Digital Trust · DPDP for HR Tech

DPDP for HR tech and employers: “employment purposes” is not a blank cheque.

For HR heads, CHROs, CISOs and product leads at HR platforms, payroll providers, background-check firms and large employers. The Act allows certain processing for employment purposes without consent, but notice, security, purpose limitation, retention and rights requests still apply — to candidates, employees, contractors and former staff.

Employment-purpose processingCandidate & background checksPayroll & benefits vendorsMonitoringRetention after exit

Request a HR Tech DPDP Assessment Run the Free Gap Assessment

Where this starts

What hr tech teams usually discover in week one.

The privacy policy exists. The gaps are operational: what was collected under which consent, who it went to, and whether anyone can prove it. If three or more of these apply, a scoped gap assessment is the right first step.

Regulators & rule-sets in play

Labour and employment law (record-keeping)Tax and social-security rulesCERT-InData Protection Board

Sound familiar?

Candidate CVs and background-check reports for people never hired are kept indefinitely in the ATS.
Employees are monitored — email, endpoint, location — with no notice of what is collected or why.
Payroll, insurance and benefits vendors receive full employee files with no processor agreement.
Family and dependant details are collected for insurance and stored with no notice to those individuals.
Former employees ask what is held about them and HR does not have a process to answer.
The HR platform you sell to customers has no data-processing terms distinguishing your role from theirs.

Personal data in scope

The data a HR Tech organisation actually holds.

A DPDP programme starts with an honest inventory. These are the categories we typically find across hr tech systems — each needs a purpose, a basis, an owner and a retention period.

Identity, address and family details
Salary, bank and tax records
Health, leave and insurance data
Background-check and reference results
Performance, disciplinary and exit records
Monitoring, access and location logs

Two professionals in conversation at an office table representing HR and workforce data processing

How the Act applies

DPDP obligations, translated for HR Tech.

The Act is sector-neutral. Its impact is not. These are the obligations that carry the most weight for your workflows.

Legitimate use for employment — with limits

Processing necessary for employment purposes may proceed without consent, but only for those purposes. Wellness marketing, analytics beyond the employment need, or sharing with unrelated third parties fall outside it.

Notice to candidates, employees and dependants

Every data principal — including family members on insurance and referees — must be told what is collected and why.

Background checks and monitoring

Both are high-sensitivity. Purpose, proportionality, notice and retention need to be documented; results should not be kept longer than the decision requires.

Vendors as processors

Payroll, ATS, HRMS, insurance, verification and cloud vendors act on your behalf. Contracts must cover purpose, security, deletion and breach duties.

Retention after exit and rights requests

Statutory employment records are retained as labour and tax law require; everything else has a defined schedule. Former staff retain access and correction rights.

We keep legal specifics general on this page. Section-level analysis, penalty exposure and interpretation are worked through with your counsel during the engagement.

The hard part

Statutory employment records versus the employee’s right to erasure.

Labour, tax and social-security rules require certain employee records to be retained after exit. DPDP allows erasure only where no law mandates retention. The programme separates statutory records from performance notes, monitoring logs, candidate files and analytics — and applies each rule at exit and on request.

How we resolve it

Statutory employment records tagged with the applicable requirement and retention period.
Candidate files for unsuccessful applicants, monitoring logs and analytics on defined, short schedules.
Vendor copies covered by contract deletion terms.
Exit and erasure responses that state what is retained and under which law.

In your workflows

Where consent, notice and rights actually show up.

Recruitment

Candidate notice at application; background-check consent and proportionality review; deletion schedule for unsuccessful candidates.

Onboarding & payroll

Employee and dependant notices; vendor processor terms; access controls on salary and health data.

Monitoring & security

Documented purpose and scope for monitoring; proportionality review; retention limits for logs.

Exit & rights

Retention matrix applied at exit; rights-request workflow for current and former staff with SLA and evidence.

Want to know which of these is your biggest gap? The free assessment takes about ten minutes and scores seven compliance areas.

Run the Gap Assessment

Typical starting points

Three ways HR Tech clients begin.

Scoped, time-boxed and designed to produce evidence early — so the board and the regulator see progress inside the first month.

First engagements

Employee data inventory and legal-basis mapping (employment purpose vs consent) in two weeks
Candidate and background-check retention schedule with ATS configuration
Vendor processor-contract remediation and a monitoring-proportionality review

How the programme runs

From gap assessment to continuous readiness.

Week 1–2 · Gap assessment

Data inventory, consent and notice review, vendor and rights-process review, breach readiness. Prioritised findings.

Week 3–6 · Remediation sprint

Notice and consent redesign, retention-vs-erasure matrix, vendor contract terms, breach playbook — highest-risk gaps first.

Week 7–12 · Operations

Rights-request workflow, consent logging and evidence store live in Avisha Trust; teams trained; first evidence pack produced.

Ongoing · Monitoring

Quarterly reviews, vendor re-assessment, AI-usage tracking and readiness reporting to the board.

Built for the Indian regulatory stack

We reconcile DPDP with the sector rules that already bind you, instead of importing a foreign template.

Security and compliance from one team

“Reasonable security safeguards” are tested by the people who run VAPT and incident response, not only described in policy.

Evidence, continuously

Avisha Trust captures consent, rights requests and attestations so the answer to “show me” is an export, not a project.

FAQ

DPDP for HR Tech: questions we hear most

Because the legitimate-use ground covers only processing necessary for employment purposes and does not remove notice, security, purpose limitation, retention or rights obligations. Most HR data problems — indefinite candidate files, undocumented monitoring, vendor sharing — sit outside the ground.

Where it is necessary and proportionate for a legitimate employment purpose such as security, with clear notice of scope and retention. Blanket, undocumented monitoring is the pattern that fails. We produce the purpose, proportionality and retention documentation.

For your customers’ employees you are normally the processor and the employer is the fiduciary; for your own staff and for users who sign up directly you are the fiduciary. Your contracts, notices and security commitments must reflect both roles.

Long enough for a defined purpose — for example, a short window for talent pooling with notice, or the period needed to defend a hiring decision — then delete. Indefinite retention is not defensible.

Related sectors

Start with your sector’s pressure point.

Request a scoped HR Tech DPDP assessment, or run the free gap assessment first.

Request a HR Tech Assessment Free Gap Assessment