Employees are Data Principals. The personal data you collect from applicants, employees, and former employees falls under DPDPA. Your employment relationship does not exempt you from transparency and consent obligations.
Employee Data Under DPDPA
DPDPA does not carve out employment data from its scope. Names, contact details, identification numbers, salary information, performance records, health data for benefits administration—all of this is personal data subject to the law. The employer is a Data Fiduciary with respect to employee personal data.
The Legitimate Uses Exception
Section 7(b) provides some relief. Processing for employment purposes is a legitimate use, meaning consent is not always required. But this exception does not eliminate the notice requirement. Even when relying on legitimate use, you must inform employees about what data you collect and why.
- Notice still required even for legitimate use processing
- Consent may be required for processing beyond employment purposes
- Marketing to employees using their data requires separate consent
- Monitoring activities require clear disclosure
Notice Content for Employees
The employee privacy notice should cover: categories of data collected throughout the employment lifecycle, purposes for each category, any monitoring or surveillance activities, data sharing with third parties like payroll processors or benefits providers, retention periods, and how employees can exercise their rights.
Timing of Notice
Ideally, the notice is provided before employment begins, during onboarding. For existing employees, the notice should be distributed as part of DPDPA implementation. Updates should be communicated when processing activities change.
Essential Clauses
Data Categories Collected
Rule 3(1)(a)Comprehensive list from recruitment through separation
Processing Purposes
Section 5(1)Why each data category is processed
Monitoring Disclosure
Section 5Any email, system, or workplace monitoring activities
Third-Party Sharing
Section 8Payroll, benefits, background check providers
Retention Periods
Section 8(7)How long employment records are kept
Rights Information
Section 11-12How employees can access, correct, or delete their data
Grievance Contact
Rule 3(1)(d)Who to contact with privacy concerns
Implementation Steps
Inventory all employee personal data collected across HR systems
Map data flows from recruitment through post-employment
Identify all third parties receiving employee data
Draft employee privacy notice covering all required elements
Review with HR and legal for accuracy and completeness
Integrate notice distribution into onboarding process
Distribute to existing workforce with acknowledgment tracking
Establish process for notice updates when processing changes
Frequently Asked Questions
Need This Document Drafted?
Understanding the requirement is the first step. Having it implemented correctly is what protects your organization. Our team drafts DPDPA-compliant documents tailored to your specific operations.
Get in Touch