DPDP Act - Digital Personal Data Protection Act (India)
India's Digital Personal Data Protection Act, 2023 (DPDP Act) is the country's first dedicated data protection law governing the processing of digital personal data, establishing rights for data principals, obligations for data fiduciaries, and penalties up to Rs 250 crore for non-compliance.
- What Is the DPDP Act?
- Key Definitions HR Teams Must Know
- Consent Requirements for Employee Data
- Employee Rights as Data Principals
- DPDP Act Compliance Steps for HR Departments
- Personal Data Breach Notification
- Penalties Under the DPDP Act
- Data Protection Statistics in India [2026]
- Frequently Asked Questions About the DPDP Act
What Is the DPDP Act?
Key Takeaways
- ✓The Digital Personal Data Protection Act, 2023 (DPDP Act) is India's first dedicated data privacy law, applicable to digital personal data processed within India and to processing outside India if it involves offering goods or services to people in India.
- ✓It introduces the concepts of 'Data Fiduciary' (organizations that determine the purpose and means of processing) and 'Data Principal' (the individual whose data is being processed).
- ✓Consent is the primary legal basis for processing personal data. It must be free, specific, informed, unconditional, and unambiguous, given through a clear affirmative action.
- ✓The Act creates a Data Protection Board of India (DPBI) to adjudicate complaints, investigate breaches, and impose penalties up to Rs 250 crore per violation.
- ✓HR departments are directly impacted because they process large volumes of employee personal data: Aadhaar numbers, bank details, health records, biometric data, performance reviews, and background verification reports.
India tried to pass a data protection law for five years before succeeding. The Personal Data Protection Bill, 2019 (based on the Justice B.N. Srikrishna Committee report) was withdrawn in August 2022 after extensive criticism. The DPDP Act, 2023 replaced it with a leaner, more principles-based approach. For HR teams, this isn't an abstract regulatory exercise. Every HRIS, payroll system, applicant tracking system, and employee database processes personal data. Employee Aadhaar numbers used for PF registration. Bank account details for salary payments. Medical records for insurance enrollment. Biometric data for attendance. Background check reports. All of it falls under the DPDP Act. The Act doesn't distinguish between customer data and employee data. An employer processing employee data is a Data Fiduciary, and each employee is a Data Principal with enforceable rights. Getting this wrong can cost up to Rs 250 crore per violation.
Key Definitions HR Teams Must Know
The DPDP Act uses specific terminology. Understanding these terms is the first step toward compliance.
| Term | Definition | HR Context |
|---|---|---|
| Data Principal | The individual to whom the personal data relates | Every employee, candidate, contractor, and former employee |
| Data Fiduciary | The entity that determines the purpose and means of processing | Your company, as the employer processing employee data |
| Data Processor | Entity processing data on behalf of the Data Fiduciary | HRIS vendors, payroll providers, background check companies, cloud storage providers |
| Consent Manager | A registered entity that manages consent on behalf of Data Principals | May become relevant for large employers managing consent across multiple HR systems |
| Significant Data Fiduciary | A Data Fiduciary designated by the Central Government based on volume, sensitivity, or risk | Large employers processing data of thousands of employees may be designated |
| Personal Data | Any data about an individual who is identifiable by or in relation to such data | Name, email, phone, Aadhaar, PAN, salary, health records, biometrics, performance data |
| Personal Data Breach | Unauthorized processing, accidental disclosure, acquisition, sharing, use, alteration, destruction, or loss of access to personal data | Data leaks from HRIS, unauthorized access to payroll files, ransomware affecting HR databases |
Consent Requirements for Employee Data
Consent under the DPDP Act isn't a blanket authorization buried in an employment contract. It has specific requirements that change how HR teams collect and process data.
Valid consent elements
Consent must be free (not coerced), specific (tied to a defined purpose), informed (the employee knows what data is collected and why), unconditional (can't be a condition of employment for non-essential processing), and unambiguous (given through a clear affirmative action, not pre-ticked boxes). The employer must provide a notice in clear, plain language describing what data is being collected, the purpose of processing, how the employee can exercise their rights, and how to file a complaint with the Data Protection Board.
Legitimate uses without consent
The Act provides exemptions where consent isn't required. For employment, the key exemption is 'performance of any function under any law.' PF registration, ESI enrollment, TDS deduction, and statutory record-keeping don't need separate consent because they're legally mandated. Voluntary benefits (wellness programs, optional surveys, social media monitoring) require explicit consent. The challenge for HR teams is categorizing each type of data processing as either mandatory (no consent needed) or voluntary (consent required).
Employee Rights as Data Principals
Every employee has seven rights under the DPDP Act. HR teams must build processes to handle these requests within 30 days.
- Right to access: Employees can request a summary of all personal data being processed and the processing activities. HR must be able to pull this information from HRIS, payroll, benefits, and all other HR systems.
- Right to correction: Employees can request correction of inaccurate or incomplete personal data. This goes beyond just updating an address; it could include correcting performance review records or background check data.
- Right to erasure: Employees can request deletion of personal data that's no longer necessary for the purpose it was collected. However, legal retention requirements (PF records, tax records) override this right.
- Right to withdraw consent: Employees can withdraw consent at any time for processing that was based on consent. The withdrawal doesn't affect the legality of processing done before withdrawal.
- Right to grievance redressal: Employees have the right to an accessible grievance mechanism. Every Data Fiduciary must publish the contact details of a Data Protection Officer or equivalent.
- Right to nominate: Employees can nominate another person to exercise their rights in case of death or incapacity.
- Right to complain to the Data Protection Board: If the employer doesn't address the employee's request satisfactorily, the employee can file a complaint with the DPBI.
DPDP Act Compliance Steps for HR Departments
HR departments can't delegate data protection compliance entirely to the legal or IT team. Much of the compliance work sits squarely within HR operations.
Data mapping and inventory
Start by mapping every type of personal data HR collects, where it's stored, who has access, and how long it's retained. This includes HRIS databases, payroll systems, recruitment platforms (ATS), benefits administration, attendance and biometric systems, employee files (physical and digital), exit interview records, and background check reports. Most HR teams discover they're collecting more data than they realized, and storing it longer than necessary.
Update employment contracts and policies
Employment contracts need a clear privacy notice explaining what personal data is collected, the purpose of processing, third parties with whom data is shared (payroll vendor, insurance company, background check provider), and the employee's rights. Update the employee handbook with a data protection policy. Include the procedure for exercising data principal rights and the contact details of the person responsible for data protection in your organization.
Vendor assessment
Every HR tech vendor that processes employee data is a Data Processor under the DPDP Act. Review contracts with HRIS vendors, payroll providers, ATS platforms, background check companies, and cloud storage providers. Ensure contracts include data processing agreements that specify the purpose and scope of processing, security measures, breach notification obligations, data return or deletion upon contract termination, and restrictions on sub-processing.
Personal Data Breach Notification
The DPDP Act requires Data Fiduciaries to notify both the Data Protection Board and affected Data Principals in case of a personal data breach.
What constitutes a breach
Any unauthorized processing, accidental disclosure, acquisition, sharing, use, alteration, destruction, or loss of access to personal data. In HR context: an employee's salary data emailed to the wrong person, a ransomware attack on the HRIS, an unauthorized person accessing employee health records, or a laptop containing employee data being stolen. Even accidental exposure counts.
Notification process
The Data Fiduciary must notify the Data Protection Board and each affected Data Principal 'without delay.' The Act doesn't specify an exact timeframe (unlike GDPR's 72 hours), but the rules will likely prescribe one. The notification must describe the nature of the breach, the personal data affected, and the measures taken to mitigate the impact. HR teams should have a breach response plan that includes identifying the scope of the breach, containing it, assessing the impact, notifying the Board and affected employees, and documenting lessons learned.
Penalties Under the DPDP Act
The penalty amounts are significantly higher than any previous Indian data-related regulation.
| Violation | Maximum Penalty |
|---|---|
| Non-fulfillment of obligations for children's data | Rs 200 crore (~$24M) |
| Failure to take reasonable security safeguards to prevent data breach | Rs 250 crore (~$30M) |
| Failure to notify the Board and affected individuals of a data breach | Rs 200 crore (~$24M) |
| Non-compliance with additional obligations for Significant Data Fiduciaries | Rs 150 crore (~$18M) |
| Breach of any other provision of the Act or rules | Rs 50 crore (~$6M) |
| Data Principal furnishing false information or suppressing material information | Rs 10,000 |
Data Protection Statistics in India [2026]
Data on India's data protection readiness and the scale of personal data processing.
Frequently Asked Questions
Is the DPDP Act fully operational?
Do I need employee consent for processing payroll data?
How does the DPDP Act compare to GDPR?
Can employees request deletion of their HR records?
What should HR teams do to prepare right now?
Written by Adithyan RK