Answer 4 quick steps about your HR data practices. Get a complete, legally-grounded employee consent framework tailored to your company — delivered to your inbox.
What is an employee consent framework under the DPDP Act? An employee consent framework under the DPDP Act 2023 is a set of four interconnected documents that together satisfy your obligations as an employer and data fiduciary: an Employee Privacy Notice (tells employees what data you collect and why), an onboarding Consent Form (captures specific consent for sensitive categories like biometrics and health data), a Data Retention Schedule (specifies when each category is deleted after employment ends), and an Employee Rights Response Template (enables HR to respond to access, correction, nomination, and erasure requests within DPDP Act timelines). Employers without these four documents risk penalties of up to ₹250 crore per breach under the Act.
Select every type of employee data your organisation collects. The more accurate your selection, the more precisely tailored your consent framework will be.
Answer honestly. Your responses determine which gaps the framework will specifically address for your organisation.
Your complete Employee Consent Framework will be emailed to
Secure payment via Razorpay · Delivered within 2 business hours
Your Employee Consent Framework is being prepared. We'll email it to within 2 business hours.
Questions? Email hello@nitibharat.com
Please contact hello@nitibharat.com with your payment ID and we'll resolve it immediately.
Under the DPDP Act 2023, employers may rely on the legitimate use ground for data necessary to fulfil the employment contract (payroll, statutory compliance). However, for additional processing — such as biometrics, health data, monitoring, or background checks — explicit and informed consent is required. Employers must issue a DPDP-compliant privacy notice at the time of onboarding and obtain specific consent for sensitive categories.
A complete DPDP employee consent framework includes four documents: (1) Employee Privacy Notice — describes what data is collected, why, and for how long; (2) Onboarding Consent Form — captures explicit consent for sensitive data categories at joining; (3) Data Retention Schedule — specifies how long each category of employee data is kept after employment ends; and (4) Employee Rights Response Template — enables HR to respond to access, correction, nomination, and erasure requests within DPDP Act timelines.
No. Under the DPDP Act 2023, your HRMS, payroll, BGV, and any other vendor that processes personal data on your behalf must be a registered Data Processor operating under a written Data Processing Agreement (DPA). Without a DPA, your organisation remains fully liable for any data breach or misuse by the vendor. This applies to all HRMS platforms including Keka, Darwinbox, greytHR, Zoho People, and SAP SuccessFactors.
One real DPDP development explained in plain English, one practical how-to, one number from our own assessment data. Nothing else — no daily noise, no sales pitch.
No spam. Unsubscribe with one click, anytime.
