Quick Answer
HR Heads are responsible for ensuring DPDP Act 2023 compliance across the entire employee data lifecycle — from recruitment and onboarding through performance management to offboarding and alumni records. Key obligations include obtaining valid consent for optional HR data processing, publishing an employee privacy notice, and defining retention periods for each HR data category. HR must also respond to employee Data Principal rights requests within DPDP timelines.
Quick AnswerHR heads must implement purpose-limited consent for employee data, review all HRMS vendor agreements for DPDP compliance, restrict background check data use, and build employee awareness on DPDP rights.
DPDP Compliance Checklist
- Audit all employee data: recruitment, employment, payroll, benefits, performance, exit
- Implement purpose-limited consent for optional data collection (e.g., emergency contacts, dietary preferences)
- Review HRMS vendor (Darwinbox, SAP SuccessFactors, Keka) DPAs for DPDP compliance
- Restrict background verification data use — only for employment verification purpose
- Implement employee data retention schedule: delete ex-employee data within defined period
- Train HR team on DSAR handling — employees have right to access their own data
- Review third-party payroll and benefits processors for DPDP sub-processor compliance
- Implement secure off-boarding: revoke system access and archive/delete employee data appropriately
- Publish employee privacy notice covering all HR data processing
- Conduct annual DPDP audit of all HR data systems
Download Full Compliance Guide (Free)
Get the complete sector-specific checklist, risk areas, and 30-day action plan — delivered to your inbox.
Frequently Asked Questions
Can employers monitor employee emails and devices under DPDP?+
Monitoring is permissible with disclosed policies. Employees must be informed of monitoring scope. Covert monitoring without disclosure violates DPDP.
How long can organisations retain ex-employee data?+
Best practice: retain employment records for 7-10 years (PF, gratuity), delete personal data beyond legal retention periods. Document your retention schedule.
Do employees have the right to access their HR records?+
Yes. Under DPDP, employees can request access to their personal data. HR must respond within 30 days.
Every Sunday
The Sunday DPDP Brief
One real DPDP development explained in plain English, one practical how-to, one number from our own assessment data. Nothing else — no daily noise, no sales pitch.
No spam. Unsubscribe with one click, anytime.
