Consent and lawful basis
Do I need consent for employee data?
- Short answer
- Usually not. Processing necessary for the purposes of employment is a listed legitimate use, so routine HR processing does not rest on consent. Consent is a poor basis in employment anyway, because it is rarely free where one party is the employer.
Payroll, attendance, performance, benefits and safety processing sit comfortably in the employment legitimate use. You do not need to ask employees to agree to be paid.
Consent still has a place for genuinely optional things you offer proactively, such as a wellness programme or the use of a photograph in marketing material. Where you use consent, it must be genuinely refusable without consequence.
The absence of a consent requirement does not remove the other duties. Security, retention limits, accuracy and rights handling all continue to apply to workforce data.
Where this comes from
- Section 7(i), DPDP Act 2023
The mistake people make
Putting a blanket data consent clause in the employment contract and treating it as the basis for everything, including monitoring.