Your Employee Data Is Personal Data: DPDP for HR Teams
HR teams handle personal data every day - PAN, Aadhaar, salary, medical records. Here is how the DPDP Act applies to employee data and what HR must do to comply.
Every employee file HR maintains - PAN, Aadhaar, bank account, salary slips, medical certificates, performance reviews - is personal data under the DPDP Act, and HR teams are acting as a data fiduciary the moment they collect it.
Key facts at a glance
- The DPDP Act 2023 applies to all digital personal data, including data collected offline and later digitised.
- Full substantive DPDP obligations become enforceable on 13 May 2027, with no stated grace period.
- Penalties for inadequate security safeguards can reach up to Rs 250 crore per instance.
- The Act includes a limited exemption for certain employment-related processing, but it does not remove every obligation.
- Common HR data categories - PAN, Aadhaar, bank details, salary, medical records - all count as personal data.
- The Data Protection Board provisions are already active; consent manager registration becomes operational 13 November 2026.
- Employers remain responsible for breaches caused by third-party HR vendors such as payroll or background-check providers.
What Counts as Employee Personal Data
Personal data under DPDP is any data about an identifiable individual. For HR, that covers a wide range of records most teams already hold:
- Government IDs: PAN, Aadhaar, passport, driving licence copies
- Bank account and salary details
- Medical certificates, fitness-to-work reports, insurance claims
- Performance reviews, disciplinary records, background-check reports
- Biometric attendance data, where used
- Emergency contact details and family information for benefits
None of this is unusual for an HR function to collect. What changes under DPDP is the obligation to handle it with documented purpose, proportionate access and adequate security.
The Employment Exemption - and Its Limits
DPDP recognises that not every HR data use needs individual consent. Processing for specific purposes - such as safeguarding the employer from loss or liability, recruitment, or providing employee benefits and services - can proceed without going through the full consent mechanism that applies to, say, a consumer app.
This is often misread as a blanket pass for all HR processing. It is not. The exemption is purpose-specific: it covers legitimate employment necessity, not every downstream use of employee data. Using employee data collected for payroll to build an unrelated marketing dataset, for instance, would fall outside the exemption.
What Still Applies Even Under the Exemption
- Reasonable security safeguards for the data, regardless of the legal basis for processing.
- Breach notification obligations if that data is compromised.
- Purpose limitation - data collected for one HR purpose should not be repurposed freely.
- Cooperation with the Data Protection Board if a complaint or inquiry arises.
Where HR Teams Usually Have Gaps
| Common gap | Why it matters |
|---|---|
| No inventory of what employee data is held and where | Cannot demonstrate purpose limitation or respond to access requests |
| HR data shared with vendors (payroll, background checks, insurance) without a data-processing agreement | Employer remains liable for vendor mishandling |
| Former-employee records kept indefinitely | No clear retention policy increases breach exposure and complicates access/erasure requests |
| Access to HRMS not role-restricted | Increases the number of people who can view sensitive fields like salary or medical status |
| No documented breach-response process for HR systems | Slower response if a payroll or HRMS system is compromised |
Practical Steps for HR Teams Now
- Map your HR data. List every system - HRMS, payroll software, background-check portal, insurance broker - that touches employee personal data.
- Tighten vendor contracts. Any vendor acting as a processor on your behalf should have clear data-handling and breach-notification terms.
- Restrict access by role. Not everyone in HR needs to see salary, medical or disciplinary data; limit access to what each role requires.
- Set a retention policy. Decide, in writing, how long employee records are kept after exit, balancing DPDP principles against statutory retention requirements under labour and tax law.
- Prepare a breach-response checklist specifically for HR systems, since payroll and HRMS platforms are common targets.
Because the substantive obligations become enforceable from 13 May 2027, the practical window to build these habits is now, while the Consent Manager framework and Board processes are still settling in.
If you are not sure how exposed your HR data practices are, ComplianceCheck's DPDP assessment gives you a clear picture in a few minutes.
Sources
- Ministry of Electronics and Information Technology, DPDP Act and Rules - meity.gov.in
- Data Protection Board of India (as constituted under the DPDP Act)
- Ministry of Labour and Employment, for statutory record-retention requirements - labour.gov.in
This guide is general information, not legal advice. Requirements vary by state, sector and headcount - confirm specifics with a compliance professional or the relevant authority.
Frequently Asked Questions
- Does the DPDP Act apply to employee data collected by HR?
- Yes. The Digital Personal Data Protection Act 2023 applies to any digital personal data, and employee records such as PAN, Aadhaar, bank details, salary and medical information all qualify as personal data.
- Is there an employment exemption under DPDP?
- The Act allows processing for certain employment-related purposes such as safeguarding the employer from loss, recruitment, and provision of employee benefits, but this is a limited exemption from consent, not a blanket exemption from every DPDP obligation.
- When do DPDP obligations actually become enforceable for HR data?
- Full substantive obligations under the DPDP Rules 2025, including notice, consent, security safeguards, breach reporting and data-principal rights, become enforceable on 13 May 2027, with no stated grace period after that date.
- What HR records typically count as sensitive personal data under DPDP practice?
- Health and medical records, disability status, salary and bank account details, and government ID numbers like Aadhaar and PAN are the categories HR teams should treat with the highest care, even though DPDP itself does not use a separate 'sensitive data' category like some other laws.
- Can an employee ask HR to delete their data after resignation?
- Employees can exercise data-principal rights such as access and correction, but employers can usually retain records needed to meet other legal obligations, such as statutory retention periods under labour and tax law, even after an erasure request.
- Who is responsible for a data breach involving an HR vendor, like a payroll processor?
- The employer, as the data fiduciary, remains responsible for breaches even when a third-party vendor such as a payroll processor or background-check agency is the data processor that mishandled the data.
- What is the penalty for HR data breaches under DPDP?
- Penalties for failing to implement reasonable security safeguards can reach up to Rs 250 crore per instance under the DPDP Act.
Check your status
DPDP Gap Assessment
A 45-question gap assessment for the Digital Personal Data Protection (DPDP) Act 2023, scoring data-protection maturity across 6 phases.