DPDP Act for Employers: How to Handle Employee Data in Your HRMS

• Identity and KYC: Aadhaar, PAN and other ID copies.
• Financial: bank account details, salary, deductions and reimbursements.
• Work records: attendance, location punches, leave and performance notes.
• Contact and family details: addresses, phone numbers and nominees.

The Rules were notified on 13 November 2025 and come into force in phases. Provisions setting up the Data Protection Board applied immediately, consent manager provisions follow after 12 months, and the remaining obligations, such as notice and consent, legitimate uses, reasonable security safeguards, breach notification and data principal rights, apply after 18 months, in May 2027.

The Act lists certain legitimate uses where consent is not the basis for processing, and employment purposes are among them. That does not remove your other duties. You still need to keep data accurate, protect it with reasonable security safeguards, and erase it when it is no longer needed for the purpose, subject to other laws that require you to retain records.

• Role-based access. Managers see their team’s attendance; only payroll sees salaries and bank details.
• Access logs. A record of who viewed or changed sensitive fields.
• Secure document storage rather than ID scans in email or WhatsApp.
• Retention and deletion rules for ex-employee data once statutory retention periods end.
• Export on request so you can answer an employee’s request about their data.
• Breach response. A clear owner and process to inform affected employees and the Data Protection Board if data is compromised.

The Act allows penalties of up to ₹250 crore for failing to take reasonable security safeguards to prevent a personal data breach. For most SMEs the practical risk is simpler: salary sheets and ID scans shared over chat, and former staff who still have access. Moving HR data into one system with proper access control fixes most of that.

1. List every place employee data lives today: spreadsheets, email, chat groups and shared drives.
2. Move it into one system and delete the scattered copies.
3. Set roles so each person sees only what they need.
4. Turn off access for anyone who has left.
5. Write down who handles a data breach and how.

Our HRMS portal stores employee documents on one profile with role-based access, and we configure roles for your organisation.

• HRMS for Indian SMEs: build vs buy
• Payroll software for small businesses in India
• Attendance management systems for Indian SMEs
• Our HRMS portal: features and pricing

• Press Information Bureau, Digital Personal Data Protection Rules, 2025
• Digital India, Digital Personal Data Protection Act, 2023