What does DPDP Act compliance for employers in India involve?
DPDP Act compliance for employers means treating employee and candidate data as personal data held by a Data Fiduciary: say plainly why you collect it, use it only for that purpose, keep it secure, delete it when the purpose ends, and report breaches. The Act allows processing for employment, but the duties still apply.
Indian central rules as of 31 October 2026. This is general information, not legal advice.
At a glance
- The Digital Personal Data Protection Act, 2023 was enacted on 11 August 2023.
- The DPDP Rules, 2025 were notified in November 2025 with an 18-month phased compliance timeline, per PIB.
- The Data Protection Board has been notified under the Rules, per PIB (3 December 2025).
- Most employer duties, such as notices, breach handling and rights requests, fall under the phased timeline.
Which parts are in force
The Act and the Rules are both notified. The Rules provide an 18-month phase-in for organizations, counted from the November 2025 notification, so the main operating duties arrive in mid-2027. PIB describes the Board as notified under the Rules. Treat the notice, consent, breach and rights-request duties below as the standard to build toward now, and read the commencement rule in the Rules for the exact date each duty starts. Check meity.gov.in for amendments before you rely on any date.
Are you a Data Fiduciary?
Yes. The Act defines a Data Fiduciary as anyone who alone or with others decides the purpose and means of processing personal data. An employer deciding what to collect from applicants and staff fits that definition. Your payroll vendor, background-check provider or applicant tracking system usually acts as a Data Processor on your behalf, but you remain accountable for the data.
What does the Act say about employment?
Section 7 of the Act lists "certain legitimate uses" that do not need fresh consent. One covers processing for the purposes of employment, or to safeguard the employer from loss or liability, such as protecting trade secrets, or to provide a service or benefit sought by an employee. Another covers data a person voluntarily gave you for a specified purpose, where they have not said no. These are bounded. Using a CV for a different purpose, or sharing staff data with an outside party for marketing, is not covered by the employment use.
What must a notice say?
The Rules require a standalone, clear and simple notice explaining the specific purpose for which personal data is collected and used (PIB). For employers, that means separate wording for:
- Job applicants: what you collect from the application form and CV, why, and how long you keep rejected applications.
- New joiners: identity documents, bank details, emergency contacts and any background verification.
- Current staff: payroll, attendance, performance and any monitoring tools.
Put the contact details of a designated officer or Data Protection Officer where people can see them. The Rules require data fiduciaries to display this.
Consent, purpose and storage limits
The Act's principles include purpose limitation, data minimization, accuracy, storage limitation and security safeguards. In practice:
- Collect only what the role needs. Ask for identity documents at the offer stage, not at application.
- When you rely on consent, make it specific and withdrawable, for example for a background check, and keep a record of it.
- Set a retention period for rejected candidates and former employees, and delete when it ends, unless another law requires you to keep the record. Payroll and statutory records have their own retention rules, so confirm them with an adviser. See payroll compliance.
- Use written contracts with every vendor that handles your people data.
Rights requests and breaches
Individuals can ask to access, correct, update or erase their data and can nominate someone to act for them. The Rules give data fiduciaries a maximum of 90 days to respond (PIB). If a personal data breach occurs, you must tell affected individuals promptly in plain language, covering the nature of the breach, likely consequences, steps taken and a contact. The Act also requires notifying the Board.
Penalties
The Act sets maximum penalties of up to Rs 250 crore for failing to keep reasonable security safeguards, up to Rs 200 crore for failing to notify a breach, and up to Rs 50 crore for other violations, per the PIB explainer. The Board decides on a case-by-case basis, and appeals go to TDSAT.
A starting checklist
| Step | Owner |
|---|---|
| List every place you hold applicant and employee data | HR and IT |
| Write applicant, joiner and employee notices | HR with counsel |
| Name a contact for data questions | Management |
| Set retention and deletion rules | HR and Legal |
| Review vendor contracts, including background verification | Procurement |
| Draft a breach response plan | IT and Legal |
For a plain-language definition of the Act, see the DPDP Act glossary entry. For the wider hiring process, see how to hire in India.
FAQ
Do I need consent to process employee data? Not always. The Act's employment legitimate use covers processing for employment purposes, but you still owe a notice and must respect purpose limits.
Does the DPDP Act cover paper records? The Act covers digital personal data, including data digitized from paper.
Do small companies have to comply? The Act and Rules provide a simplified framework for start-ups and certain data fiduciaries (PIB, 3 December 2025), but there is no blanket exemption for small employers.
Can I keep rejected resumes forever? No. Storage limitation means keeping data only as long as the purpose needs it. Set and publish a period.
Who enforces it? The Data Protection Board of India, a digital body, with appeals to TDSAT.
Sources
See front matter. Accessed 31 October 2026.
This is general information, not legal, tax or immigration advice. Rules change and your situation may differ. Consult a licensed attorney or qualified adviser.