When an employee exits, DPDP obligations do not end — they change. The employer must revoke system access, decide what data to delete versus retain (and for how long), and remain able to fulfil the ex-employee's data-principal rights such as access, correction and erasure. Holding ex-employee records indefinitely, leaving access rights live, or having no process for a former employee's rights request are the three most common offboarding gaps. This checklist assesses your employee offboarding data-rights readiness.
Exit is a DPDP flashpoint. Check whether your offboarding handles access revocation, retention, deletion and ex-employee rights the way the Act expects.
Offboarding is where a lot of quiet DPDP risk accumulates, because the moment an employee leaves is the moment their data is most likely to be forgotten rather than managed. Three failures are common: system access that is never revoked or is revoked slowly, leaving a security hole; ex-employee records held indefinitely with no retention rule, sitting uncomfortably with storage-limitation duties; and no process at all for a former employee who later exercises a data-principal right such as access, correction or erasure.
The rights point is often overlooked. Under the DPDP Act, an individual remains a Data Principal in relation to data an employer still holds about them, even after they leave. If a former employee asks what data you still hold, or asks you to correct or erase it, you need a working process to respond within a reasonable timeline — not an ad hoc scramble.
A DPDP-ready offboarding process treats data as a formal exit workstream: same-day access revocation across internal and third-party systems, a retention and deletion schedule that decides what goes and what stays and for how long, and a documented route for handling former-employee rights requests. De-provisioning from vendor systems is especially important, because payroll, benefits and SaaS tools frequently retain ex-employee access and data long after the internal exit is done.
Niti Bharat helps Indian HR teams design offboarding workflows that close these gaps as part of fixed-price DPDP engagements, building the access-revocation, retention and rights-handling steps into a repeatable process with an evidence trail — so a former employee's complaint or a Board inquiry finds a documented, defensible exit process rather than an afterthought.
A step-by-step offboarding workflow covering access revocation, third-party de-provisioning, retention and deletion rules, and former-employee rights handling under DPDP.
One real DPDP development explained in plain English, one practical how-to, one number from our own assessment data. Nothing else — no daily noise, no sales pitch.
No spam. Unsubscribe with one click, anytime.
