Does it apply to me
Does DPDP apply if we only have employee data?
- Short answer
- Yes. Employee data is personal data. Payroll, HR records, biometric attendance and identity documents all count, so an organisation with no customer data at all is still within scope. One employee is enough to trigger the baseline.
This catches a lot of B2B firms and manufacturers, who reason that because they sell to businesses rather than people, they hold little personal data. The workforce is the gap in that reasoning.
Much employment processing rests on the legitimate use in Section 7(i) rather than on consent, which means no consent notice is needed for it. That reduces the paperwork, it does not remove the duty to secure the data, to keep it only as long as it is needed, or to answer a rights request.
Biometric attendance deserves particular attention, because it is high sensitivity data collected routinely and often held far longer than any purpose requires.
Where this comes from
- Section 7(i), DPDP Act 2023
- Rule 6, DPDP Rules 2025
The mistake people make
Treating employee data as an internal matter outside the Act. The Act does not distinguish between data about customers and data about staff.