HR departments process more categories of employee personal data than any other function — from payroll and performance records to health data, biometrics, and background verification. Every employee is a Data Principal under DPDP Act 2023 with rights to access, correction, and in some cases deletion of their HR data.
DPDP-compliant HR policies — employee privacy notice, monitoring policy, payroll data protection, and offboarding data checklist.
The Employee Privacy Notice (EPN) is the foundational DPDP document for HR. It informs employees — as Data Principals — about all personal data processing that occurs during their employment. The EPN must be provided to new employees at or before onboarding, and must be updated whenever processing purposes change materially.
Required EPN Contents under DPDP: (a) Categories of personal data collected — basic identity, payroll, performance, health, biometric, BGV. (b) Purpose of processing for each category — legal basis where applicable (statutory compliance vs consent). (c) Third parties who receive employee data — payroll providers, insurance companies, government bodies, background check agencies. (d) Cross-border transfers — if payroll is processed overseas (cloud payroll, shared services centre). (e) Retention periods per category. (f) Employee rights — access, correction, grievance mechanism. (g) Grievance Officer contact details.
Notice vs Consent for Employment Data: Not all HR data processing requires consent. Payroll processing, statutory filings (TDS, PF, ESI), and legal compliance activities can be conducted on a legitimate processing basis under DPDP Rules 2025. Document the legal basis for each processing activity — this distinction is crucial in a DPDP audit. Activities beyond statutory requirements (internal profiling, skills database, marketing to ex-employees) require explicit consent.
Notice Delivery and Acknowledgement: Issue the EPN via the HRMS onboarding workflow. Obtain a digital acknowledgement (click-through or e-signature) from each employee. Store acknowledgements in the HRMS with employee ID, date, and EPN version. When the EPN is updated, notify affected employees and obtain fresh acknowledgements.
Candidates who apply for roles — whether through your careers page, job portals, or recruitment agencies — are Data Principals with full DPDP rights from the moment you collect their personal data. The Candidate Privacy Notice (CPN) must be presented at the point of application.
CPN Key Disclosures: (a) What data is collected — resume, LinkedIn profile data, interview notes, assessment results. (b) Who processes the data — internal HR team, recruiting managers, and any third-party ATS or AI screening tool. (c) How long data is retained — for unsuccessful candidates, best practice is 6 months from rejection date. (d) Whether the candidate will be added to a talent pool — this requires explicit opt-in, not assumption. (e) Cross-border transfers — if the ATS or interview platform processes data overseas.
AI-Assisted Hiring Disclosure: If you use AI tools for resume screening, video interview analysis, or candidate scoring, this must be disclosed in the CPN. DPDP and DPDP Rules 2025 require disclosure of automated decision-making that significantly affects individuals — and hiring decisions clearly qualify.
Candidate Rights in the Hiring Process: (a) Access — candidates can request a copy of the data you hold about them. (b) Correction — candidates can request corrections to inaccurate data. (c) Deletion — unsuccessful candidates can request deletion of their application data (unless you are retaining it for a defined talent pool with their consent). Implement a simple process for candidates to exercise these rights — email to your talent acquisition team is acceptable for smaller organisations.
HR departments are the largest internal processors of employee personal data. Payroll data alone typically includes PAN numbers, bank details, salary history, and tax information — all sensitive under various laws. Add background verification records, health insurance data, performance reviews, and biometric attendance records, and a typical 500-person company's HR function is processing more categories of personal data than most consumer-facing products.
The DPDP Act 2023 treats employees as Data Principals with the same rights as consumers. This is a significant shift from the traditional 'employer access' assumption in Indian employment practice. HR teams that build DPDP-compliant processes now will avoid the compliance scramble that will follow the first employee DPDP complaint to the DPB.
One real DPDP development explained in plain English, one practical how-to, one number from our own assessment data. Nothing else — no daily noise, no sales pitch.
No spam. Unsubscribe with one click, anytime.
