The DPDP Act lets an employer process employee data without consent for purposes of employment, or to protect the employer from loss or liability, as we read section 7. That does not remove other duties: you still need to collect only what you need, keep it secure, tell staff what you do with it and handle requests. Review HR files, payroll tools and attendance systems first.
- A legitimate use for employment does not cover every use of staff data.
- HR spreadsheets, payroll apps and biometric attendance are the usual risk areas.
- Job applicants’ CVs are personal data too.
What employee data do you hold?
| Type | Examples | Where it usually sits |
|---|---|---|
| Identity and contact | Name, phone, address, photo | HR file, WhatsApp groups |
| Pay and tax | Bank details, PAN, salary | Payroll app, accountant, spreadsheets |
| Attendance | Biometric or app records, leave | Attendance device, HR tool |
| Hiring | CVs, interview notes, references | Email, job portals |
| Health and family | Medical leave, emergency contacts, insurance | HR file, insurer |
The employment “legitimate use”
Section 7 lists situations in which personal data can be processed without consent. One of them covers purposes of employment and purposes related to safeguarding the employer from loss or liability, such as preventing the leak of trade secrets or confidential information, and providing a service or benefit the employee has asked for. We read it as covering normal HR, payroll and security functions. Whether a particular use fits depends on the facts, so take advice for unusual cases, for example monitoring staff devices.
What still applies
- Collect only the data you need for the stated purpose.
- Keep it secure and limit who can open it.
- Tell staff what you collect and why, in plain language.
- Keep it only as long as needed, subject to legal record-keeping duties.
- Have a way for staff to ask for correction or raise a concern.
Where small employers slip
- Staff documents shared on WhatsApp or personal email
- Salary sheets open to everyone in a shared drive
- Former staff data kept indefinitely
- Biometric attendance with no notice or retention rule
- CVs from job portals forwarded around without a purpose
A short checklist
- List the staff data you hold and where it sits.
- Restrict access to payroll and HR files.
- Add a short staff notice to your onboarding pack.
- Set a retention rule for ex-employee and applicant data.
- Name someone staff can contact with questions.
Frequently asked questions
Do I need employee consent for payroll?
Where processing falls within the employment legitimate use, consent is not the route. Even so, give staff a clear notice and keep the data secure.
Do job applicants’ CVs count?
Yes. A CV is personal data. Keep it only for the hiring purpose, and delete or return it when you no longer need it, subject to any consent you hold to keep it on file.
Sources
Reviewed 3 November 2026. This is general information, not legal advice. Dates and details can change, so check the official sources.