Readiness assessment
The Act
The DPDP Act, explainedThe DPDP Rules 2025

Ch IPreliminary

S.1 Short title and commencementS.2 DefinitionsS.3 Application and scope

Ch IIObligations of Data Fiduciary

S.4 Grounds for processingS.5 NoticeS.6 ConsentS.7 Certain legitimate usesS.8 Data Fiduciary obligationsS.9 Children’s dataS.10 Significant Data Fiduciary

Ch IIIRights and duties of Data Principal

S.11 Right to accessS.12 Correction and erasureS.13 Grievance redressalS.14 Right to nominateS.15 Duties of the Data Principal

Ch IVSpecial provisions

S.16 Transfer outside IndiaS.17 Exemptions

Ch VData Protection Board of India

S.18 Establishment of the BoardS.19 Composition of the BoardS.20 Salary and term of officeS.21 DisqualificationsS.22 Resignation and vacanciesS.23 Proceedings of the BoardS.24 Officers and employeesS.25 Members as public servantsS.26 Powers of the Chairperson

Ch VIBoard powers and procedure

S.27 Powers and functions of the BoardS.28 Procedure followed by the Board

Ch VIIAppeal and dispute resolution

S.29 Appeal to the Appellate TribunalS.30 Tribunal orders as a decreeS.31 Alternate dispute resolutionS.32 Voluntary undertaking

Ch VIIIPenalties

S.33 Penalties and the ScheduleS.34 Penalties to Consolidated Fund

Ch IXMiscellaneous

S.35 Good-faith protectionS.36 Power to call for informationS.37 Blocking of accessS.38 Consistency with other lawsS.39 Bar of jurisdictionS.40 Power to make rulesS.41 Laying of rules before ParliamentS.42 Power to amend the ScheduleS.43 Power to remove difficultiesS.44 Amendments to other Acts
Industries
Fintech & BFSIPayments & UPIUPIWalletsLendingBNPLLSPsKYCVideo-KYCAadhaar eKYCWealthtechInsurTechHealth insuranceDebt collectionsBanksNBFCsNGOsHealthcare & PharmaHospitalsDiagnostic labsGenetic testingPharmaClinical trialsTelemedicineE-commerce & RetailD2CMarketplacesLogisticsLoyalty & CRMGCCsSaaS & TechnologyAI & MLFoundation modelsB2B SaaSCloudDeveloper toolsEdTech & EducationSchoolsCoachingLMSProctoringChildren-directed appsGovernment & PSUe-GovernancePublic servicesUtilitiesManufacturingAutomotiveDealersIndustrialIoTMedia & EntertainmentAdTechGamingOTTPublishingSocial mediaBrowse all sectors
Implementation
All 17 DPDP servicesFintech & digital lendingGCC & global centresDPDP Compliance AssessmentFind where you stand and your gapsDPDP ImplementationTurn the rules into daily practiceData MappingKnow what data you hold, and whereRoPAYour record of processing activitiesPrivacy AuditIndependent check of your controlsDPO ServicesOutsourced or part-time DPOSDF ReadinessCheck for extra SDF dutiesConsent ManagementCapture, track and withdraw consentNotice & Consent RemediationFix notices and consent flowsData Principal RightsHandle access, correction, erasureRetention & DeletionWhat to keep, how long, how to deleteVendor & Processor ManagementControl third parties handling dataChildren's DataRules for handling minors' dataSecurity SafeguardsTechnical and organisational controlsBreach ResponseWhat to do when a breach happensPrivacy Operations SupportKeep the programme runningDPDP TrainingTrain staff, legal and leaders
Training
All DPDP Act trainingEmployee awarenessCorporate trainingLeadership briefingDPO and certification
Resources
Readiness assessmentGuidesBy roleGlossaryCompareNews
About
AboutEditorial policyContactFAQ
Readiness assessment

DPDP Act by role

DPDP Act for HR and People Teams

Employee and candidate data is personal data. Here is what the DPDP Act changes for how your people team handles it.

Understand. Check. Connect.

We match you with the right DPDP implementation partner, only when you ask.

Free readiness checkGet the toolkit

At a glance

HR and people teams handle large volumes of employee, candidate and contractor personal data, all covered by the DPDP Act. The priorities are to give staff and applicants a clear notice, handle the consent-versus-employment basis correctly, manage retention of HR records, respond to employee data requests, and put DPDP Act terms in contracts with payroll, background-check and benefits vendors.

What the DPDP Act means for you

People teams sit on some of the most sensitive personal data an organisation holds: identity, financial, background and performance information. The DPDP Act applies to all of it. The work is mostly about clear notices to staff and candidates, sensible retention, and making sure your HR vendors are contractually bound to protect the data you share with them.

Your priorities

Notices to staff and candidates

Tell employees and applicants what you collect and why, in plain language.

Retention of HR records

Set and follow retention periods for applications, payroll and personnel files.

Employee data requests

Be ready to handle access, correction and grievance requests from your own people.

Vendor contracts

Bind payroll, background-check and benefits providers with DPDP Act processor terms.

Where to start

Map employee data

List the personal data you hold across the employee lifecycle.

Issue notices

Give staff and candidates a clear privacy notice.

Set retention

Define how long you keep each HR record, then delete on schedule.

Fix vendor contracts

Add DPDP Act processor clauses to your HR vendors.

Tools and help

Move fast with ready-made resources, or get expert help where it matters:

Compliance ToolkitFree readiness assessmentServices and partnersGuides

Frequently asked questions

Do we need consent to process employee data?
Not always. Some employment processing relies on other legitimate bases, but you still owe employees a clear notice, and any consent-based processing must be handled properly.
How long can we keep candidate data?
Only as long as needed for the role or a defined talent-pool period, then delete it, unless a law requires longer retention.
Are background-check vendors our responsibility?
Yes. As the Data Fiduciary you remain responsible, so bind them with a processor contract and confirm their safeguards.

See where you stand

Take the free readiness assessment for a picture tailored to your organisation, then choose a tool or a partner.

Start free readiness assessmentSee the Compliance Toolkit

This page is educational and not legal advice. Confirm against the enacted Act and the DPDP Rules, or take professional advice. dpdpactindia.in is an independent resource and is not affiliated with the Government of India.