Digital Personal Data Protection Act, 2023

Key Provisions

Section	Provision	HR Implication
Section 3	Territorial Scope	Applies to employee data processed in India or outside, if related to Indian individuals.
Section 5	Consent Requirements	HR must obtain informed, voluntary, purpose-specific consent—especially for background checks or optional benefits.
Section 8	Notice Obligations	Employees must receive clear, pre-processing notices in simple language.
Section 11	Data Principal Rights	Employees can request access, correction, or deletion of their personal data. HR must have a mechanism to respond.
Section 12	Significant Data Fiduciaries (SDF)	If classified as SDF, HR must appoint a DPO, conduct DPIAs, and maintain an audit trail.
Section 16	Minors’ Data	Verifiable parental consent is needed for interns or candidates under 18.
Section 25	Data Breach Notification	Breaches must be reported to the Data Protection Board and affected individuals within 72 hours.
Sections 33–42	Penalties	Financial penalties up to ₹250 Cr for security failures, improper consent, or non-notification.

HR Implications

The DPDP Act reshapes HR compliance from passive paperwork to proactive privacy governance.

HR teams must:

• Obtain express consent for data beyond employment obligations
• Secure data relating to employees and their dependents
• Implement robust access and security controls
• Create policies for handling data subject rights
• Prepare breach response protocols
• Record all data processing activities in an auditable format
• Train staff regularly on privacy practices

Rules of This Act

The Draft Rules (released January 3, 2025) expand on the operational aspects:

Notice & Consent

• Multi-language consent templates
• Child-specific mechanisms
• Consent withdrawal policies

Security

• Alignment with ISO/IEC 27001
• Audit trail requirements
• Encryption and data masking

Significant Data Fiduciaries (SDFs)

• Thresholds to be defined by Central Government
• DPO appointment requirements
• Annual DPIAs

Consent Managers

• Licensing and tech standards

Data Breaches

• Notify DPB and individuals within 72 hours
• Provide mitigation plans and risk assessments

State-Specific Applicability

Aspect	Applicability	Notes
Legislation Scope	National	Central law overrides state laws
Variability by State	None	Uniform application
Enforcement Authority	Data Protection Board	Centralized enforcement
Appellate Forum	TDSAT	Pan-India jurisdiction

Forms and Returns

Form Name	Purpose	Frequency
Notice to Employees Form	Disclose data usage, storage, and retention policies	At onboarding & updates
Employee Consent Form	Obtain specific consent for optional processing	As needed
Children’s Data Consent Form	Get verifiable parental consent for minors	Onboarding
Third-Party Processor Agreement	Ensure vendors (e.g., HRMS, payroll) are compliant	On contract initiation
Data Breach Notification Form	Report incidents to DPB and data principals	Within 72 hours of breach
Data Protection Impact Assessment	Assess privacy risks before introducing new HR tech/tools	Before deployment
Employee Grievance Redressal Form	Enable rights request submission (correction/erasure)	As requested
Retention & Disposal Schedule	Define how long employee data is stored	Reviewed annually

Each template includes fields, instructions, and usage examples tailored for HR.

Penalties for Non-Compliance

Violation Type	Max Penalty	Examples
Security Safeguard Failure	₹250 Cr	Weak password/storage policies
Non-Notification of Breach	₹200 Cr	Late or no reporting
Children’s Data Violations	₹200 Cr	No verifiable consent
General Obligations Breach	₹50 Cr	Consent errors, inaccurate data
False Complaints by Data Subject	₹10,000	Frivolous redressal requests

Note: Penalties are adjudicated by DPB based on nature, gravity, and recurrence.

Prevention Strategies

Avoid penalties and ensure compliance by following these core strategies:

• Consent-first HR: Collect clear, purpose-specific consent for data outside core employment (e.g., biometric, health, or analytics data).
• Standardized notices: Ensure all employee-facing communications explain how their data will be used.
• Secure storage practices: Use encrypted HRMS systems and restrict access based on roles.
• Set data retention limits: Define how long to store resumes, background checks, or exit records—and dispose securely.
• Appoint privacy champions: Assign HR PoCs or a DPO (if applicable) to monitor compliance and respond to data requests.
• Run breach drills: Establish and test your 72-hour response playbook in case of a data breach.
• Train HR & managers: Conduct quarterly privacy workshops to build awareness and preparedness.
• Vendor due diligence: Audit all third-party HR tech or payroll tools for DPDP compliance.

Recent Updates

January 3, 2025 – Draft Rules Released

The Ministry of Electronics and Information Technology (MeitY) issued Draft Rules detailing how organizations must implement the Act. While not yet in force, they offer critical guidance.

Highlights:

• Consent Language Standards
  Templates must be simple, multilingual (at least English + one regional language), and explain the exact purpose of data collection (e.g., payroll, health insurance, attendance tracking).
  
• Consent Withdrawal Mechanism
  Employees must be able to withdraw consent easily—through email, HRMS portal, or physical forms—without losing core employment benefits.
  
• Data Breach Reporting Protocol
  Organizations must:
  • Notify the Data Protection Board (DPB) and impacted employees within 72 hours of discovering a breach.
  • Provide a risk assessment, mitigation plan, and estimated impact report.
    
• Data Protection Officer (DPO) Requirements
  Significant Data Fiduciaries must appoint a DPO who directly reports to the Board/CEO. HR teams may need to coordinate closely with this officer on audits, complaints, and DPIAs.
  
• Audit and Logging Mandates
  All access to employee data must be logged with timestamps, user ID, and access purpose. HRMS systems must support audit trails.

February 2025 – Public Consultation Phase

Stakeholders, including HR professionals, industry bodies, and legal experts, submitted feedback on:

• Definition of Sensitive HR Data (e.g., health records, background checks)
• Cross-border data processing in global HR systems
• Clarity on retention timelines for ex-employee data

Q3 2025 – Final Notification Expected

The finalized rules and go-live dates are expected by September 2025. Sector-specific FAQs and toolkits for HR, finance, and IT are anticipated.

What HR Should Do Now

• Review draft rules with legal/compliance team
• Update internal privacy policies and employee handbooks
• Prepare consent and notice templates in simple language
• Set up a breach notification SOP aligned with the 72-hour rule
• Check if your company may be designated a Significant Data Fiduciary