DPDP Act for HR: Employee Data Checklist Before May 2027
The DPDP Act for HR is no longer a future topic. India’s Digital Personal Data Protection Rules were published in November 2025, and most duties for employers start on 13 May 2027. Every payslip, Aadhaar copy, bank detail, attendance selfie and appraisal note you hold is personal data under the Act. This guide is for HR heads, founders and SMB owners with 10 to 500 employees who want a practical checklist for employee data, not a law lecture.
Table of Contents
Disclosure: we build OXHRM, an HR software product. The checklist below applies whatever tools you use, and we only say where OXHRM can help near the end. This article is general information, not legal advice.
Key Takeaways
- Employers are “Data Fiduciaries” for staff data. Most DPDP duties start 18 months after the Rules were published, which works out to 13 May 2027.
- Section 7(i) of the Act lets you process personal data “for the purposes of employment” without consent, but security, breach-reporting, erasure and contact duties still apply.
- The Rules ask for encryption or masking, access control, access logs and a one-year log retention by default.
- A breach must be reported to affected people without delay and to the Data Protection Board within 72 hours.
- Start now with a data map: what you collect, where it sits, who can see it and when you delete it.
In this guide
- Key DPDP dates for employers
- Do you need employee consent?
- Where employee data hides in an SMB
- What the Act and Rules ask HR to do
- DPDP checklist for HR teams
- How HR software can help (and where OXHRM fits)
- FAQ
- Sources
Key DPDP dates for employers
The DPDP Act was passed in August 2023. It came into force in phases through a Gazette notification (G.S.R. 843(E)) and the DPDP Rules, 2025, both published in November 2025. The Rules carry the date 13 November 2025. The dates below follow from that notification and the Rules.
| Phase | What starts | Date | What it means for HR |
|---|---|---|---|
| On publication | Definitions, Data Protection Board set-up, rule-making provisions | 13 Nov 2025 | No new duties on employers yet |
| One year later | Registration and duties of Consent Managers (Rule 4) | 13 Nov 2026 | Mainly affects Consent Manager companies, not ordinary employers |
| 18 months later | Core duties: notice, consent, legitimate uses, security, breach reporting, erasure, rights (Rules 3 and 5 to 16) | 13 May 2027 | The main deadline for employee and candidate data |
As of 15 October 2026 we found no official notice changing these timelines. MeitY’s Removal of Difficulties Order of 5 October 2026 (S.O. 5458(E)) only corrects wording in sections 9(1) and 10(2)(c)(ii) of the Act and does not move any date. News reports earlier this year said MeitY was considering a 12-month window for Significant Data Fiduciaries, but no such notification has been published. Plan for 13 May 2027.
Do you need employee consent?
Not always. Section 7 of the DPDP Act lists “certain legitimate uses” where you can process personal data without consent. Clause (i) covers processing “for the purposes of employment or those related to safeguarding the employer from loss or liability”, such as preventing corporate espionage or protecting trade secrets, and providing a service or benefit an employee asks for.
That covers a lot of everyday HR work: payroll, attendance, leave, statutory filings and benefits. But it does not switch off your other duties. You must still protect the data, report breaches, erase data when the purpose is over, and give people a contact for questions. The Act does not define every edge case, for example how far “purposes of employment” stretches for job applicants, interns, background checks or monitoring tools. Get advice from a compliance professional on these and write your position down.
If you collect something that is not needed for employment, such as photos for a marketing campaign or data for an optional wellness programme, rely on clear, separate consent instead.
Where employee data hides in an SMB
Most small companies do not have one HR database. They have several copies of the same data in places nobody tracks. Before you fix anything, list where employee data lives today.
| Data | Where it often sits | Typical risk |
|---|---|---|
| Offer letters, ID and address proofs, PAN, Aadhaar copies | Email inboxes, shared drives, WhatsApp chats | Copies kept forever, open to anyone with the link |
| Bank details and salary | Payroll spreadsheets, CA’s email, bank upload files | Files forwarded outside the company, no access control |
| Attendance selfies, GPS check-ins, biometric templates | Attendance app, biometric devices | Sensitive data kept longer than needed |
| Appraisals, warnings, medical leave notes | Manager laptops, email threads | Wide access, no deletion after exit |
| Candidate CVs | Job portals, recruiter inboxes | Kept for years after the role is filled |
Attendance data deserves extra care. Our guide to attendance software in India covers what to ask a vendor about storing selfies, location and biometric data.
What the Act and Rules ask HR to do
Here are the duties that matter most for employee data, with where they come from. Penalty amounts are the maximum ceilings stated by the Government; actual penalties depend on the case.
| Duty | Source | What HR should do |
|---|---|---|
| Reasonable security safeguards | Act s.8(5); Rule 6 | Encrypt or mask data, control access, keep access logs, keep backups, and put safeguards in contracts with vendors |
| Keep logs for one year | Rule 6(1)(e) | Retain access logs and related data for one year unless another law requires otherwise |
| Breach reporting | Act s.8(6); Rule 7 | Tell affected employees without delay; report to the Data Protection Board within 72 hours of becoming aware |
| Erase when the purpose ends | Act s.8(7) | Delete data you no longer need (and make vendors delete it), unless a law such as tax or labour law requires you to keep it |
| Contact for data questions | Act s.8(9); Rules | Publish a contact person or Data Protection Officer for data queries |
| Rights requests | Act ss.11-14; Rules | Handle requests to access, correct, update or erase data; the Rules set a maximum of 90 days to respond |
The Government’s own summary gives the penalty ceilings: up to ₹250 crore for failing to keep reasonable security safeguards, up to ₹200 crore each for failing to notify a breach or breaking duties on children’s data, and up to ₹50 crore for other violations. That is why security and breach reporting come first in the checklist below.
Still keeping employee files in email and spreadsheets? Moving them into one HR system with role-based access is often the quickest first step. See how OXHRM Core HR stores employee records and documents.
DPDP checklist for HR teams
Work through this in order. Most SMBs can finish the first four steps in a few weeks; the rest is policy and habit.
| Step | Action | Owner |
|---|---|---|
| 1. Map the data | List each type of employee and candidate data, where it lives, who can access it and why you hold it | HR with IT |
| 2. Close the copies | Move records out of inboxes, chats and personal drives into one controlled system | HR |
| 3. Set access by role | Managers see their team, payroll sees salary, employees see their own record | HR with IT |
| 4. Check vendors | Review contracts with payroll, attendance, background-check and cloud vendors for security and deletion terms | Founder or finance |
| 5. Write a retention schedule | Decide how long each record is kept after exit, based on the laws that apply to you, and delete the rest | HR with a compliance adviser |
| 6. Prepare a breach plan | Name who decides, who informs employees and who reports to the Board within 72 hours | Founder, HR and IT |
| 7. Publish a contact and notice | Give employees a privacy notice and a contact for data questions and requests | HR |
| 8. Train managers | Explain what not to forward, download or share in chat groups | HR |
If you are also choosing a new HRMS, add data-protection questions to your shortlist. Our HRMS buyer’s checklist for India lists the questions to ask any vendor.
How HR software can help (and where OXHRM fits)
Software does not make you compliant on its own. Your policies, retention decisions and breach plan still matter. But one system makes steps 2, 3 and 7 much easier than a mix of spreadsheets and chats.
OXHRM’s Core HR module keeps employee records and documents in one central database, with role-based access control, onboarding and offboarding workflows, and a self-service portal where employees can view payslips and update their own personal details. The attendance module handles geo-fenced and mobile check-ins in the same system, so attendance data does not sit in a separate tool. Whatever you use, ask your vendor where data is hosted, how access is logged and how deletion after exit works.
FAQ
Does the DPDP Act apply to employee data?
Yes. The Act covers digital personal data, and personal data collected on paper and later digitised. Employee and candidate records such as ID proofs, bank details, salary, attendance and appraisal data are personal data. The employer decides why and how this data is processed, so it acts as the Data Fiduciary and carries the duties under the Act.
When do employers have to comply with the DPDP Rules?
Most duties, including security safeguards, breach reporting, notices, erasure and rights requests, start 18 months after the Rules were published in November 2025, which works out to 13 May 2027. The 13 November 2026 date mainly concerns Consent Managers. As of 15 October 2026, no official notice has changed these dates.
Do we need consent from employees to process their data?
Often not for core HR work. Section 7(i) allows processing for the purposes of employment and to protect the employer from loss or liability without consent. You still owe security, breach reporting, erasure and a contact point. For optional uses that are not needed for employment, take clear consent. Confirm edge cases with a compliance adviser.
How long can we keep data of former employees?
The Act says to erase personal data once the purpose is no longer served, unless another law requires you to keep it. Tax, wage and social security laws often require certain records for set periods. Build a retention schedule per record type with your adviser, then delete or anonymise anything not covered.
What should we do if employee data leaks?
Contain the leak first, then inform affected employees without delay in plain language: what happened, the likely impact and what they can do. The Rules also require a report to the Data Protection Board within 72 hours of becoming aware, with fuller details. Name the people responsible for each step before anything happens.
Do small companies need a Data Protection Officer?
A formal Data Protection Officer is required for Significant Data Fiduciaries, which the Government designates. Most SMBs will not be in that group. They must still publish contact details of a person who can answer questions about personal data. In a small company this is often the HR head or a founder.
Are attendance selfies and biometric data covered?
Yes. Face photos, fingerprints and GPS check-in locations are personal data. Collect only what your attendance policy needs, tell employees how it is used, restrict who can see it and set a retention period. Ask your attendance vendor how templates and photos are stored, encrypted and deleted.
Can HR software make us DPDP compliant?
No software makes a company compliant by itself. A good HRMS helps by keeping records in one place, controlling access by role and making deletion and employee self-service easier. You still need a data map, retention schedule, vendor contracts, a breach plan and trained managers, ideally reviewed by a compliance professional.
Get employee records out of inboxes and spreadsheets.
Start free for up to 20 employees, see plans and pricing for larger teams, or write to support@oxhrm.com with your headcount and the systems you use today.
Sources
- MeitY, Digital Personal Data Protection Act, 2023 (Gazette text, sections 7, 8 and 11-14): meity.gov.in
- MeitY, Digital Personal Data Protection Rules, 2025 (Gazette dated 13 Nov 2025; Rules 1, 4, 6 and 7): meity.gov.in
- MeitY, DPDP Rules 2025 document page (Rules, corrigendum and “Enforcement Timeline for the DPDP Act”, G.S.R. 843(E)): meity.gov.in
- MeitY, Digital Personal Data Protection (Removal of Difficulties) Order, 2026, S.O. 5458(E), 5 Oct 2026: meity.gov.in
- PIB, MeitY, “A Citizen-Centric Framework for Privacy Protection and Responsible Data Use” (DPDP Rules, 2025, penalties and 90-day response), 17 Nov 2025: pib.gov.in
- Business Standard, “MeitY may cut compliance timeline for key DPDP rules to 12 months”, 22 Jan 2026: business-standard.com
- OXHRM product pages: Core HR, Attendance, Pricing
Checked on 15 October 2026 against the MeitY Act and Rules texts, MeitY’s enforcement timeline, the 5 Oct 2026 MeitY order and the PIB release. Rules can change and vary in how they apply to each business; confirm with a compliance adviser. This article is not legal advice.
Shafeeq Khan is a web developer who creates modern, responsive, and user-friendly websites with clean code and creative design
Latest Posts
HRMS Implementation Checklist for Indian SMBs: Step by Step
An HRMS implementation goes well when you decide three things before anyone logs in: what data moves, who owns each...
Wage Definition Under Labour Codes: The 50% Rule Explained
Since 21 November 2025, India's Labour Codes use one definition of "wages" for statutory calculations such as gratuity and bonus,...
HRMS vs Spreadsheets for Indian SMBs: When to Switch
Most Indian SMBs start HR on Excel or Google Sheets. It works for a while: a headcount sheet, a leave...
