Quick Answer: What Does the DPDP Act Mean for HR Teams?
What the DPDP Act for HR Means in Practice, 2023 covers the digital personal data your HR team handles every day: salary records, PAN and Aadhaar, bank details, biometric attendance, appraisals and verification reports. It does not matter how many people you employ.
- Payroll and statutory compliance count as “legitimate use” for employment purposes, so no fresh consent is needed.
- Anything beyond that, like a voluntary wellness programme or passing data to someone outside the employment need, is safer with a clear notice and consent.
- The main obligations are expected around 13 May 2027, which makes 2026 the year to prepare.
The largest penalty, up to ₹250 crore, is for failing to keep reasonable security safeguards.
When the DPDP Act Rules were notified in November 2025, most of the conversation I saw was about servers, cybersecurity and legal teams. HR barely featured, and that always struck me as odd, because HR is one of the most data-heavy functions in any company.
Think about what passes through HR across an employee’s lifecycle. Applications with educational certificates and identity documents. Onboarding forms with bank details and PF nominations. Monthly payroll with salary structures and tax computations. Daily attendance, sometimes by fingerprint or face. Health declarations for insurance. Appraisals. Background verification reports. Exit paperwork. For years all of this sat quietly under the label of “internal HR data”. The Act changes that label. Your company is a Data Fiduciary, which means it is legally responsible for how that data is collected, used, stored and deleted.
The DPDP Act treats employee data as personal data like any other, and HR is where most of it lives.
Where the DPDP Act Stands For HR Today
The Rules are notified, the main obligations are expected around May 2027, and the Data Protection Board is still being set up.
The DPDP Rules, 2025 were notified on 13 November 2025. The rules relating to the Data Protection Board came into force immediately. The provisions on consent managers are due about a year after notification, which is around 13 November 2026, and the main obligations that bind employers are due about 18 months after, which is around 13 May 2027. Some sources count the dates a day apart, so treat them as approximate.
Two points are worth keeping in mind. In January 2026 the government floated a proposal to shorten the 18-month period to 12 months, and I have not seen an amending notification, so the 18-month timeline appears to stand for now. And as at September 2026 the Board itself had not been reported as fully constituted, with applications for Chairperson and Members invited in May 2026. Please check the current position before you plan around any date.
| Date | Milestone | What it means for HR |
|---|---|---|
| 13 Nov 2025 | DPDP Rules notified; Board-related rules in force | The framework is now set. Start mapping your employee data. |
| About 13 Nov 2026 | Consent manager provisions due | Mostly relevant to consent-based flows; little direct change for HR. |
| About 13 May 2027 | Main obligations apply | Notice, security safeguards, retention, rights requests and breach reporting must be in place. |
What Counts as Employee Personal Data
Any digital data that identifies an employee is personal data, and there is no small-company exemption based on headcount.
In practical HR terms, this means salary records, PAN and Aadhaar numbers, bank account details, PF nomination forms, biometric attendance data, health and insurance records, performance reviews and background verification reports. If it is stored digitally and can be traced back to a specific person, it falls under the Act.
One thing that surprises people: the DPDP Act does not create a separate “sensitive” category the way some earlier drafts and other countries’ laws do. Aadhaar, health data and biometrics are all personal data under it. That does not make them less risky. It means the same duties apply across the board, and the security expectations rise with how harmful a leak would be.
On company size, the Act itself has no threshold. It does allow the government to notify exemptions for certain classes of fiduciaries, and startups are named as one such class.
Consent or Legitimate Use: The Question Every HR Team Asks First
The Act lists certain “legitimate uses” in Section 7 for which consent is not required. One of them covers processing for the purposes of employment, or those related to safeguarding the employer from loss or liability. In everyday HR terms that comfortably covers running payroll, deducting and depositing PF and ESI, calculating TDS, maintaining statutory records and administering benefits the employee has asked for. You do not need to go back to your team and collect fresh consent for these.
The harder cases are the ones on the edges. Whether recruitment and background checks before someone joins count as “purposes of employment” is not clearly settled, and legal commentary has flagged this as an open question. Retaining a former employee’s data after they leave, for something like future reference checks or rehire, is difficult to justify under the employment limb once the relationship has ended. The wording also appears to speak of employees, so contractors, consultants and agency staff may need a different basis. And optional extras such as wellness programmes or data used for analytics unrelated to the job sit outside the plain reading.
Where the position is unclear, my practice is to default to clear notice and specific, informed consent captured at the point of collection, with the purpose stated in plain language. A clause buried in an offer letter signed three years ago is not a comfortable foundation. This is my reading of how the Act works, and you should confirm the edge cases with a lawyer who handles data protection.
| HR activity | Likely basis | What to do |
|---|---|---|
| Payroll, PF, ESI, TDS | Employment purposes / legal obligation | No fresh consent. Secure the data and keep records as the law requires. |
| Attendance, including biometric | Employment purposes | Tell employees what is collected and why. Do not reuse it for other purposes. |
| Performance reviews | Employment purposes | Limit access and set a retention period. |
| Background verification | Unclear before joining; stronger after | Take consent and give notice, and sign an agreement with the verification vendor. |
| Wellness programmes, health camps | Outside plain employment purposes | Take specific, voluntary consent. |
| CVs of candidates not selected | Consent | Delete after a defined period unless the candidate agrees to stay in your pool. |
| Data of ex-employees | Law-required records only | Keep what labour and tax laws require, delete or anonymise the rest. |
This table is my reading of how the Act applies to common HR activities. Confirm the edge cases with your lawyer.
What Employees Can Now Ask For
The Act gives individuals rights to information about the personal data being processed, to correct or complete it, and to have it erased when it is no longer needed for the purpose it was collected, unless a law requires you to keep it. There is also a right to grievance redress, and a fiduciary must publish contact details of a person who can answer questions about the processing of personal data. For a typical company this does not need a heavy structure. It does need an email address, an owner and a record of what was asked and how quickly you answered.
The statutory-records point matters. An employee cannot ask you to delete payroll records you are legally required to retain. HR should therefore decide in advance which records fall into that category and which do not.
Vendors: Your Responsibility Does Not End at the Contract
Payroll providers, background verification companies, insurance brokers, biometric device suppliers and cloud tools all handle employee data on your behalf. Under the Act, the Data Fiduciary remains responsible for what its processors do. In practice that means a data processing agreement before data is shared, covering security, breach intimation, retention and deletion, and limits on sub-processing. If your existing contracts predate the Rules, review them now and not at renewal.
DPDP Act Security Safeguards and Breaches: Where the Penalties Sit
Reasonable security means the basics done properly: encryption, access controls so people see only what they need, logs of who accessed what, backups, and the ability to detect and respond to a breach. If a personal data breach happens, the Rules require you to inform the affected individuals and the Data Protection Board, with a detailed report to the Board within a set time after you become aware of it. The Board decides penalties after looking at the nature and gravity of the breach, the data involved, the harm, and whether the breach was repeated, negligent or wilful.
The penalty is not one number for everything, so the commonly quoted “₹250 crore per violation” needs care.
| Failure | Maximum penalty |
|---|---|
| Failing to take reasonable security safeguards | Up to ₹250 crore |
| Failing to notify a personal data breach | Up to ₹200 crore |
| Failing to meet obligations on children’s data | Up to ₹200 crore |
| Failing to meet extra duties of a Significant Data Fiduciary | Up to ₹150 crore |
| Failing to honour individuals’ rights (access, correction, erasure) | Up to ₹50 crore |
These are maximum amounts set in the Schedule to the Act. The Data Protection Board decides the actual penalty case by case.
DPDP Act HR Practical Checklist
How Runtime HRMS Fits In
I take this responsibility seriously on the platform side as well, because an HRMS holds exactly the data this Act is about. Runtime HRMS keeps payroll, attendance, leave and employee records in one system, with role-based access so that people see only the data their role needs. Employees see their own payslips, leave and attendance through Workman, our self-service app, which reduces the amount of personal data moving through emails and spreadsheets.
Attendance is worth a specific mention. If you use biometric devices or Runtime Lens, our touchless face-recognition attendance, you are collecting biometric data, and that is a decision to make deliberately: tell employees what is collected and why, use it only for attendance, and set how long it is kept.
Employee Data Scattered Across Different Tools?
If your employee data is split between spreadsheets, a separate attendance device and disconnected tools, that fragmentation is exactly what makes it hard to show regulators who can see what.
You can test how Runtime HRMS works with your own team through a free trial. The Free plan covers up to 5 employees.
Start a Free Trial →Our Other Useful Resources
Disclaimer
This article is general information about the DPDP Act, 2023 and the DPDP Rules, 2025 as I understand them in October 2026. It is not legal advice.
Official references: Ministry of Electronics and Information Technology | India Code