DPDP Compliance for HR: Employee Data, Payroll Vendors and What to Fix by May 2027

Is employee data covered by the DPDP Act?

Yes. Under the employee data DPDP Act position, nothing is carved out for staff records. Personal data means any data about an individual who is identifiable by or in relation to that data (section 2(t)). The Act applies to digital personal data processed in India, whether collected in digital form or collected on paper and digitised later (section 3(a)). An employee master in an HRMS, a payslip PDF, a scanned offer letter and a WhatsApp photo of a leave certificate are all covered. A paper personnel folder that has never been digitised is outside the Act, but very few HR records stay on paper alone.

There is no size threshold. A 40-person agency and a 40,000-person IT company have the same core duties. The employer is the data fiduciary because it decides why and how the data is processed (section 2(i)). Extra duties apply only to a company notified as a Significant Data Fiduciary under section 10. Section 17(3) lets the government exempt notified classes of fiduciaries, including DPIIT-recognised startups, from a few provisions such as notice and erasure, but as of October 2026 no such notification is known, and it would not touch security or breach duties.

Do you need employee consent under the DPDP Act?

Usually not. Section 4 allows processing either on consent or for a “certain legitimate use” under section 7. Section 7(i) covers processing “for the purposes of employment or those related to safeguarding the employer from loss or liability”, and gives examples: prevention of corporate espionage, maintaining confidentiality of trade secrets, intellectual property and classified information, and providing any service or benefit sought by an employee.

Among the section 7 legitimate uses, employment is the one HR will lean on most. That covers the core of HR work: payroll, statutory deductions, attendance, appraisals, disciplinary processes, IT access logs and benefits the employee asks for. It is also the safer ground. Consent under section 6(1) must be free, specific and unambiguous, which is hard to show in an employment relationship, and under section 6(4) the employee could withdraw it at any time.

DPDP consent for employees still has a place, for things that are genuinely optional and outside employment: using an employee’s photo in external marketing, a voluntary wellness programme, or sharing data with a partner offering discounts. Where you rely on consent, a notice under section 5 and Rule 3 is required. Where you rely on section 7(i), section 5 does not strictly require a notice, but a clear employee privacy notice is recommended practice and makes later disputes easier.

Two limits deserve care. Family members named for insurance are data principals in their own right, and whether section 7(i) covers their data is less clear than for the employee’s own data. And the section 7(i) legitimate use for employment does not obviously reach job applicants, which is discussed below.

DPDP compliance for HR: what still applies under section 7(i)

The ground for processing changes the consent analysis. It does not switch off section 8. The duties below apply to employee data from 13 May 2027 on the current timeline.

• Responsibility for vendors (s.8(1)): you answer for processing done by your payroll provider or HRMS, whatever the contract says.
• A valid contract with each processor (s.8(2)), including an appropriate security provision (Rule 6(1)(f)).
• Accuracy (s.8(3)) where data is used to make a decision about the employee, such as appraisal ratings, salary revisions or termination.
• Reasonable security safeguards (s.8(5)), with the Rule 6(1) minimums: encryption, masking or tokenisation; access control; logs and monitoring; backups; one-year retention of logs; and organisational measures.
• Breach intimation to affected employees and the Data Protection Board (s.8(6) and Rule 7).
• Erasure once the purpose is no longer served, including at your vendors (s.8(7)), unless another law requires retention.
• A published contact for data questions (s.8(9) and Rule 9) and an effective grievance mechanism (s.8(10)).

Aadhaar, bank details and medical data

The DPDP Act has no separate category of sensitive personal data. All personal data carries the same duties. Sensitivity still matters in two ways. What counts as a “reasonable” safeguard under section 8(5) is likely to be judged against how harmful a leak would be, and section 33(2) lists the type and nature of the personal data affected among the factors the Board weighs when setting a penalty.

Until 13 May 2027, the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 under section 43A of the IT Act continue to treat passwords, financial information and medical records as sensitive. Section 44(2) of the DPDP Act omits section 43A, and that provision is scheduled to commence on 13 May 2027. Until then, both regimes are relevant.

Aadhaar numbers carry their own rules under the Aadhaar Act, 2016 and UIDAI regulations, which restrict how they are collected, stored and displayed. Masking all but the last four digits in HR systems is common practice and fits Rule 6(1)(a). Keep bank details and PAN in fields with restricted access. Keep medical certificates, pre-employment health checks and maternity records separate from the general personnel file, visible only to the people who need them.

HR vendors, the data they hold and the clauses to check

Most HR data leaves the company, which is why payroll vendor DPDP terms matter more than any policy document. A Pune payroll vendor processing salaries for 600 employees holds bank details, PAN and Aadhaar-linked PF records for every one of them. The table lists typical HR vendors, the data they usually hold, their likely role and the clauses to check first. Roles depend on the facts; a vendor that uses data for its own purposes is a fiduciary for that use.

Candidate data and background verification

Job applicants are not yet employees. Whether section 7(i) covers recruitment is not settled. A cleaner ground for most hiring is section 7(a): a candidate who sends a CV for a specific role has voluntarily provided personal data for that specified purpose. That ground ends when the purpose ends. Keeping rejected CVs in a talent pool for future roles is a new purpose, and asking for consent is the safer route.

Background verification vendor DPDP terms deserve particular care. The agency often sub-contracts address checks to field agents, collects documents from past employers and keeps reports. Tell candidates clearly that a check will be run, limit the agency to your purpose, and agree how long it keeps reports and supporting documents after delivery.

Retention and erasure after an employee leaves

Section 8(7) requires erasure once it is reasonable to assume the purpose is no longer being served, unless retention is necessary to comply with law, and requires you to make your processors erase too. Rule 8(3) sets a floor: personal data and processing logs must be kept for at least one year from the date of processing.

For ex-employees, other laws often require you to keep records: tax, provident fund, gratuity and labour law records among them. Section 8(7) allows that retention. What it does not allow is keeping everything indefinitely “just in case”. Build a retention schedule that lists each record type, the law or purpose that justifies keeping it, and the period. Apply the same schedule to your vendors. An HRMS subscription that ends in 2028 should end with written confirmation that your data has been deleted.

What rights do employees have, and how fast must HR respond?

Chapter III gives data principals a right to a summary of their personal data and of the processing, and to the identities of the fiduciaries and processors it has been shared with (section 11); a right to correction, completion, updating and erasure (section 12); a right to grievance redressal (section 13); and a right to nominate someone to act on death or incapacity (section 14).

There is a nuance for HR. Sections 11 and 12 are framed around data the principal has given consent for, including under section 7(a). Where an employer relies only on section 7(i), it is arguable that these two rights do not strictly apply. Section 13 is wider: it covers any act or omission of the fiduciary about the employee’s data. The practical course is to answer employee requests anyway, because refusing invites a grievance and a complaint.

Under Rule 14(3) you must publish the period within which you will respond to grievances, and it cannot exceed ninety days. Under section 13(3), an employee must use your grievance process before going to the Board. Rule 9 requires the contact for data questions to be published on your website or app and named in every response to a rights request.

When HR data is breached

A payroll file emailed to the wrong person, a laptop with an employee spreadsheet stolen from a car, or ransomware at your HRMS vendor are all personal data breaches under section 2(u). Rule 7 requires you to inform each affected employee without delay, and the Board without delay, followed by a detailed report within 72 hours of becoming aware. The DPDP Act and Rules give your vendors no deadline to tell you, so put a short notice period in each contract as recommended practice. See our guide on breach notification for the full sequence.

What must an HR team have in place by 13 May 2027?

• A data map of every HR system, spreadsheet and vendor holding employee or candidate data.
• A recorded ground for each purpose: section 7(i), section 7(a) or consent.
• An employee privacy notice (recommended) and a consent flow for optional uses (required where consent is the ground).
• Rule 6 safeguards in the HRMS and payroll stack: masking of Aadhaar and bank details, role-based access, logs kept for a year, backups.
• Valid contracts with every HR vendor, each with a security provision and erasure terms.
• A retention schedule for employees, ex-employees and candidates, applied to vendors.
• A published contact, a grievance process with a stated response period of ninety days or less, and a breach response plan that names who calls the Board.

Why check your HR vendor contracts with ClauseAudit before 13 May 2027?

Under section 8(1) you answer for your payroll vendor’s mistakes, and the Schedule allows penalties of up to ₹250 crore for a failure to take reasonable security safeguards. Many HR and payroll contracts signed before November 2025 are likely to say nothing about DPDP, and so may not cover erasure, logs or breach notice.

You have three honest options. An advocate’s review is thorough and right for material contracts, but it is slower and costs more. A free checklist is fast, though you still have to read every clause yourself. The ClauseAudit DPDP Compliance Check reads every clause of a vendor agreement, DPA or SaaS terms in minutes, for ₹999 per contract. Each finding is labelled as required by the DPDP Act or Rules, with the section or rule, or as recommended practice, and comes with a suggested redline and a negotiation email. You choose your side, here the customer (data fiduciary). The original document is not stored after the review.

It is an AI-assisted review and can miss things. Where you process health data at scale, run large workforce monitoring, or work in a regulated sector, ask an advocate to review the contract. For the wider programme of HR data protection India teams need, see our guides on the DPDP compliance checklist and section 8.