DPDP for Employment and Workplace

Can my employer process my data without asking for consent every time?

Yes, for the work itself. The law lists a short set of situations where an employer does not have to ask, and running the employment relationship is one of them. Your employer does not need a fresh yes from you to pay you, roster you, or keep your service record.

The same allowance covers protecting the business from loss, such as guarding trade secrets or stopping someone walking off with confidential material.

It stops at those purposes. Anything for a different reason needs a reason of its own, and that is not always your agreement. A filing the law obliges the employer to make, or a court order, each stand on their own footing. But where the new purpose is something the employer simply wants, such as marketing or publicity, nothing on the list covers it and your agreement is what it would take.

ACT · Section 7(i).

What happens to my data when I leave the job?

They have to let it go once there is no longer a reason to keep it. As soon as it is fair to say the purpose has ended, your former employer has to delete it.

The exception is anything another law tells them to keep. Tax and employment records usually have their own set periods. Those periods are the ceiling, not a licence to keep the whole file forever.

ACT · Section 8(7).

Can my employer monitor my official email, laptop or attendance biometrics?

Within limits, and without asking you first. Monitoring that the job genuinely needs, or that protects the company from a real loss such as leaked trade secrets, is allowed.

The limit is how far it goes. It has to stay inside what those purposes actually require, and whatever is collected still has to be kept secure. Watching everything you do, just in case, is not what this allowance is for.

ACT · Sections 7(i), 8(4) and 8(5).

Can they share my data with a background verification agency or group company?

A background check for the job itself can be part of employing you, so that sharing can be fine.

Passing your details to a sister company for something unrelated is a different matter. That is a new purpose and it needs its own reason. Being part of the same group is not a reason on its own.

ACT · Sections 4, 6 and 7(i).

How long can they keep my records after I resign?

Only while there is still a live reason, or while another law says they must.

Plenty of employment and tax rules set their own periods and those apply. But they are a limit, not a starting point. Keeping the whole file indefinitely because it might be useful one day is not a reason the law recognises.

ACT · Section 8(7).

Can they use my data for internal analytics or future hiring?

Analysis that stays inside the employment relationship, such as looking at attendance or attrition across the company, can be covered.

Using your information to recruit other people, or for analysis unconnected to your job, is a different purpose. That needs its own reason, and already holding the data is not one.

ACT · Sections 4, 6 and 7(i).

What exactly can HR do without my consent?

More than most people expect, and it comes from four separate places in the law rather than one.

Running the job itself, and protecting the company from loss. Anything you handed over yourself for an obvious reason. Filings the employer is legally required to make to the government, such as provident fund, ESI and tax returns. And obeying a court order, such as an attachment of salary.

None of them is a blank cheque. Each one covers only its own purpose, and the duties to keep your information secure, accurate, and no longer than needed apply to all four.

ACT · Sections 7(a), 7(d), 7(e) and 7(i).

Is my company email address my personal data, or the company's?

It is your personal data. The law covers any information about a person who can be identified from it, and an address in the form firstname.lastname@company.com identifies you.

Owning the mailbox is not the same as owning what is inside it. The company owns the account and the mail system, and under your contract it may own the work itself. What that makes it is the organisation answerable for your data, not one the law leaves out.

ACT · Section 2(t).

Can I ask my employer for a copy of everything they hold about me?

Not for everything, and this catches people out. The right to ask an organisation for a copy of what it holds is written to apply where you agreed to the use, or where you handed the information over yourself.

It is not written to cover information the employer uses simply because it employs you.

A personnel file is usually a mix of the two. What you gave them, and anything they asked your permission for, is within reach. The rest sits outside how that right is worded.

ACT · Sections 11(1), 7(a) and 7(i).

Can I make my employer correct or erase my records?

Correction is the stronger of the two. Quite apart from you asking, an employer that uses your information to make a decision about you has to make sure it is complete, accurate and up to date.

Deletion does not depend on you asking either. Once it is fair to say the reason for holding it has ended, they have to delete it, unless another law requires them to keep it.

The right to demand correction or deletion yourself is worded like the right to a copy, so it reaches what you agreed to or handed over rather than everything in the file.

ACT · Sections 12(1), 12(3), 8(3) and 8(7).

If I have a complaint about how my employer handles my data, what can I do?

This one is not narrowed the way the others are. You can complain about anything your employer does or fails to do with your information, whatever its reason for holding it was, and the employer has to give you a workable way to do that.

Every organisation also has to publish contact details for someone who can answer questions about how it handles your data. Your employer is no exception.

There is an order to it. You have to go through the employer's own complaints process first, before taking it to the Data Protection Board.

ACT · Sections 13(1), 13(3) and 8(9).

My payroll is run by an outside vendor. If they leak my data, who is answerable?

Your employer. The law makes the organisation that decided to collect your data answerable for it, including when the work is done by someone it hired, and it says so no matter what the two of them agreed between themselves.

A clause in the vendor contract moving the blame changes who pays whom. It does not change who is answerable to you.

The employer also has to put security terms into that vendor contract rather than assume the vendor has it covered.

ACT · Section 8(1); RULES · Rule 6.

Does the company need my consent to run payroll?

No. Paying you is the clearest case of running the employment relationship, which is one of the situations where the law does not require your agreement. Salary, deductions, attendance feeding into pay, and the bank transfer are all covered.

The government filings sit on separate footing. Provident fund, ESI and tax deduction returns are things the employer is legally obliged to file, so those do not turn on your agreement either.

This cuts both ways, which is worth knowing. Where your agreement was never the basis, there is nothing for you to withdraw. You cannot opt out of being on the payroll. Equally, your employer cannot wave a signed form as its authority.

ACT · Sections 7(i) and 7(d).

Can my employer post my photo on the company's social media or website?

Not without asking you. Running the job, and protecting the company from loss, are what the law lets an employer do without permission. Marketing, employer branding and recruitment posts are none of those. Publishing your photograph is a separate thing the company wants to do, so it needs your agreement.

That agreement has to be real. It must be freely given, specific to what they actually intend to do, and not bundled into something else. A line in your appointment letter covering any future promotional use is not specific, and permission an employer asks of its own staff is hard to call freely given.

You can also take it back at any time, and withdrawing has to be as easy as agreeing was. Once you do, the company has to stop, and make anyone it passed the photo to stop as well. If it is ever disputed, it is the employer who has to prove you were told and that you agreed.

ACT · Sections 7(i), 6(1), 6(4), 6(6) and 6(10).

Can the company keep using my photo or testimonial after I leave?

Only while it still has a reason. If they were relying on your agreement, you can take that back at any point, including after you have left, and they then have to stop and make anyone they shared it with stop too.

Even if you say nothing, once it is fair to say the reason for using it has ended they have to delete it. No law requires a company to keep a marketing photograph, so there is little left to stand on once you have gone.

Material already out in the world is a practical problem rather than an exception. What they owe you is to stop, and to delete what they hold. Not a guarantee that nobody ever saved a copy.

ACT · Sections 6(4), 6(6) and 8(7).

Does HR need consent to collect my family's details for insurance or emergency contacts?

Your spouse, parent or dependant is a separate person in the eyes of this law. Their information belongs to them, and you passing it on is not the same as them agreeing.

The employer's usual footing is that the law lets it handle what is needed to give you a benefit you asked for. Group insurance and an emergency contact are benefits you asked for, so handling the details that benefit genuinely needs can sit there.

The benefit is also the boundary. Using a family member's details for anything beyond running the benefit you asked for is a separate purpose, with nothing behind it.

ACT · Sections 7(i) and 2(j).

Can my employer monitor my personal phone or personal messages?

Who owns the phone is not what decides it. The reason is. The allowance covers monitoring the job genuinely needs, or that protects the company from a real loss such as leaked trade secrets, and it stops there.

On a personal phone that is a narrow opening. Reading your private messages, or tracking where you are outside working purposes, is hard to tie back to protecting trade secrets, and anything beyond those purposes has nothing holding it up.

Asking your permission is not an easy way round it. Permission has to be freely given, specific, and not a condition of something else, and a request from your own employer attached to keeping an arrangement in place struggles on all three.

ACT · Sections 7(i) and 6(1).

The law lets us monitor anything an employee does.

It reaches employment purposes, and protecting the employer from loss or liability such as corporate espionage, trade secrets, intellectual property and classified information. Monitoring outside those purposes, or beyond what they actually need, is not covered.

You signed the employment contract, so you consented to all of this.

The employer never needed your agreement for the core of the job, so signing the contract adds nothing to it. And where agreement genuinely is required, one demanded as a condition of keeping your job is hard to call freely given, specific and unconditional.

We keep your complete personnel file forever after you leave.

It can be kept only while a live reason remains, or while another law requires it. Plenty of tax and employment laws set their own periods, and those periods are the limit, not a starting point.

Background verification means we can look into anything about you.

Checks the job genuinely needs can be covered. Collecting unrelated information about your family, your finances or your private life is a separate purpose, and it needs a reason of its own.