Each activity may have a legitimate business purpose. That does not mean every collection, disclosure, reuse, or retention practice is justified.
India’s Digital Personal Data Protection Act, 2023—the DPDP Act—requires organisations to examine the purpose of processing, the applicable legal ground, and the safeguards surrounding it. The central question is not merely, “Is this our employee?” It is: “What are we doing with this individual’s data, why, and within what boundaries?”
This distinction matters because the Act recognises certain employment-related uses without consent, but does not create an unrestricted exemption for employee information. Employer ownership of a device, mailbox, photograph repository, or HR system does not eliminate the personal-data character of the information inside it. The statutory definition turns on whether an individual is identifiable by or in relation to the data.
The legal foundation: employment is a ground, not a blanket waiver
Section 7(i) permits processing for purposes of employment, purposes related to safeguarding the employer from loss or liability, and provision of a service or benefit sought by an employee. It expressly refers to matters such as preventing corporate espionage and maintaining confidentiality of trade secrets and intellectual property.
The provision is commercially useful, but its boundaries matter. Routine payroll administration is a stronger employment-purpose case than using an employee’s portrait in an advertising campaign. Providing a requested benefit is different from automatically collecting additional family information for unrelated initiatives.
Legal commentary has highlighted the difference between the earlier draft’s broader language about purposes “related to employment” and the enacted wording, “purposes of employment.” That drafting history supports caution, although commentary is not a binding judicial determination. Businesses should avoid assuming that every activity benefiting the employer necessarily falls within section 7(i).
For each activity, document:
- The precise purpose and minimum information needed.
- The relevant consent or particular section 7 ground.
- The people or organisations receiving the information.
- Whether each recipient acts on instructions or determines its own purposes.
- Security controls, retention rules, and deletion arrangements.
- How questions, corrections, withdrawals, and complaints will be handled.
Where consent is used, section 6 requires it to be free, specific, informed, unconditional, unambiguous, and communicated through clear affirmative action. Consent must cover only data necessary for the specified purpose, and withdrawal must be comparably easy. Employment does not make valid consent impossible, but pressure, bundled permissions, or adverse consequences for declining an optional use can make it difficult to defend.
Ten everyday workplace scenarios, their legal ambiguities, and a practical path to defensible compliance
1. Using an employee’s personal mobile number for business
The compliance position
A personal mobile number is personal data when connected to an identifiable employee. Using it for emergency contact, essential work coordination, or an authentication process is materially different from publishing it as the organisation’s customer-service number.Necessary internal communication may reasonably fit section 7(i). Public distribution, permanent customer contact, or addition to external messaging groups requires a more careful purpose analysis.
The ambiguity
The Act does not specify exactly when use of a personal number becomes “for purposes of employment.” A number supplied for HR emergencies is not automatically authorised for sales enquiries. Nor does reimbursement of a mobile bill establish unlimited permission to disclose the number.Messaging groups create additional exposure: other participants can see and retain the number, and the employer may have limited control over those copies.
The lower-risk approach
Provide company-managed numbers, business calling tools, or role-based contact channels for customer-facing responsibilities. Restrict personal numbers in internal directories to those who need them.For optional external use, obtain separate, recorded permission explaining the audience and purpose. Do not treat the employee’s submission of a number during onboarding as universal consent.
Offer an alternative authentication method where practical. At exit, remove the number from organisation-controlled directories and groups, update customer contact information, and end its use as a business contact. A BYOD policy should also distinguish business information from unrelated personal contacts and files.
Practical principle:
A personal number may support employment; it should not silently become a permanent corporate asset.
Promotional publication is a weaker case for relying solely on the employment ground. The conservative approach is separate, genuinely optional consent.
The public-data exclusion also requires care. It concerns data made publicly available by the individual, or by another person legally obliged to publish it. An employer should not assume that its own unauthorised publication creates an exemption. Nor should an employee’s public profile photograph be treated as unrestricted permission for a new promotional use.
Permit refusal without employment consequences. Provide photo-free participation arrangements for events and obtain additional permission for materially different uses, such as paid advertising or a new campaign.
Maintain a publication register linking assets to permissions and review dates. Explain withdrawal realistically: the organisation can stop future use and remove material it controls, but cannot guarantee removal of screenshots, reposts, or third-party caches.
2. Using employee photographs in social-media promotion
The compliance position
An identifiable employee photograph is personal data. Collection for an identity card or internal directory serves a different purpose from publication on social media.Promotional publication is a weaker case for relying solely on the employment ground. The conservative approach is separate, genuinely optional consent.
The ambiguity
There is a spectrum between an incidental appearance in an office-event photograph and a named employee becoming the face of a paid advertising campaign. The Act does not provide a detailed employee-image rule resolving every point on that spectrum.The public-data exclusion also requires care. It concerns data made publicly available by the individual, or by another person legally obliged to publish it. An employer should not assume that its own unauthorised publication creates an exemption. Nor should an employee’s public profile photograph be treated as unrestricted permission for a new promotional use.
The lower-risk approach
Separate photo permissions from mandatory employment documentation. Identify the campaign, platforms, photograph or recording, whether names and tags will appear, and intended duration.Permit refusal without employment consequences. Provide photo-free participation arrangements for events and obtain additional permission for materially different uses, such as paid advertising or a new campaign.
Maintain a publication register linking assets to permissions and review dates. Explain withdrawal realistically: the organisation can stop future use and remove material it controls, but cannot guarantee removal of screenshots, reposts, or third-party caches.
Practical principle:
Permission to take a photograph is not automatically permission to publish, tag, promote, or reuse it.
For a staffing or consulting business, sharing a limited profile for a genuine, proposed assignment may reasonably form part of employment. That assessment is stronger where employees understand that client deployment is part of their role.
The boundary becomes less defensible when sales teams circulate complete résumés to many prospects, retain them indefinitely in customer databases, or include home addresses, personal numbers, compensation, identification documents, or family details.
An existing employee’s deployment is also different from recruiting an external candidate or arranging an unrelated placement.
Have the employee verify accuracy before disclosure. Explain the customer-sharing process and obtain specific consent where the proposed use falls outside the documented employment purpose.
Use secure, access-controlled sharing and agree restrictions on onward disclosure, unrelated recruitment, retention, and deletion. Release identification or clearance documents only at the justified stage, through a separate controlled workflow.
3. Sharing employee profiles with a prospective customer
The compliance position
Professional information remains personal data when it identifies an individual. Qualifications, project experience, certifications, and employment history do not lose protection merely because they concern work.For a staffing or consulting business, sharing a limited profile for a genuine, proposed assignment may reasonably form part of employment. That assessment is stronger where employees understand that client deployment is part of their role.
The ambiguity
A customer may decide independently how to retain and use profiles. It should not automatically be labelled the employer’s Data Processor.The boundary becomes less defensible when sales teams circulate complete résumés to many prospects, retain them indefinitely in customer databases, or include home addresses, personal numbers, compensation, identification documents, or family details.
An existing employee’s deployment is also different from recruiting an external candidate or arranging an unrelated placement.
The lower-risk approach
Use a standard, minimised client profile: relevant skills, verified experience, certifications, and availability. Use a profile identifier or de-identified summary at the early commercial stage where feasible; recognise that unusually specific experience can still identify someone.Have the employee verify accuracy before disclosure. Explain the customer-sharing process and obtain specific consent where the proposed use falls outside the documented employment purpose.
Use secure, access-controlled sharing and agree restrictions on onward disclosure, unrelated recruitment, retention, and deletion. Release identification or clearance documents only at the justified stage, through a separate controlled workflow.
Practical principle:
A customer needs evidence of suitability, not an unrestricted copy of the HR file.
Couriers may act on instructions for part of the delivery process and determine their own purposes for other processing, including legally required records. Role classification must follow the actual arrangement.
Share only what is needed: recipient name, confirmed address, necessary contact information, and delivery instructions. Do not include employee IDs, departmental rosters, or unrelated HR information.
Use controlled transfers rather than wide email circulation. Contractually restrict mailing-list reuse, unrelated marketing, and unnecessary onward disclosure. Separate temporary distribution spreadsheets from delivery records that must be retained under applicable law.
4. Sharing home addresses with courier agencies
The compliance position
A home address and contact number are personal data. Delivery of work equipment may support an employment purpose. Delivery of a gift requested or accepted by the employee may support a sought benefit or a clearly specified voluntary disclosure.The ambiguity
A surprise gift does not necessarily demonstrate that the employee sought home delivery. A residential address provided for statutory or emergency records should not automatically be repurposed for every distribution campaign.Couriers may act on instructions for part of the delivery process and determine their own purposes for other processing, including legally required records. Role classification must follow the actual arrangement.
The lower-risk approach
Offer office collection or allow the employee to confirm a preferred delivery address. Explain the courier disclosure when offering the delivery.Share only what is needed: recipient name, confirmed address, necessary contact information, and delivery instructions. Do not include employee IDs, departmental rosters, or unrelated HR information.
Use controlled transfers rather than wide email circulation. Contractually restrict mailing-list reuse, unrelated marketing, and unnecessary onward disclosure. Separate temporary distribution spreadsheets from delivery records that must be retained under applicable law.
Practical principle:
Confirm the delivery choice before converting an HR address into a logistics list.
Providing employee-requested family insurance may support an employment-benefit purpose. However, relying on section 7(i) for the employee does not automatically remove the special requirements attaching to a child’s information.
A child is an individual under eighteen. Under the notified framework, section 9 requires verifiable parental or lawful-guardian consent before processing, subject to applicable exemptions. Rule 10 sets out verification mechanisms, including use of reliable identity and age information already held or appropriate voluntarily supplied information or authorised tokens.
The October 2026 Removal of Difficulties Order clarified wording in section 9 and the terminology for Significant Data Fiduciary audits. It did not introduce an employment-family-insurance exemption or move the substantive commencement timetable.
Use existing verified HR information to establish the consenting employee’s adulthood where appropriate, rather than routinely demanding additional identity copies. Establish the person’s stated parental or lawful-guardian authority and a process for resolving uncertainty.
Collect only fields genuinely required for enrolment. Where possible, have medical declarations and claim documents submitted directly to the insurer rather than stored in general HR folders.
Adult dependants require their own lawful-ground analysis; an employee’s workplace consent is not a universal authorisation for another adult. When a child turns eighteen, review the ongoing processing and transition to an adult-facing notice and appropriate ground.
Treat the insurer as an independent fiduciary where it determines underwriting and claims purposes. Clarify the administrator’s role separately.
5. Collecting employees’ children’s data for family insurance
The compliance position
This scenario involves separate individuals, not merely extensions of the employee record. The employee, an adult dependant, and a child each have their own personal data.Providing employee-requested family insurance may support an employment-benefit purpose. However, relying on section 7(i) for the employee does not automatically remove the special requirements attaching to a child’s information.
A child is an individual under eighteen. Under the notified framework, section 9 requires verifiable parental or lawful-guardian consent before processing, subject to applicable exemptions. Rule 10 sets out verification mechanisms, including use of reliable identity and age information already held or appropriate voluntarily supplied information or authorised tokens.
The ambiguity
Employers should not assume that insurance enrolment is automatically exempt under Rule 12 and the Fourth Schedule. Any exemption must match the actual class, purpose, and conditions; it is not a general waiver for all beneficial processing.The October 2026 Removal of Difficulties Order clarified wording in section 9 and the terminology for Significant Data Fiduciary audits. It did not introduce an employment-family-insurance exemption or move the substantive commencement timetable.
The lower-risk approach
Use a dedicated insurance-enrolment notice identifying the employer, insurer, administrator, data fields, and purposes. Record verifiable parental consent before collecting a child’s information, unless counsel confirms a specific applicable exemption.Use existing verified HR information to establish the consenting employee’s adulthood where appropriate, rather than routinely demanding additional identity copies. Establish the person’s stated parental or lawful-guardian authority and a process for resolving uncertainty.
Collect only fields genuinely required for enrolment. Where possible, have medical declarations and claim documents submitted directly to the insurer rather than stored in general HR folders.
Adult dependants require their own lawful-ground analysis; an employee’s workplace consent is not a universal authorisation for another adult. When a child turns eighteen, review the ongoing processing and transition to an adult-facing notice and appropriate ground.
Treat the insurer as an independent fiduciary where it determines underwriting and claims purposes. Clarify the administrator’s role separately.
Practical principle:
An employee benefit does not erase the separate rights and protections of family members.
That does not justify every camera location, analytic feature, or later reuse.
Clear signage supports transparency, but should not be mistaken for proof of valid consent. Whether entering a clearly notified monitored area constitutes voluntary provision under section 7(a) is an interpretive question, not a reliable blanket answer.
Retention is another significant issue. Rule 6 addresses retention of relevant security logs and personal data for one year. Rule 8(3) uses broad language requiring retention of personal data, associated traffic data, and processing logs for at least one year for Seventh Schedule purposes. Its interaction with short rolling footage-retention periods needs a documented legal assessment. It is unsafe to advertise a universal “30-day DPDP CCTV rule.”
Publish accessible camera notices and a fuller policy. Restrict viewing, downloading, and remote access; log exports and protect recording infrastructure.
Before the substantive Rules commence, establish a retention interpretation addressing original footage, access logs, incident extracts, legal holds, and the one-year provisions. Where retaining original footage is required or conservatively adopted, protect it in a restricted archive rather than leaving it broadly searchable.
6. CCTV recordings inside the office
The compliance position
Digital footage is personal data where individuals can be identified, directly or through other information. Security-focused employee recording may reasonably fit safeguarding the employer from loss or liability under section 7(i).That does not justify every camera location, analytic feature, or later reuse.
The ambiguity
Employees, visitors, contractors, customers, and children may appear in the same recording. The employee ground does not automatically cover everyone.Clear signage supports transparency, but should not be mistaken for proof of valid consent. Whether entering a clearly notified monitored area constitutes voluntary provision under section 7(a) is an interpretive question, not a reliable blanket answer.
Retention is another significant issue. Rule 6 addresses retention of relevant security logs and personal data for one year. Rule 8(3) uses broad language requiring retention of personal data, associated traffic data, and processing logs for at least one year for Seventh Schedule purposes. Its interaction with short rolling footage-retention periods needs a documented legal assessment. It is unsafe to advertise a universal “30-day DPDP CCTV rule.”
The lower-risk approach
Document each camera’s purpose and coverage. Avoid private spaces, unnecessary audio, and unrelated monitoring. Treat facial recognition or other identity analytics as a separate processing decision.Publish accessible camera notices and a fuller policy. Restrict viewing, downloading, and remote access; log exports and protect recording infrastructure.
Before the substantive Rules commence, establish a retention interpretation addressing original footage, access logs, incident extracts, legal holds, and the one-year provisions. Where retaining original footage is required or conservatively adopted, protect it in a restricted archive rather than leaving it broadly searchable.
Practical principle:
Cameras should protect the workplace, not create an uncontrolled archive of everyone who enters it.
Existing SPDI requirements concerning financial information must also be assessed during the transition.
Section 8(2)’s valid-contract requirement is worded around processor engagement for activities related to offering goods or services to Data Principals. Its precise application should not be overstated. Nevertheless, a written, enforceable payroll-processing agreement is the prudent baseline, and Rule 6 specifically addresses contractual security safeguards where applicable.
Address instructions, confidentiality, security, subprocessors, locations, incident reporting, assistance with requests, retention, deletion, and exit support in the contract. Prohibit advertising, enrichment, or unrelated analytics using payroll data without a separate lawful basis.
Provide finance teams with the information needed for their responsibilities, not unrestricted access to individual banking records.
7. Sharing personal and bank information with a payroll agency
The compliance position
Payroll is a strong example of a core employment purpose. Necessary sharing can reasonably be analysed under section 7(i); separate DPDP consent should not automatically be treated as the only available ground.Existing SPDI requirements concerning financial information must also be assessed during the transition.
The ambiguity
A payroll provider may act as a processor when calculating salary on instructions, yet determine independent purposes for another service. Contract labels alone do not resolve that distinction.Section 8(2)’s valid-contract requirement is worded around processor engagement for activities related to offering goods or services to Data Principals. Its precise application should not be overstated. Nevertheless, a written, enforceable payroll-processing agreement is the prudent baseline, and Rule 6 specifically addresses contractual security safeguards where applicable.
The lower-risk approach
Share only required payroll fields. Validate bank-detail changes through authenticated processes and independent checks. Use secure portals or controlled transfers instead of recurring unprotected spreadsheet attachments.Address instructions, confidentiality, security, subprocessors, locations, incident reporting, assistance with requests, retention, deletion, and exit support in the contract. Prohibit advertising, enrichment, or unrelated analytics using payroll data without a separate lawful basis.
Provide finance teams with the information needed for their responsibilities, not unrestricted access to individual banking records.
Practical principle:
Outsourcing payroll transfers work, not the employer’s accountability for its own processing.
8. Is an official email address personal data?
The compliance position
Usually, yes—where it identifies an individual.A named corporate address is personal data despite using the employer’s domain. A generic address such as “support” may not identify someone in isolation, but can become personal data when linked to a named account holder, shift allocation, or activity log.
Emails may contain personal data about several people: employees, customers, suppliers, family members, or other correspondents. Describing the mailbox as “official” does not remove those interests. This follows from the Act’s identification-based definition, not from ownership of the account.
The lower-risk approach
Include named addresses in inventories, authorised directories, security controls, and retention arrangements. Use role-based addresses where business continuity does not require public identification of a particular employee.Explain access and monitoring practices. Do not interpret an acceptable-use policy as permission for unlimited reading, disclosure, or reuse.
Practical principle:
“Professional” and “personal data” are not mutually exclusive categories.
Business correspondence may be needed for transactions, statutory recordkeeping, disputes, or genuine continuity. These purposes must be distinguished from retaining unrelated personal material or continuing to operate the former employee’s identity.
The Act’s erasure provisions must also be reconciled with legal retention and the Rules’ one-year provisions. No universal mailbox retention period can be derived simply from employment ending.
Move important business records to governed repositories. Retain necessary correspondence under a category-based schedule identifying its purpose, legal authority where relevant, retention trigger, and review date.
Use restricted, logged archive access. Avoid permanent manager access to the complete mailbox. Apply legal holds narrowly and remove them when no longer justified.
For incoming correspondence, use a time-limited departure notice and a role-based alternative. Avoid indefinite forwarding that silently captures new personal communications. Do not reassign the departed employee’s named address to a successor.
9. Retaining official email after an employee leaves
The compliance position
Departure does not require destruction of every business record. Equally, it does not justify keeping an entire mailbox forever.Business correspondence may be needed for transactions, statutory recordkeeping, disputes, or genuine continuity. These purposes must be distinguished from retaining unrelated personal material or continuing to operate the former employee’s identity.
The ambiguity
The continuing reach of the employment ground after departure is not expressly resolved for every purpose. A genuine legal-right or claim circumstance may engage section 17(1)(a), but that exemption should not be used as a blanket justification for speculative future usefulness.The Act’s erasure provisions must also be reconciled with legal retention and the Rules’ one-year provisions. No universal mailbox retention period can be derived simply from employment ending.
The lower-risk approach
Disable sign-in, revoke sessions and delegated access, and prevent continued sending as the former employee.Move important business records to governed repositories. Retain necessary correspondence under a category-based schedule identifying its purpose, legal authority where relevant, retention trigger, and review date.
Use restricted, logged archive access. Avoid permanent manager access to the complete mailbox. Apply legal holds narrowly and remove them when no longer justified.
For incoming correspondence, use a time-limited departure notice and a role-based alternative. Avoid indefinite forwarding that silently captures new personal communications. Do not reassign the departed employee’s named address to a successor.
Practical principle:
Preserve business evidence without indefinitely preserving or operating the individual’s digital identity.
A justified access-security purpose may fit section 7(i). It would be equally misleading to say that biometrics always require DPDP consent or that section 7(i) permits any biometric implementation.
A template remains personal data when linked or linkable to the employee. Calling it encrypted, encoded, or “hashed” does not necessarily make it anonymous.
Using access templates later for attendance analytics or another purpose requires a fresh assessment.
Prefer controlled templates over retained raw images. Separate the template database from the HR master record, protect keys independently, restrict access, and prohibit vendor reuse for model training or unrelated identity services.
Immediately revoke access at exit. Separately determine lawful template retention, deletion, vendor erasure, and backup handling; do not assume that disabling an account deletes its biometric record.
10. Biometric information for physical access control
The compliance position
Fingerprint, face, and iris templates linked to an employee are personal data. The DPDP Act does not create a separate statutory category called sensitive personal data, but absence of that category does not make biometrics low-risk. The existing SPDI Rules expressly address biometric information.A justified access-security purpose may fit section 7(i). It would be equally misleading to say that biometrics always require DPDP consent or that section 7(i) permits any biometric implementation.
The ambiguity
The real issue is often necessity: could badges or other less intrusive methods adequately address the threat?A template remains personal data when linked or linkable to the employee. Calling it encrypted, encoded, or “hashed” does not necessarily make it anonymous.
Using access templates later for attendance analytics or another purpose requires a fresh assessment.
The lower-risk approach
Assess alternatives before deployment and document why biometrics are justified. Where practical, offer a secure non-biometric method.Prefer controlled templates over retained raw images. Separate the template database from the HR master record, protect keys independently, restrict access, and prohibit vendor reuse for model training or unrelated identity services.
Immediately revoke access at exit. Separately determine lawful template retention, deletion, vendor erasure, and backup handling; do not assume that disabling an account deletes its biometric record.
Practical principle:
If an ordinary badge solves the problem, collecting an enduring bodily identifier may be unnecessary.
Nevertheless, a comprehensive employee privacy notice is sound governance. Explain routine employment processing, optional uses, recipients, monitoring, retention, and contact channels. Keep optional promotional permissions separate from payroll and mandatory administration.
Select controls according to risk. Masked payroll views, secure family-insurance enrolment, restricted CCTV archives, and business-managed communication channels are more meaningful than a policy stating only that information will be kept “secure.”
Create separate schedules for operational records, legally required evidence, security logs, vendor copies, backups, and legal holds. Do not apply the Third Schedule’s inactivity arrangements indiscriminately to every HR record. Obtain a documented interpretation of Rule 8(3), particularly for footage, biometrics, delivery records, and exited mailboxes.
That distinction should not become an excuse to ignore employees. Maintain practical correction and complaint channels, protect other people’s information when responding, and explain justified retention clearly. Section 13 separately addresses accessible grievance redressal.
For overseas HR platforms, shared-service centres, and vendors, examine section 16, Rule 15, any notified restrictions, and stricter sectoral requirements. The framework should not be reduced either to “everything must remain in India” or “all overseas transfers are unrestricted.”
Next, remove unnecessary disclosures: replace public personal numbers with business channels, minimise customer profiles, obtain optional photo permissions, confirm delivery addresses, and move medical submissions directly to insurers where feasible.
Then strengthen vendor arrangements and offboarding procedures. Test whether a withdrawn photo permission stops new publication, whether a changed address reaches the correct courier, whether a payroll vendor reports an incident promptly, and whether departed employees lose access without destroying legally required evidence.
Finally, obtain focused legal review of unresolved issues rather than settling for a generic compliance certificate. Employment-purpose boundaries, children’s exemptions, visitor CCTV grounds, and one-year retention interpretation deserve particular attention.
Employee-data governance requires organisations to distinguish necessary administration from convenience, a requested benefit from an unsolicited disclosure, a security control from excessive monitoring, and a business record from an indefinitely retained identity.
The lowest-risk approach is not to obtain one sweeping consent form. It is to select the correct ground for each purpose, collect less, explain more, limit recipients, secure the information, and retain evidence of the decisions made.
No organisation can promise zero legal or operational risk. It can, however, build a defensible position: every significant use of employee data has a clear purpose, a reasoned legal basis, controlled implementation, and an accountable owner.
That is the difference between merely holding employee information and genuinely governing it.
Governance controls that make all ten scenarios defensible
1 Provide transparency, without pretending every notice is consent
Section 5 and Rule 3 govern notices associated with consent requests. It is imprecise to claim that their exact notice mechanism automatically applies identically to every section 7(i) activity.Nevertheless, a comprehensive employee privacy notice is sound governance. Explain routine employment processing, optional uses, recipients, monitoring, retention, and contact channels. Keep optional promotional permissions separate from payroll and mandatory administration.
2 Protect information across organisational boundaries
Rule 6 sets minimum security expectations, including appropriate data protection measures, access controls, visibility through logs, continuity measures, and contractual safeguards where applicable.Select controls according to risk. Masked payroll views, secure family-insurance enrolment, restricted CCTV archives, and business-managed communication channels are more meaningful than a policy stating only that information will be kept “secure.”
3 Resolve retention before making deletion promises
Section 8(7) establishes erasure triggers, subject to lawful retention. The final Rules introduce additional retention requirements. Organisations should not copy GDPR-style deletion expectations into an Indian policy without reconciling the notified wording.Create separate schedules for operational records, legally required evidence, security logs, vendor copies, backups, and legal holds. Do not apply the Third Schedule’s inactivity arrangements indiscriminately to every HR record. Obtain a documented interpretation of Rule 8(3), particularly for footage, biometrics, delivery records, and exited mailboxes.
4 Handle rights according to their statutory conditions
Sections 11 and 12 contain consent-linked wording, including section 7(a). It is therefore inaccurate to assume that their full access, correction, and erasure mechanics apply identically to all processing based solely on section 7(i).That distinction should not become an excuse to ignore employees. Maintain practical correction and complaint channels, protect other people’s information when responding, and explain justified retention clearly. Section 13 separately addresses accessible grievance redressal.
5 Prepare for incidents and international processing
Once applicable, Rule 7 requires breach intimation to affected individuals without delay, initial information to the Board without delay, and detailed information within seventy-two hours or a permitted longer period. A vendor contract should require notification early enough to support the employer’s response.For overseas HR platforms, shared-service centres, and vendors, examine section 16, Rule 15, any notified restrictions, and stricter sectoral requirements. The framework should not be reduced either to “everything must remain in India” or “all overseas transfers are unrestricted.”
6 A practical readiness programme
Begin with an inventory of the ten activities discussed here. Assign an accountable owner to each and record the information collected, exact purpose, proposed legal ground, recipients, protection measures, and retention interpretation.Next, remove unnecessary disclosures: replace public personal numbers with business channels, minimise customer profiles, obtain optional photo permissions, confirm delivery addresses, and move medical submissions directly to insurers where feasible.
Then strengthen vendor arrangements and offboarding procedures. Test whether a withdrawn photo permission stops new publication, whether a changed address reaches the correct courier, whether a payroll vendor reports an incident promptly, and whether departed employees lose access without destroying legally required evidence.
Finally, obtain focused legal review of unresolved issues rather than settling for a generic compliance certificate. Employment-purpose boundaries, children’s exemptions, visitor CCTV grounds, and one-year retention interpretation deserve particular attention.
Conclusion: the goal is justified use, not maximum collection
Employee-data governance requires organisations to distinguish necessary administration from convenience, a requested benefit from an unsolicited disclosure, a security control from excessive monitoring, and a business record from an indefinitely retained identity.
The lowest-risk approach is not to obtain one sweeping consent form. It is to select the correct ground for each purpose, collect less, explain more, limit recipients, secure the information, and retain evidence of the decisions made.
No organisation can promise zero legal or operational risk. It can, however, build a defensible position: every significant use of employee data has a clear purpose, a reasoned legal basis, controlled implementation, and an accountable owner.
That is the difference between merely holding employee information and genuinely governing it.
