Quick answer: The DPDP Act, formally the Digital Personal Data Protection Act, 2023, is India’s general law on processing digital personal data. As an employer you are a Data Fiduciary for your staff’s records. Employment is a legitimate use under section 7(i), so core HR processing needs no consent, but security, breach and erasure duties still apply.
- The DPDP Act 2023 is Act No. 22 of 2023 and received presidential assent on 11 August 2023.
- The DPDP Rules 2025 were published on 13 November 2025, triggering a phased start.
- Penalties reach ₹250 crore for failing to keep reasonable security safeguards.
- A breach needs prompt notice to the Data Protection Board and affected people, then a detailed report within 72 hours.
When do DPDP duties start for employers?
Mostly on 13 May 2027. The rollout runs in three stages.
| Date | What starts |
|---|---|
| 13 November 2025 | Definitions, Data Protection Board provisions and the Rules’ framework |
| 13 November 2026 | Consent manager registration |
| 13 May 2027 | Notices, legitimate uses, security safeguards, breach reporting, retention and erasure, data principal rights, penalties |
So the hard deadline is 18 months after the Rules. That leaves about six and a half months. The Privacy Labs’ DPDP timeline sets out which rules start on each date.
The Board itself exists in law but had no published appointments as of August 2026. Plan to its deadlines anyway.
How does the DPDP Act treat employee data?
As processing on a legitimate-use basis, for most HR work. Section 7(i) covers processing “for the purposes of employment” or to protect the employer from loss or liability, as Bar & Bench’s analysis of the employment exemption explains.
Payroll, attendance, statutory filings and background verification for a hire sit comfortably inside it. Consent forms are not needed. Duties remain. Section 8 still binds you.
You must keep reasonable security safeguards, report breaches and erase data once its purpose is served, unless another law requires you to keep it. Indian payroll law often does, so map each record to its retention rule.
Here is the trap. Foreign employers assume their GDPR programme already covers India.
Much of it does. Yet the bases differ: the DPDP Act has no general “legitimate interests” ground, and its employment ground may not clearly reach contractors or seconded staff.
Transfers abroad are allowed unless the Centre restricts a country by notification. None had been notified at last check.
Who is the Data Fiduciary when you use an EOR?
Usually the EOR for the records it holds as employer, with you as a possible joint fiduciary where you decide how team data is used. Your HRIS and the EOR’s employee self-service portal both hold personal data, so the contract should say who does what.
Agree on breach roles before 13 May 2027, because the 72-hour clock leaves no time to negotiate. Our guide to the DPDP Act for employers in India covers the full programme.
How does Remunance protect your team’s personal data?
Remunance is ISO/IEC 27001:2022 certified, which you can check on our ISO certifications page, and that controls framework supports the Act’s security safeguard duty. We hold payroll, bank and identity records for 1,200+ employees hired for clients, so access control and retention are daily work for us. To align your contract and breach roles before the 2027 deadline, map your DPDP responsibilities with us.
What else do people ask about the DPDP Act?
Do employers need consent to process employee data under DPDP?
Not for employment purposes under section 7(i). Consent or another basis is still needed for processing outside that, such as marketing to staff.
What is the penalty under the DPDP Act?
Up to ₹250 crore. That cap applies to failing to take reasonable security safeguards. The Schedule also sets up to ₹200 crore for breach notification and children’s data failures, and up to ₹50 crore for other breaches.
Does DPDP apply to foreign companies?
Yes, where they process digital personal data in India, or process it from abroad while offering goods or services to people in India. Employing staff through an Indian EOR keeps most employee processing with an Indian fiduciary.