HR Tech
DPDP Compliance for HR Tech Platforms
Employee personal data including salary information, identity documents, and performance records falls under the DPDP Act. Your clients' employees are data principals with enforceable rights.
- DPDP obligations on Data Fiduciaries take effect
- 13 May 2027
- Penalty ceiling for failing to notify a breach, Section 8(6)
- 200 Cr
- Maximum penalty under the DPDP Act
- 250 Cr
Obligations
Your DPDP Obligations as a HR Tech Company
The DPDP Act 2023 imposes specific requirements based on how your organisation processes personal data. These are the obligations most relevant to hr tech operations.
Ref 01
Employment Context Consent
Section 6 requires free consent. In employment contexts, consent may not be truly "free" due to power imbalances. Legitimate interest and contractual necessity must be documented as alternative legal bases.
Ref 02
Employee Data Rights
Sections 11-14 grant employees the right to access, correct, and erase their personal data. Performance reviews, salary data, and identity documents are all subject to these rights.
Ref 03
Purpose Limitation
Employee data collected for payroll processing cannot be repurposed for performance analytics or workforce planning without separate consent or documented legal basis.
Ref 04
Data Retention Controls
Employee data must be deleted when the employment relationship ends and retention periods expire. Tax and labour law retention requirements must be documented.
Ref 05
Processor Obligations
As a platform processing data on behalf of employer clients, you carry processor obligations. Data processing agreements must define purpose, scope, and security requirements.
Ref 06
Cross-border Transfers
Global HR platforms move Indian employee data to servers outside India. The DPDP Act permits transfers outside India unless the Central Government restricts a country by notification under Section 16(1). Record each transfer and watch for notifications.
Timeline
Your Compliance Roadmap
Key milestones between now and 13 May 2027, when the Act's obligations on Data Fiduciaries take effect.
Now
Audit employee data processing
Map all personal data fields, processing purposes, and third-party sharing across your HR platform.
Q3 2026
Legal basis documentation
Document consent vs. contractual necessity vs. legal obligation for each processing activity.
Nov 2026
Rule 4 applies
From 13 November 2026, registration with the Data Protection Board is mandatory for entities that operate as Consent Managers. A Data Fiduciary is not required to register, or to route consent through one.
Q1 2027
Rights fulfilment system
Implement employee data access, correction, and erasure workflows for your platform.
May 2027
Obligations and penalties take effect
The maximum penalty, 250 crore, is for failing to take reasonable security safeguards under Section 8(5).
Penalty Exposure for HR Tech Companies
Section 33 of the DPDP Act prescribes penalties based on violation type. Each amount is the ceiling for that category of breach.
Recommended Plan
Starter for HR Tech
Starter tier supports up to 50K data principals with the consent management and audit trail functionality HR Tech platforms need for employee data compliance.
₹25,000 one-time
- Up to 50K data principals
- Audit readiness dashboard
- Privacy notice generator
- Email support
Resources
Essential Reading for HR Tech
The DPDP provisions that bear most on your sector, in detail.
DPDP Act 2023: The Data Principal Rights with Templates (India)
Access, correction, erasure, grievance, and nominee rights under the DPDP Act 2023: the response deadlines a Data Fiduciary must meet, with ready-to-use request templates.
7 min read
Compliance Areas7 Data Fiduciary Obligations Under India's DPDP Act 2023
The DPDP Act imposes 7 obligations on every Data Fiduciary, with penalties reaching ₹250 crore at the top tier. What each obligation requires, section by section.
8 min read
Implementation GuidesBuilding a DPDP-Compliant Privacy Program for Indian Businesses (2026)
Structured approach to building a data protection program that meets India's DPDP Act 2023 requirements. From gap assessment through operational compliance in 90 days.
8 min read
FAQ
HR Tech compliance, answered.
Can employees consent freely in an employment context?
Consent in employment is complicated by power imbalances. The DPDP Act requires consent to be "free." Where consent cannot be truly free, document contractual necessity or legal obligation as the processing basis instead.
Do we need separate consent for performance analytics?
If employee data collected for payroll is repurposed for performance analytics, that constitutes a new processing purpose under Section 5. You need either fresh consent or a documented alternative legal basis.
What happens to employee data after termination?
Personal data must be deleted when the processing purpose is fulfilled. Post-termination, only data required for tax compliance, legal disputes, or regulatory obligations may be retained, with documented justification.
Every employee on your platform is a data principal with enforceable rights.
The free DPDP Gap Assessment takes less than ten minutes. You receive a scored compliance report with a prioritised action list.