The Digital Personal Data Protection Act, 2023, together with the Digital Personal Data Protection Rules, 2025, now forms India’s core framework for handling digital personal data. For HR teams, that affects almost every stage of the employee lifecycle, from recruitment and onboarding to payroll, performance management, vendor management, and offboarding.
If you manage employee records, run an HRMS, process payroll, or share candidate information with background verification vendors, the DPDP framework defines how that data should be handled and what responsibilities your organization may carry.
This guide explains the framework in practical HR terms, including the current rollout, when consent is required, employee rights, employer obligations, breach reporting, penalties, and the compliance steps HR teams should prepare for in FY 2026-27.
DPDP Act 2023 and DPDP Rules 2025: What Governs Data Privacy in India
The Digital Personal Data Protection Act, 2023 sets the legal framework for processing the digital personal data of individuals in India. The Digital Personal Data Protection Rules, 2025 provide the operational requirements around notice, consent, security, breach reporting, rights, and other compliance obligations.
The framework applies to the processing of digital personal data within India and, in certain circumstances, to processing outside India when it is connected with offering goods or services to individuals in India.
For HR teams, this means employee and candidate data can fall within the framework when it is collected, stored, shared, or otherwise processed digitally.
India’s data protection framework also reflects the broader recognition of privacy as a fundamental right under Article 21 following the Supreme Court’s 2017 Justice K.S. Puttaswamy judgment.
Key Definitions
Three roles anchor the framework:
-
Data Principal: The individual whose data is being processed.
-
Data Fiduciary: The entity deciding how and why data is processed.
-
Data Processor: A third party that processes data on behalf of the fiduciary.
In an HR context, the employer will typically act as the Data Fiduciary because it determines why employee or candidate data is collected and how it will be used.
A payroll provider, background-check vendor, or HR software platform may act as a Data Processor when it processes data on the employer’s behalf.
Where DPDP Rules 2025 Stands Right Now
The rollout of the DPDP framework is phased:
| Provision |
Status under the notified timeline |
| Data Protection Board-related provision |
In force from November 2025 |
| Consent Manager Framework |
Scheduled to take effect from November 2026 |
| Most consent, notice, rights, and Data Fiduciary obligations |
Scheduled under the phased rollout from May 2027 |
The Rules were notified in November 2025, followed by a corrigendum in December 2025.
During the transition, organizations need to pay close attention to which obligations have already taken effect and which are scheduled to phase in later. The older IT Act framework and related rules continue to remain relevant during areas of transition.
There was also a proposal in early 2026 to accelerate certain Significant Data Fiduciary obligations. However, the compliance timeline should be followed based on the final applicable notification rather than an earlier consultation proposal.
Where this fits the older law:
India’s older framework relied largely on the IT Act, 2000 and the SPDI Rules, 2011 for personal-data protection. The DPDP framework creates a broader, dedicated system for digital personal data. For the older framework, see our guide on the Information Technology Act, 2000.
Who are the Key Entities Under the DPDP Act?
The DPDP framework assigns different responsibilities depending on an organization’s role in the processing of personal data.
Data Principal and Data Fiduciary: Who’s Who
A Data Principal is the individual whose personal data is being processed. In HR, this can include employees, job applicants, former employees, and other individuals whose data an organization handles.
A Data Fiduciary decides the purpose and means of processing that data. Employers will typically occupy this role.
For example, if an organization collects an employee’s bank details to process salary, it decides:
That makes the employer responsible for ensuring that the processing follows the applicable framework.
Significant Data Fiduciary
The Central Government can designate certain entities as Significant Data Fiduciaries based on factors such as the volume and sensitivity of personal data, potential risks to Data Principals, and the impact of the processing activity.
SDFs may face additional obligations, including:
-
Appointing a Data Protection Officer
-
Conducting periodic or annual Data Protection Impact Assessments
-
Undergoing independent data audits
-
Completing additional risk and governance assessments where required
An SDF should therefore treat data protection as an ongoing governance function rather than a one-time compliance exercise.
Data Processor
A Data Processor handles personal data on behalf of a Data Fiduciary.
Common HR examples include:
Using a third-party processor does not automatically remove the employer’s responsibility. HR and procurement teams should ensure vendor contracts clearly define the processing relationship and include the required security and data-protection obligations.
Consent Manager
A Consent Manager provides a registered platform through which Data Principals may manage, give, review, or withdraw consent.
The Consent Manager framework is part of the phased DPDP rollout. While the role may become more relevant across the broader data ecosystem, HR teams should first focus on understanding when consent is required and ensuring their own notice and consent workflows are clear.
When is Consent Required for Processing Employee Data?
Consent is one of the key grounds for processing personal data, but HR teams shouldn’t assume that every employee-data activity requires a separate consent form.
The DPDP framework also recognises certain legitimate uses, including specified processing connected with employment.
That distinction matters.
An employer may need to process an employee’s:
-
Bank details for salary
-
Attendance information
-
Tax declarations
-
Statutory contribution details
-
Performance-related information
-
Data required to prevent loss or fraud
Where processing is necessary for a legitimate employment-related purpose, the organization should still ensure that the processing is appropriate, transparent, and limited to the relevant purpose.
When Should HR Use Explicit Consent?
Explicit consent becomes more relevant where the processing goes beyond core employment requirements.
Examples may include:
-
Optional employee programs
-
Non-essential wellness initiatives
-
Certain monitoring activities
-
Processing that isn’t reasonably connected with employment
-
Processing for a separate purpose from the one originally communicated
Where consent is used, it should be clear, informed, purpose-specific, and capable of being withdrawn through an accessible process.
HR teams shouldn’t bury consent inside a broad employment contract and assume that covers every future use of employee data.
What Rights Do Data Principals Have Under the DPDP Act?
The DPDP framework gives individuals greater control over how their personal data is handled.
The key rights include:
A Data Principal can seek information about the processing of their personal data.
For employers, this means HR and IT teams should know where employee data is stored and which systems or vendors process it.
You cannot effectively respond to a request for information if employee records are scattered across spreadsheets, inboxes, shared drives, and disconnected software.
Right to Correction and Erasure
Individuals can seek correction of inaccurate or incomplete personal data.
They may also seek erasure when the data is no longer necessary for the purpose for which it was collected, subject to other legal retention requirements.
For example, an employee may request the correction of an incorrect address or bank record. An organization may need to retain certain payroll or statutory records even after an employee exits, but that doesn’t justify keeping every piece of personal data indefinitely.
Right to Grievance Redressal
Organizations need a mechanism through which individuals can raise grievances relating to the handling of their personal data.
The Rules establish a framework requiring grievances to be addressed within the applicable 90-day period.
For HR teams, this means employee privacy concerns should not be handled informally through ad hoc email chains. There should be a defined channel, owner, and escalation process.
Right to Nominate
A Data Principal can nominate one or more individuals to exercise their rights in specified circumstances, including where the individual is deceased or incapable of exercising those rights.
This is a distinct feature of the Indian framework and should be reflected in the processes organizations build for handling rights-related requests.
What are the Key DPDP Obligations for HR Teams?
The practical impact of the data protection act 2023 on HR is not limited to getting employee consent.
The bigger responsibility is building repeatable processes around how data is collected, retained, shared, secured, and eventually deleted.
Issue Clear and Purpose-Specific Notices
Employees and candidates should understand:
-
What personal data is being collected
-
Why it is being processed
-
How it may be used
-
How they can exercise relevant rights
-
How they can withdraw consent where consent is the applicable basis
-
How they can raise a grievance
Privacy notices should be clear and understandable rather than written as generic legal disclaimers that employees are expected to accept without reading.
A practical approach is to include a dedicated employee privacy notice within the onboarding workflow and update it when processing practices materially change.
Create a Defensible Data Retention Policy
Data should not be retained indefinitely simply because storage is cheap.
HR teams should map different categories of data, such as:
Each category should have a defined retention period based on its purpose and any applicable statutory requirement.
The end of employment does not automatically mean all data must be deleted immediately. At the same time, a legal retention requirement for payroll records does not justify retaining unrelated information forever.
Prepare for Data Breaches
A breach-response plan should define:
-
How the incident is detected
-
Who assesses its impact
-
Who communicates with affected individuals
-
How the Data Protection Board is notified where required
-
How the organization documents its response
Under the Rules, breach reporting includes prompt notification requirements, with a detailed report to the Board within the applicable 72-hour timeline after initial intimation.
This is not a process you want to design while an actual breach is unfolding.
Strengthen Vendor Contracts and Security Controls
If a third-party vendor processes employee data, your compliance responsibilities do not disappear.
Vendor agreements should clearly address:
A vendor onboarding checklist should include data-protection questions before the contract is signed, not after a security incident.
How Does the DPDP Act Affect Children’s and Candidate’s Data?
The DPDP framework places additional safeguards around the processing of children’s personal data.
Where the processing involves a child, organizations may need to obtain verifiable consent from the parent or lawful guardian, subject to the applicable rules and exemptions.
For HR teams, the more common challenge may involve candidates, dependants, interns, apprentices, or records containing children’s information for benefits or insurance purposes.
The important control is to identify these data flows before building a standard consent process.
Candidate data also needs attention. Recruitment teams often retain resumes and interview information long after a role has been filled. A retention schedule should specify what happens to unsuccessful candidate data and when it should be reviewed for deletion.
Can Employee Data Be Transferred Outside India?
The DPDP framework generally allows cross-border transfers of personal data, subject to restrictions that may be notified by the Central Government.
This is particularly relevant for organizations using:
-
Global HR systems
-
International cloud infrastructure
-
Overseas parent-company systems
-
Global payroll platforms
-
Cross-border shared-service centres
The key question is no longer simply whether data is leaving India. Organizations must also monitor whether the Government has placed restrictions on transfers to particular jurisdictions or entities.
For HR teams, cross-border data flows should be mapped before they become a problem.
Ask:
-
Where is the HR platform hosted?
-
Which vendors can access the data?
-
Does the parent company receive employee information?
-
Are backups or analytics systems located outside India?
A cross-border transfer policy should reflect the actual data architecture rather than simply stating that international transfers may occur.
What Penalties Apply Under the DPDP Act?
The DPDP framework provides for significant financial penalties depending on the type of non-compliance.
Penalty Tiers by Violation Type
| Violation Type |
Max Penalty |
Examples |
| Security Safeguard Failure |
₹250 crore |
Weak password or storage policies |
| Non-Notification of Breach |
₹200 crore |
Late or no reporting |
| Children’s Data Violations |
₹200 crore |
No verifiable consent |
| Non-Fulfilment of SDF Obligations |
₹150 crore |
Missing DPO, DPIA, or audit |
| General Obligations Breach |
₹50 crore |
Consent errors, inaccurate data |
| False Complaints by Data Subject |
₹10,000 |
Frivolous redressal requests |
Penalties can depend on the nature and seriousness of the violation. In some situations, multiple failures may also arise from the same broader compliance incident.
How Does the Data Protection Board Handle Complaints?
The enforcement process may begin through:
The organization can receive a notice and an opportunity to respond. The Board may consider the facts, evidence, remedial action, and the seriousness of the incident before issuing an order.
Factors can include:
-
Nature and duration of the violation
-
Sensitivity of the personal data involved
-
Whether the incident was negligent or intentional
-
Past compliance history
-
Steps taken to reduce harm
-
Promptness of breach notification and remediation
Appeals from the Board’s orders follow the applicable appellate process.
The larger lesson for HR leaders is simple: data protection failures can no longer be treated purely as an IT issue.
DPDP Compliance Checklist for HR Teams
A practical DPDP compliance plan should begin with the data your organization already has.
A Practical DPDP Compliance Checklist
Within your first 30 days of building this out:
-
Draft and issue standalone, purpose-specific notices for every category of employee data you collect.
-
Set up a consent-first process for anything outside core employment processing, such as biometric, health, or analytics data.
-
Write a retention schedule covering resumes, interview notes, background checks, and exit records.
Every quarter:
-
Run a breach-response drill against your 72-hour playbook.
-
Review consent and notice templates against anything that’s changed: a new benefit, a new vendor, a new HR tool.
Every year:
-
Run a full internal audit against the Act and Rules, not just the areas your last audit flagged.
-
Refresh the retention schedule and clear out anything past its erasure date.
When you onboard a new vendor:
-
Confirm the contract includes DPDP-specific security clauses.
-
Confirm the vendor’s role is Data Processor, not co-Data Fiduciary, unless the contract says otherwise.
When you onboard a new employee:
When Do You Need a Data Protection Officer?
A Data Protection Officer becomes mandatory when an organization is designated as a Significant Data Fiduciary.
However, every organization handling personal data should still assign clear internal ownership. Employees need to know whom to contact when they have questions or want to raise a privacy-related grievance.
What DPDP Templates Should HR Have Ready?
Keep the following templates current:
-
Notice to Employees Form: Explains data usage and retention
-
Employee Consent Form: For processing that requires consent
-
Children’s Data Consent Form: Where applicable
-
Data Breach Notification Form: Ready for use during an incident
-
Retention and Disposal Schedule: Defines review and deletion periods
DPDP compliance works best when it becomes part of existing HR operations. Add these checks to onboarding, vendor management, offboarding, and your broader compliance calendar rather than creating an entirely separate workflow that no one checks until something goes wrong.
Wrapping It Up
DPDP compliance is not a one-time legal exercise.
For HR teams, it runs across the employee lifecycle, from recruitment and onboarding to payroll, performance management, vendor management, and offboarding.
The fundamentals are straightforward:
-
Know what data you collect
-
Be clear about why you collect it
-
Use consent where it is required
-
Apply appropriate safeguards
-
Don’t retain data indefinitely
-
Prepare for breaches
-
Give employees a clear way to exercise their rights
The harder part is turning those principles into repeatable workflows.
That becomes much easier when employee data and HR processes are managed through a structured system. Keka helps organizations centralize employee records, standardize HR workflows, and build more consistent processes around how workforce data is handled.
Make Compliance a Part of Everyday HR Processes
Explore Keka
Frequently Asked Questions (FAQs)
Q1. What is the data privacy rule in India?
-
The Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025, notified on November 13, 2025, together govern how organizations collect, process, and store the personal data of individuals in India.
Q2. Is DPDP implemented?
-
Partially. Data Protection Board provisions are already in force. Consent Manager rules take effect November 13, 2026. Most fiduciary obligations, including consent and notice requirements, phase in by May 13, 2027.
Q3. What is a data privacy act?
-
A data privacy act is a law that sets rules for how organizations can collect, use, store, and share personal information, along with the rights individuals have over their own data.
Q4. Is India a GDPR country?
-
No. India isn’t subject to the EU’s GDPR. The DPDP Act is India’s domestic equivalent. Indian companies serving EU customers still need separate GDPR compliance for that processing.
Q5. What is data privacy?
-
Data privacy is the principle that individuals control how their personal information is collected, used, and shared, and that organizations handling that information do so within defined legal limits.
Login
Payroll Suite
HR Suite
Talent Suite
Project Services Suite
