ex-Employee Requests and Data Leakage
Exits create two DPDP risks. First, leavers who take customer or employee data with them can cause a personal data breach your organisation must report. Second, former employees remain Data Principals: their records must be kept only as long as the law requires, and their requests and grievances must be handled properly. A good offboarding process revokes access promptly, checks for data exfiltration, settles retention, and treats references and alumni programmes as separate purposes.
ReadDPDP for HR Leaders: What You Own and What to Do First
HR holds more personal data than almost any other function: candidates, employees, contractors, interns and former staff, much of it sensitive. Under the DPDP Act, most employment processing can rely on the Section 7(i) legitimate use rather than consent, but notices, security, vendors, retention limits and breach reporting all still apply. HR leaders should map their data, separate employment needs from extras, tighten vendor contracts and set retention schedules before 13 May 2027.
ReadROPA Under DPDP: Map Every Data Flow Before Someone Else Does
Unlike the GDPR, the DPDP Act does not explicitly require a Record of Processing Activities. But without one, you cannot write itemised notices, tell individuals who received their data, erase it on time, scope a breach within 72 hours, or prove compliance. A DPDP ROPA records each processing activity's purpose, data, individuals, lawful basis, systems, recipients, transfers, retention and safeguards. It is the foundation every other DPDP control is built on.
Read