How the DPDP Act changes HR in India: a practical guide for 2026

HR holds more personal data than any other function: Aadhaar and PAN, bank accounts, salary, health records, attendance selfies, GPS locations and performance notes. Under India's Digital Personal Data Protection (DPDP) Act, 2023, every one of those records is now regulated — and the company is accountable for how it is collected, used, shared and deleted.

Where things stand in October 2026

Parliament passed the DPDP Act on 11 August 2023. The Government notified the DPDP Rules on 14 November 2025, operationalising the law. The Rules commence in phases: the Data Protection Board provisions applied immediately, consent-manager rules apply after one year, and the core obligations on organisations — notice, security safeguards, breach intimation, retention and data-principal rights — apply eighteen months after notification.

Employees are 'Data Principals'; the employer is the 'Data Fiduciary'

The Act uses its own vocabulary. Your employees, job applicants, contract staff and even ex-employees are Data Principals. Your company is the Data Fiduciary — the party that decides why and how their data is processed. Payroll processors, background-verification agencies, attendance apps and cloud HRMS vendors are Data Processors acting on your behalf.

Crucially, the fiduciary stays responsible for processing done on its behalf, irrespective of any contract to the contrary. You can outsource the work, but not the liability.

Consent is usually not the right basis for HR data

Section 7(i) of the Act treats processing 'for the purposes of employment' — including safeguarding the employer from loss or liability and providing benefits — as a legitimate use. That means routine activities like running payroll, marking attendance or filing PF and ESI don't need a fresh consent form.

The protection has limits. Anything outside the employment purpose — sharing staff details with a wellness partner, using photos in marketing, or feeding data to unrelated analytics — needs a clear notice and free, specific consent that can be withdrawn.

Where the Act touches the employee lifecycle

• Hiring: collect only what the role needs. Résumés and BGV reports of rejected candidates shouldn't be kept indefinitely.
• Onboarding: Aadhaar, PAN and bank details must be stored securely, with access limited to people who need them.
• Attendance: selfie, GPS and biometric data is sensitive in practice. Capture it for attendance only, and don't track location outside working hours.
• Payroll & statutory: salary, PF, ESI, PT and TDS data must be accurate — employees have the right to correction and completion.
• Performance & grievances: notes and investigation records are personal data, accessible to the employee on request.
• Exit: once the purpose ends and legal retention periods lapse, data should be erased — including from vendor systems.

Security and breach reporting are now legal duties

Data Fiduciaries must adopt reasonable security safeguards — encryption or masking, access controls, logs and monitoring, and backups. If a breach happens, the Rules require intimation to the Data Protection Board and to affected individuals, with a detailed report to the Board within 72 hours.

Up to ₹250 crore for failure to have reasonable security safeguards; up to ₹200 crore for failing to notify a data breach.— Schedule to the DPDP Act, 2023

For HR, the most common breach vectors aren't sophisticated hacks. They're salary sheets on shared drives, Aadhaar copies in email threads, and ex-employees who still have WhatsApp-group access to staff lists.

A 7-step DPDP readiness checklist for HR

• Map every employee data field you collect, where it lives and which vendor touches it.
• Drop fields you don't need — less data means less risk.
• Move HR records out of spreadsheets and inboxes into one access-controlled system.
• Set role-based access: managers see their team, payroll sees salary, nobody sees everything by default.
• Define retention periods aligned to labour and tax laws, then automate deletion.
• Review vendor contracts for security, breach notice and deletion clauses.
• Publish an employee privacy notice and a simple way to raise data requests and grievances.

How an integrated HRMS helps

Most DPDP gaps in HR come from fragmentation — attendance in one app, payroll in Excel, documents on email. A single HRMS with role-based access, audit trails and central records makes the checklist above enforceable rather than aspirational. Enkept HRMS keeps attendance, payroll, leave and employee documents in one secure platform, so you know exactly where staff data sits and who can see it.