There Is No Employment Exemption
The DPDPA applies to all processing of personal data of individuals within India. It does not exempt employment data. Every piece of information an employer collects about an employee — name, address, salary, bank details, performance reviews, health records, biometric attendance data — is personal data under Section 2(t). The employer is a Data Fiduciary under Section 2(i). The employee is a Data Principal under Section 2(j).
Obligation 1: Notice Before Collection (Section 5)
Before collecting any employee personal data, the employer must provide a notice specifying: the personal data to be collected, the purpose of processing, the manner in which the Data Principal can exercise their rights, and the manner in which complaints can be made. For global employers, this means issuing DPDPA-specific privacy notices to Indian employees — separate from GDPR or other jurisdiction-specific notices.
Obligation 2: Consent or Legitimate Use (Sections 6-7)
Employee data processing must be grounded in either consent or a legitimate use. Section 7(a) provides a legitimate use for processing "for any purpose for which the Data Principal has voluntarily provided personal data and has not indicated that she does not consent." Employment applications, payroll processing, and statutory compliance may fall under this provision. But performance monitoring, background checks, and behavioural analytics require explicit consent.
Obligation 3: HR Technology Vendors (Section 8(2))
Global employers typically use centralised HR platforms — Workday, SAP SuccessFactors, Oracle HCM. Each is a Data Processor under DPDPA. The employer must ensure a valid Data Processor Agreement exists with each HR technology vendor, and the vendor must process data only in accordance with the employer's instructions and for the stated purposes. Sub-processor chains (the HR vendor using cloud infrastructure from another provider) must also be contractually governed.
Obligation 4: Cross-Border Transfer of Employee Data (Section 16)
Global employers routinely transfer Indian employee data to regional or global headquarters for consolidated reporting, talent management, and compliance. Under Section 16, this transfer is permitted unless the destination is a restricted jurisdiction. But the employer must map every system where Indian employee data is accessed — including global HR dashboards, payroll consolidation systems, and talent analytics platforms — and verify that none of these systems route data through restricted jurisdictions.
Obligation 5: Biometric Data
Indian employers commonly use biometric attendance systems (fingerprint, facial recognition). Biometric data is personal data under DPDPA. Collection requires specific notice and consent. Storage must comply with data security obligations under Section 8(4). And the employer must have a clear retention policy — biometric data should not be retained beyond the employment relationship unless required by specific law.
12 Key Obligations Summary
1. Issue DPDPA-specific employee privacy notice. 2. Obtain granular consent for non-essential processing. 3. Map all HR technology vendors as Data Processors. 4. Execute compliant Data Processor Agreements. 5. Audit cross-border transfer paths for employee data. 6. Implement biometric data governance. 7. Establish employee data retention schedule. 8. Create employee data breach response protocol. 9. Implement employee data access/erasure request workflow. 10. Review background check processes for DPDPA compliance. 11. Assess employee monitoring and surveillance practices. 12. Train HR teams on DPDPA obligations.