Under Section 7(i) of the DPDP Act, an employer can process employee personal data without consent for employment purposes, such as payroll, attendance, benefits, and protecting itself from loss or liability (for example preventing corporate espionage or protecting trade secrets). Security, breach reporting, retention limits and grievance duties still apply. Candidate data and optional uses usually need consent.
- Employment purposes
- Legitimate use, no consent needed
- Candidates
- Usually consent or voluntary provision
- Still applies
- Security, breach reporting, retention, rights
What counts as employment purposes
- Hiring formalities, payroll, PF and ESI, tax
- Attendance, leave and performance records
- Benefits and services the employee asks for
- Safeguarding the employer from loss or liability: confidentiality, trade secrets, IP, corporate espionage
What still needs consent or care
- Candidate CVs from job portals or referrals: give a notice and keep only as long as needed.
- Background verification: tell the candidate and use a vendor bound by contract.
- Optional uses: photos on social media, employee data in marketing.
- Monitoring: keep it proportionate and tell staff what is monitored.
- Ex-employees: keep only what laws require (for example tax and labour records) and delete the rest.
Frequently asked questions
Do I need employee consent under the DPDP Act?
Not for employment purposes (Section 7(i)). You do for optional uses unrelated to employment, such as using an employee's photo in marketing.
Can employees ask to delete their data?
They can ask for erasure, but you can keep data that is still needed for the purpose or that a law requires you to retain, such as tax, PF and statutory registers.
More DPDP Act guides
- DPDP Act (DPDPA), 2023: complete guide
- DPDP compliance checklist
- DPDPA 2027 compliance: deadline and roadmap
- Does the DPDP Act apply to my business?
- DPDP Act penalties
- Consent and privacy notice under DPDP
- Data breach reporting under DPDP (72 hours)
- Significant Data Fiduciary (SDF)
- Data Protection Officer (DPO) under DPDP
- Children's data and parental consent
- DPDP Act vs GDPR
- DPDP and marketing (email, WhatsApp, calls)
- Data Principal rights and requests
- Data retention and erasure under DPDP
- Cross-border data transfer under DPDP
- DPDP compliance cost in India
See all deadlines on the compliance calendar, or browse the compliance hub.
This guide is general information based on the law as of 25 October 2026, not legal advice. Rules and dates can change by notification; speak to a professional about your situation.