What Is the DPDP Act — and What Does It Mean for Your Privacy at Work?
Your employer holds a significant amount of personal data about you — your Aadhaar and PAN details, salary and tax records, health and insurance information, performance records, BGV data, and potentially a good deal more gathered across your entire employment lifecycle. Until 2023, there was no comprehensive law specifically governing how that data had to be handled, stored, or disclosed to you.
The Digital Personal Data Protection Act, 2023 — the DPDP Act — changed that. It is India’s first comprehensive data protection legislation and the 19th G20 country to pass such a law. For employees specifically, it creates a set of legally enforceable rights over personal data that simply did not exist before in this form. Here is what you need to know.
What the DPDP Act Actually Is
The DPDP Act received Presidential assent on August 11, 2023, and the implementing rules — the DPDP Rules 2025 — were notified on November 13, 2025. Together they form India’s comprehensive framework for digital personal data protection, broadly comparable in intent to the EU’s GDPR, though with important differences in structure and scope.
Full compliance deadline: May 13, 2027
The law sits directly in the line of succession from the Supreme Court’s landmark 2017 judgment in Justice K.S. Puttaswamy v. Union of India, which recognised privacy as a fundamental right under Article 21 of the Constitution. The DPDP Act is the legislative expression of that constitutional recognition — providing the mechanism to actually enforce it in practice.
Two New Terms You Need to Know
Data Principal
The individual whose personal data is being processed. As an employee, you are a Data Principal in relation to your employer. This is the role that comes with legally enforceable rights under the Act.
Data Fiduciary
The entity that determines the purpose and means of processing personal data. Your employer is a Data Fiduciary. This is the role that comes with legal obligations, including responding to your rights requests and notifying you of data breaches.
The Two Lawful Bases for Processing Your Data
Unlike the EU’s GDPR which provides six different lawful grounds for data processing, the DPDP Act operates on just two. Understanding this distinction matters because it determines which of your rights apply.
Consent
Free, specific, informed, unconditional and unambiguous — given through a clear affirmative action. Where an employer processes data on this basis, you have the full set of rights including access, correction, erasure, and withdrawal.
Legitimate Use (Section 7)
A defined list of situations where consent is not required. Critically, Section 7(i) covers processing “for purposes of employment” — meaning your employer doesn’t need separate consent for routine employment data like payroll and HR records. However, this exemption is not unlimited.
Your Five Rights as an Employee Under the DPDP Act
These are the legally enforceable rights the Act gives you as a Data Principal. They are new — employees in India have not had these specific rights before in statutory form.
Right to Information Access
You can ask your employer what personal data they hold about you, what it is being processed for, and which third parties it has been shared with — including background verification agencies, payroll processors, insurance providers, and any other parties. The employer must respond within 30 days.
Right to Correction and Erasure
You can request correction of inaccurate or outdated personal data — useful if your employer’s HR records have wrong address, contact, or qualification details. You can also request erasure of data that is no longer needed for the purpose it was collected for, subject to statutory retention requirements.
Right to Grievance Redressal
Every Data Fiduciary must appoint a Grievance Officer and publish their contact details. If you have a concern about how your data is being handled, you can raise a formal grievance — and if the company does not respond satisfactorily, you can escalate to the Data Protection Board of India.
Right to Withdraw Consent
Where your employer is processing data based on your consent (rather than the Section 7 legitimate use provision), you can withdraw that consent. The employer must cease processing within a reasonable time after withdrawal.
Right to Nominate
A unique feature of the DPDP Act — you can designate a trusted person to exercise your data rights on your behalf in the event of your death or incapacity. This is not found in the same form in most other global data protection frameworks including the GDPR.
What the DPDP Act Means Specifically During Employment
Several of the Act’s provisions have direct, practical implications for the employer-employee relationship at every stage.
| Stage | What the DPDP Act Requires |
|---|---|
| Recruitment and onboarding | Employers must state what data is being collected, for what purpose, and who it is shared with — background verification agencies, medical check providers, etc. |
| During employment | Data must be limited to what is actually necessary for the employment purpose. Monitoring must be disclosed and proportionate. Data shared with third parties (payroll processors, insurers) must be covered by proper data processing agreements. |
| Workplace surveillance | Monitoring data qualifies as personal data. Covert, continuous, or disproportionate surveillance increasingly conflicts with the Act’s purpose limitation and data minimisation principles. |
| After you leave | Employers cannot retain your personal data indefinitely after your employment ends. Once the purpose for retention no longer applies — with the exception of statutory requirements like PF, tax records, and gratuity — data should be erased. Former employees can request erasure of non-mandatory HR records. |
What the DPDP Act Does NOT Give You
Being clear about what the Act doesn’t include is as important as understanding what it does.
Data portability
You cannot demand your personal data in a portable, machine-readable format for transfer elsewhere. The GDPR has this; the DPDP Act deliberately does not.
Right to restrict processing
You cannot instruct your employer to pause processing of your data while a dispute is pending — again, unlike GDPR.
Right to sue the employer directly
If your data is mishandled, your path is to the Data Protection Board of India — not a direct private lawsuit against your employer. The DPBI can award penalties, but there is no private right of action.
A full “right to be forgotten”
The erasure right is narrower than the GDPR’s right to be forgotten. It applies to data that is no longer necessary for its stated purpose — not a blanket right to demand all records be deleted on request.
Where the Rollout Currently Stands
Data Protection Board of India
The oversight and complaints body is operational. You can file a grievance with your employer’s Grievance Officer now, and escalate to the DPBI if unresolved.
Consent Manager Framework
Third-party intermediaries managing consent on behalf of individuals become operational, making consent management more structured and verifiable.
All obligations enforceable
Notice requirements, individual rights handling, breach notification processes, and all other DPDP obligations must be fully operational. Penalties up to ₹250 crore apply for serious violations.
The build year
Employers are expected to be building compliance now. The direction of the law is unambiguous even before May 2027 — transparency, proportionality, and documented purpose for every data processing activity.
“For the first time in India, employees have specific, statutory rights over what their employer knows about them, how long it can be kept, and who it can be shared with. These rights are new. Understanding them is how you use them.”
WorkRightsIndiaFrequently Asked Questions
What to Do Right Now
- Find your employer’s Grievance Officer details — they must be published on the company’s website or privacy policy. Note them down before you ever need them.
- Check what monitoring disclosures are in your employment contract or IT policy — the DPDP Act’s transparency requirements mean these should exist; understanding them tells you what your employer considers disclosed.
- If you have left a job recently, consider whether there is data held about you by that former employer that you want corrected or — where it is not statutorily mandated — erased.
The One Line to Remember
The DPDP Act gives every employee in India statutory rights over their personal data for the first time. Your employer can still process what they need to — but they now have to tell you what they’re processing, why, and for how long. And you can ask, correct, and in some cases erase it.
This article is for informational purposes only and does not constitute legal advice. The DPDP Act 2023 and DPDP Rules 2025 are being implemented in phases; rules, guidance, and enforcement timelines may evolve. For advice specific to your situation, consult a qualified lawyer or data protection professional. Information in this article is current as of July 2026.