India's data protection law reaches every company that holds an Aadhaar copy, a bank account number and a salary. That is every employer. Here is the part that applies to you, without the enterprise consultancy.
The Digital Personal Data Protection Act, 2023 applies to any business that processes personal data digitally — which includes every employer holding employee records. The DPDP Rules, 2025 were notified on 13 November 2025 in phases: the Data Protection Board machinery first, consent-manager provisions from 13 November 2026, and the substantive obligations on businesses — security safeguards, notice, breach notification, retention limits and data principal rights — from 13 May 2027. For employers the good news is that processing "for the purposes of employment" is a legitimate use under Section 7, so you do not need consent to run payroll, attendance or leave. The work is elsewhere: knowing what you hold, securing it, deleting what you no longer need, contracting your vendors properly, and being able to notify a breach within 72 hours. Facts checked 14 October 2026; this is a practical guide, not legal advice.
| 13 November 2025 | Rules notified; Data Protection Board constituted; definitions in force. |
|---|---|
| 13 November 2026 | Consent manager framework applies (mostly relevant to platforms, not employers). |
| 13 May 2027 | Obligations on data fiduciaries apply: notice, consent where required, security safeguards, breach notification, retention and erasure, data principal rights, grievance redressal. |
You are a data fiduciary for your employees' data. Your payroll software, HRMS, background-check agency and payroll outsourcer are data processors acting on your instructions. Employees are data principals with rights to access, correct and erase their data, and to a grievance channel. Penalties for failing security safeguards run to ₹250 crore at the top end — not a small-business number, but the Board can scale penalties, and the reputational cost of a leaked salary sheet is immediate.
Even where no consent is needed, data minimisation applies: collect what the employment purpose needs. The attendance system needs location at the moment of check-in; it does not need the employee's location all day. See how geolocation attendance should be bounded and why face recognition raises the bar further.
The rules require reasonable safeguards and name the kinds: encryption, access control, monitoring and logging, backups, and contractual controls on processors. In practice for a 5–200 person company:
The workforce data security checklist has the eight questions to put to any vendor; under DPDP, their answers become your compliance evidence.
DPDP says delete when the purpose is served. Labour and tax law say keep payroll, attendance, PF and TDS records for defined periods (several years; registers under the labour codes and the Income-tax Act have their own schedules). These reconcile through a written retention schedule: payroll and statutory records kept for the statutory period then deleted; identity documents kept for the employment plus the statutory period; recruitment data for candidates not hired deleted within months; access logs kept for a year. The rules also contemplate notifying the individual before erasure after a period of inactivity — relevant to ex-employees who still have self-service logins.
On becoming aware of a breach, you notify the Board and each affected individual — promptly in the first instance, with the detailed report within 72 hours. The hard part for a small business is not the notification; it is becoming aware. A spreadsheet forwarded to the wrong person is a breach nobody detects. A system with access logs is one you can.
| Law | Digital Personal Data Protection Act, 2023; DPDP Rules, 2025 |
|---|---|
| Rules notified | 13 November 2025 |
| Main obligations apply | 13 May 2027 |
| Employer's role | Data fiduciary for employee data; vendors are processors |
| Consent for HR core | Not required — employment is a legitimate use (Section 7) |
| Consent likely needed | Background checks, monitoring, marketing use of photos, sharing for third-party purposes |
| Breach notification | Board and affected individuals; detailed report within 72 hours |
| Retention | Delete when purpose served, reconciled with labour and tax record-keeping periods |
Yes. The Act applies to anyone processing digital personal data in India, with no headcount threshold. Holding employee records — identity documents, bank details, salary, attendance — makes an employer a data fiduciary. Some obligations are lighter for smaller entities, but the security, breach and retention duties apply.
No. Processing for the purposes of employment is a legitimate use under Section 7 of the Act, so payroll, attendance, leave, statutory filings and performance records do not require consent. Consent is still needed for purposes outside employment, such as marketing use of employee photos or sharing data with third parties for their own use.
The Rules were notified on 13 November 2025 and phased in. Consent manager provisions apply from 13 November 2026, and the substantive obligations on businesses — security safeguards, notice, breach notification, retention and data principal rights — apply from 13 May 2027.
Any unauthorised processing, disclosure, access, loss or alteration of personal data that compromises its confidentiality, integrity or availability. A salary spreadsheet emailed to the wrong person, a lost laptop with employee documents, or a shared HR login used after someone left all qualify.
As long as the purpose or a legal obligation requires. Labour and tax laws require payroll, attendance and statutory records for several years; keep those for the statutory period, then delete. Data with no legal retention requirement — recruitment files of candidates not hired, for example — should be deleted much sooner, and the rules contemplate notifying the individual before erasure after a period of inactivity.
The vendor is a data processor acting on your instructions; you remain the fiduciary responsible to employees and the Board. Your contract must require the vendor to maintain security safeguards, notify you of breaches and delete data on termination, and you should be able to show what the vendor does to protect the data.
Merik is built the way the safeguards section describes. Employee records, attendance, leave, payroll and documents live in one tenant whose isolation is enforced in Postgres by row-level security, not only in application code; roles are superadmin, admin and employee, so a manager cannot open another team's salary and an employee sees only their own record. Payroll is computed server-side, never downloaded to a browser to be worked on. Employees download their own payslips and see their own attendance and leave, which covers most of the access-and-correction right in practice. Location is captured at the check-in tap, reverse-geocoded to a place name, and not tracked between punches.
Merik is a processor for your employee data; the privacy notice, the retention schedule and the consent forms for anything outside employment purposes are yours to write. The security page sets out tenant isolation, authentication, where payroll runs, AI gating and the third-party services Merik itself depends on — the answers a processor contract asks for.
Free, set up for you, every module included — see what the free workspace includes
The questions to ask any HR tool holding your salaries and IDs.
It solves proxy punching only; what DPDP demands for biometric data; the cheaper verifiable alternative.
How self-service removes HR as a bottleneck across the business.
Request your free company workspace and bring employees, attendance, leave, payroll and tasks together.