DPDP for HR Teams: What Changes, What Breaks, and How to Get Ready Before May 2027
Every HR team already runs a personal data operation. Most have just never called it one.
Ask an HR head how many systems hold employee data and you will usually hear four: the HRMS, payroll, the applicant tracking system and the attendance machine. Then ask where interview scorecards live, who keeps the spreadsheet of last quarter's exits with names and reasons, and which WhatsApp group the recruiters use to pass CVs around. The count doubles. Ask the hiring managers and it doubles again.
That sprawl used to be untidy. Under the Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025, it is exposure. The core obligations become enforceable on 13 May 2027, roughly six and a half months from today, and HR sits closer to the blast radius than almost any other function. We hold identity documents, bank details, family information, insurance claims and performance judgements on every person the company has ever hired, and on thousands it rejected.
This article is written for HR leaders, not lawyers. It covers what the Act says about candidate and employee data, where HR teams genuinely struggle, and how to prepare in ninety days. Where the law is unsettled, I say so.
Why HR is the most exposed function in the company
Marketing holds a lot of data about strangers. HR holds a great deal about people we are obliged to know well, across a relationship that runs from the first application to long after the last working day. That lifecycle matters, because the legal footing changes at every stage.
A candidate is someone who sent a CV for one role. An employee is a party to a contract, and the company needs almost everything about them to run payroll, statutory filings and benefits. An ex-employee is someone whose records you may still need for a tax assessment or a dispute and, after that, have no reason to keep. Most HR data policies treat all three as one population. The Act does not, because it looks at purpose, and purpose changes.
The data is also heavier than most business data: salary, Aadhaar and PAN copies, bank accounts, dependant details, medical claims, disciplinary records. A leaked HR folder is not an embarrassment. It is an identity-fraud kit, which is exactly the harm the security-safeguards duty exists to prevent.
The ground rules, in HR language
Four terms carry most of the weight. The company is the Data Fiduciary. Candidates, employees, interns, contractors and ex-employees are Data Principals. The payroll provider, background-verification agency, ATS vendor and similar suppliers are Data Processors. Under Section 8, responsibility stays with you even when a processor does the work, and you may engage one only under a valid contract. The Act covers personal data in digital form, including paper records that are later digitised, so a scanned joining form is in scope the moment it lands on a shared drive.
Section 4 gives a company two lawful routes: the individual's consent, or one of the "certain legitimate uses" listed in Section 7. Two matter to HR. Section 7(a) covers data a person voluntarily provides for a stated purpose, as long as they have not indicated they refuse consent. That is the CV a candidate emails for a specific job. Section 7(i) covers processing for the purposes of employment, or to safeguard the employer from loss or liability, with examples such as preventing corporate espionage, protecting trade secrets and providing a service or benefit an employee has sought.
This is useful. Most core HR processing does not need a consent form. But it is not a free pass, and I have watched teams stop reading at exactly this point. Section 7 removes the need for consent. It does not remove Section 8, which binds every Data Fiduciary whatever the ground: reasonable security safeguards, accuracy where data drives decisions, breach reporting, erasure once the purpose is served, and a working grievance process. The Section 5 notice duty attaches to consent requests, so it is not strictly mandatory for 7(i) processing, but telling employees what you do with their data is cheap insurance.
Table 1. Common HR activities and the footing I would use (practical reading, not legal advice)
| HR activity | Likely footing | Practical read |
|---|---|---|
| Payroll, statutory filings, benefits the employee asked for | Section 7(i) | The safe core. Document purpose and retention. |
| Attendance and access control | Section 7(i) | Choose the least intrusive method. Secure biometric data. |
| CV received for the role it was sent for | Section 7(a) | Use it for that application only. |
| Talent pool for future roles | Consent | A new purpose. Ask separately and set an expiry. |
| Pre-employment background checks | Grey zone | Give clear notice, collect only what the role needs. |
| Productivity monitoring, screen capture | Grey zone | Not clearly an employment purpose. Design for proportionality. |
| Wellness programmes, marketing photos, alumni lists | Consent | Genuinely optional and easy to withdraw. |
The calendar HR is working against
Table 2. DPDP milestones that matter to HR
| Date | What happens | What HR should have in hand |
|---|---|---|
| 13 Nov 2025 | DPDP Rules notified. Data Protection Board provisions take effect. | Awareness, and a first pass at mapping HR data. |
| 13 Nov 2026 | Consent Manager registration (Rule 4) begins. | Usually nothing, unless you plan to use one. |
| 13 May 2027 | Core obligations apply: notice, security safeguards, breach reporting, rights, erasure, children's data, cross-border conditions. | Everything in this article running as routine. |
There is one wobble. In January 2026 MeitY discussed shortening the window for Significant Data Fiduciaries from eighteen months to twelve. As far as I can tell, no amendment has been notified as of mid-October 2026, but check MeitY's site before relying on that. The more practical clock is commercial: customer questionnaires and due-diligence checklists already ask about DPDP readiness, and employee data will not be left out.
Seven challenges HR teams actually face
Frameworks are tidy and offices are not. These are the seven problems I would bet on finding in any mid-sized HR function.
1. "Purposes of employment" is not defined
Section 7(i) gives examples but no definition, and practitioners disagree on how far it stretches. Some read it as covering routine HR processing broadly. Others argue that anything evaluating an employee's work, such as keystroke tracking or screen capture, needs a narrower reading or consent. Falling back on the offer-letter signature does not solve it, because consent must be free, specific, informed and unambiguous, and "sign or lose the job" is hard to call free. What works: for every monitoring tool, write down the purpose, why it is necessary, and the less intrusive option you rejected. If you cannot write that page, you probably cannot defend the tool.
2. The candidate CV graveyard
Applicant tracking systems quietly accumulate years of rejected CVs. Others live in recruiters' inboxes, job-portal downloads and WhatsApp groups. Section 7(a) covers a CV for the role it was sent for. Keeping it for "future openings" is a different purpose, and Section 8(7) requires erasure once the original purpose is served, unless a law requires retention. The fix is unglamorous: a short default retention for rejected candidates, plus an explicit opt-in for the talent pool.
3. The vendor chain nobody has read
Payroll, background verification, ATS, insurers, a cloud HRMS, sometimes a parent company's system abroad. Each is a processor or a fiduciary in its own right, and your liability does not shrink because the leak happened on their servers. Most of these contracts were signed years before DPDP and say nothing useful about sub-processors, breach notice or deletion at exit. The Act permits cross-border transfers except to countries the Government restricts, and Rule 15 allows the Government to attach conditions, so you also need to know where your HR data physically sits.
Table 3. The HR vendor map
| Vendor | Data they touch | Check in the contract |
|---|---|---|
| Payroll provider | Salary, bank details, PAN, tax declarations | Use only on your instructions. Breach notice faster than your own clock. Deletion or return at exit. |
| Background-verification agency | ID documents, addresses, employment and education history | Named sub-processors. What they retain after the report. A route to correct errors. |
| ATS or job portal | CVs, contact details, assessment scores | Retention settings you control. Auto-delete. Hosting location. |
| Group insurer or TPA | Dependant details, claims | Often a fiduciary in its own right. Clarify who decides purposes. |
| HRMS, cloud or parent-company systems | Nearly everything | Cross-border access. Log retention. Right to request evidence. |
4. Shadow data
The attrition spreadsheet with names. Salary-revision drafts mailed to three people. Interview notes in a hiring manager's personal notebook app. This is where real breaches start, and it is a behaviour problem before it is a technology problem. Section 8(5) requires reasonable security safeguards, and Rule 6 spells out the baseline: encryption or masking, access control, monitoring and logging, backups, and keeping relevant logs for at least one year. None of that works on data you did not know you had.
5. Retention versus erasure
Section 8(7) says erase when the purpose is no longer served, unless retention is necessary to comply with a law. HR is bound by tax, labour, social-security and company-law record-keeping, and the periods differ by statute and state. I will not quote numbers here; build the schedule with counsel. The real challenge is that nobody owns the decision, so the default becomes "keep everything forever." There is a second grey area: whether Section 7(i) still supports holding data after the employment ends. The text does not say, so a documented, time-boxed schedule is your best defence.
Table 4. Retention drivers for HR records
| Record | Why you may need to keep it | Who decides |
|---|---|---|
| Payroll and tax records | Tax and statutory filing requirements | Finance with Legal |
| PF, ESI, gratuity records | Social-security and labour-law obligations | HR with Legal |
| Ex-employee personnel file | Disputes, reference requests, contractual claims | HR head with Legal, fixed period |
| Rejected candidate CVs | Usually nothing beyond the hiring cycle | HR head, short default |
| System access logs | Rules require relevant logs for at least one year | IT with HR |
6. Automated screening and accuracy
The Act has no AI-hiring chapter, but Section 8(3) says that where personal data is used to make a decision affecting a person, you must make reasonable efforts to ensure it is complete, accurate and consistent. That reaches auto-reject filters, psychometric scoring and ranking tools. A wrong employment date from a background check can end a candidacy. Keep a human in the loop on rejections, know what data your vendor's tool uses, and give people a way to correct errors.
7. Rights, grievances and the 72-hour clock
Rule 14 requires you to publish how people can exercise their rights and to resolve grievances within a period not exceeding 90 days. Expect requests from ex-employees in the middle of a separation dispute, often phrased as an angry email to HR. On the text, the access and erasure rights in Sections 11 and 12 attach to processing based on consent (including 7(a)), while the grievance right in Section 13 is open to everyone. Running two processes does not survive contact with reality, so build one intake and decide the legal reading case by case.
Breach is the other clock. Rule 7 requires telling affected individuals without delay, and sending the Board a detailed report within 72 hours. HR incidents are mundane: a payroll file mailed to the wrong list, a laptop with candidate data lost, a vendor breach. Put HR in the room for the drill, because HR is who will face the employees.
One smaller trap: if you take interns or apprentices under 18, Section 9 requires verifiable parental consent and restricts tracking and behavioural monitoring, subject to exemptions in the Rules.
What the law puts at stake, in HR terms
Penalties are capped by the Act's Schedule and imposed by the Data Protection Board. They are maximums, not fixed fines.
.png)
The largest ceiling, ₹250 crore, attaches to failing to take reasonable security safeguards, the very thing a tidy, access-controlled HR estate prevents. Failing to notify a breach carries up to ₹200 crore, and so does breaching the children's-data duties. Everything not otherwise listed is capped at ₹50 crore. A single incident can trigger more than one band.
The HR readiness checklist
- Name an owner, an executive sponsor, and a published contact for queries (Rule 9).
- Map the data across candidates, employees and ex-employees, including spreadsheets, inboxes and chat groups.
- Record purpose and basis for every HR activity: 7(i), 7(a) or consent.
- Rewrite notices in plain language at application and onboarding (Rule 3).
- Fix consent where it is truly the basis: talent pool, wellness, alumni. Separate from the offer letter, easy to withdraw.
- Set retention with a legal reason per record type, then run deletions.
- Put vendors on paper, starting with payroll, BGV, ATS, insurer and HRMS.
- Tighten access to payroll and personnel files, revoke same-day at exit, keep logs.
- Open one rights and grievance channel, with an internal target well inside 90 days.
- Rehearse and record. Run a breach drill with HR present and keep dated evidence.
Ninety days will not finish the job. It will make you defensible, with a data map, a retention schedule, signed vendor terms and one rehearsed breach, and it leaves roughly a hundred days of buffer before 13 May 2027.
Where VaultDef fits
A spreadsheet can carry a ten-person company through this. An HR function with thousands of employees, a dozen vendors and years of candidate history cannot, and auditors do not grade intentions. They sample evidence.
VaultDef turns this checklist into a running programme. Automated data discovery and classification helps find where HR data actually sits, shadow copies included. RoPA and data mapping record each HR activity with its purpose, basis, location and recipients. Consent and notice management handles talent-pool opt-ins, with withdrawals logged. The rights workflow gives employees, candidates and ex-employees one intake, tracked against the 90-day ceiling. Vendor and cross-border tracking keeps your payroll, BGV and HRMS register current, the breach workflow keeps the 72-hour clock visible, and a tamper-evident evidence trail means that when someone says "prove it," you open a folder.
To be clear about the limits: software will not choose your retention periods, rewrite old contracts or change how a hiring manager handles a CV. Those remain human decisions. VaultDef's job is to make them stick and to leave a record. If you want to see it against your own HR estate, book a working demo. For the wider organisational view, read our DPDP audit readiness checklist.
The honest closing thought
HR teams are good at what DPDP rewards: documenting decisions, following process and treating people's information with discretion. The teams that struggle in 2027 will not be the ones with small budgets. They will be the ones that waited for perfect legal clarity before touching the recruiter's inbox.
Start this week with one question: where does our candidate data actually live? Everything else follows from the answer.
Frequently asked questions
Does the DPDP Act cover employee data? Yes. Employees, candidates, interns and ex-employees are all Data Principals, and HR records in digital form are in scope.
Do we need consent from every employee? Not for processing that falls under Section 7(i), but consent is needed for optional uses, and the Section 8 duties apply regardless.
Must we delete rejected candidates' CVs? Once the hiring purpose is served and no law requires retention, Section 8(7) points to erasure unless the candidate opted in to a talent pool.
