DPDP Guide · Employee data

Section 7(i) of the DPDP Act: what employers can and cannot do with employee data

A guide for HR, legal and IT teams. It sets out what the employment clause permits, which duties still apply when you rely on it, and where the Act says nothing. The Act and Rules are quoted. Commentary is kept apart and labelled.

Reviewed by Team DPDP Act India · 3 November 2026 · Cited to the Gazette of India · Editorial policy

In short

Section 7(i) lets an employer process an employee’s personal data without consent for the purposes of employment and for safeguarding the employer from loss or liability. The clause also mentions a service or benefit the employee asked for. It does not switch off the security, breach, contract and grievance duties in section 8 and the Rules.

The Act does not mention monitoring tools, CCTV or biometrics anywhere. Sections 7 and 8 begin on 13 May 2027, computed from the Gazette notices.

Now · since 13 Nov 2025

Definitions live

The Act’s definitions and the Board’s establishment are in force. Section 7 is not.

Next · 13 Nov 2026

Consent Managers

Rule 4 and section 6(9) start. They do not change section 7 or 8.

Then · 13 May 2027

Sections 7 and 8 start

The employment ground and the section 8 duties begin to apply.

Status · as of 3 November 2026

Nothing in this guide binds an employer yet. Sections 7 and 8 begin on 13 May 2027.

Date basis: 13 May 2027 is computed from the Gazette notices of 13 November 2025, which do not print the calendar date. Some commentary says 14 May. We follow the Gazette masthead.
We found no official guidance on employee data from MeitY, the Data Protection Board or Parliament.
We found no country notified under section 16 and no Rule 15 order. That finding rests on secondary sources.
The Removal of Difficulties Order of 5 October 2026 is reported to change only sections 9(1) and 10(2)(c)(ii), not sections 7 or 8. We relied on reports and did not open the Gazette copy.

Take the readiness assessment What still applies

What section 7(i) says

Section 7 lists the “certain legitimate uses” that section 4(1) allows as an alternative to consent. Clause (i) is the one written for employers.

The law

Section 7(i): “for the purposes of employment or those related to safeguarding the employer from loss or liability, such as prevention of corporate espionage, maintenance of confidentiality of trade secrets, intellectual property, classified information or provision of any service or benefit sought by a Data Principal who is an employee.”

Select a box to jump to its section. The three boxes on the left are the purposes the clause names. The three on the right are what sits around it.

The clause, part by part

Part of the clause	What it covers	What the text leaves open
“for the purposes of employment”	Processing for the purposes of employment, as the clause says.	The Act does not define “employment” or “employee”.
“safeguarding the employer from loss or liability, such as…”	Examples given: prevention of corporate espionage, confidentiality of trade secrets, intellectual property and classified information.	“Such as” introduces examples. The text does not say whether the list is closed.
“provision of any service or benefit sought by a Data Principal who is an employee”	A service or benefit the employee asked for.	It follows “such as” in the sentence. Commentators treat it as a separate purpose. Whether it is a third limb is a question for a lawyer.

Source: Digital Personal Data Protection Act, 2023, section 7(i). Section 4(1) allows processing either with consent or for certain legitimate uses, and section 7 opens “for any of following uses”.

Practice

Do not confuse it with 7(a). Clause (a) is a different ground. It covers data the person voluntarily provided for a specified purpose. As practice, not law, keep a record of which ground you rely on for each activity.

Does section 7(i) cover what you are doing?

Answer three questions for each activity. This is a way to organise your thinking, not a legal test.

Is the person a current employee? If not (a candidate, contractor, consultant or intern), the Act does not define “employee” and says nothing about these groups. Commentators disagree, so treat it as open and read the table on silent areas. If yes, go to question 2.
Is the purpose one the clause names: employment, protecting the employer from loss or liability, or a benefit the employee asked for? If not, the clause as worded does not name this purpose, and another ground under section 4(1) would be needed: consent under section 6, or another clause of section 7. If yes, section 7(i) is available as the ground.
Have you covered the section 8 duties for this data? If not, these are the duties to look at first. The section 8 duties apply to a Data Fiduciary that relies on 7(i). If yes, record the activity, the purpose and the ground in your register.

Our reading

An activity that stretches the purpose, for example a tool bought to prevent leaks that starts producing productivity reports, is no longer clearly inside the clause. The Act does not say this in terms. It is how we would apply the words “for the purposes of”.

What still applies when you rely on 7(i)

Relying on section 7(i) removes the need for consent. It does not remove the rest of the Act. The section 8 duties apply to a Data Fiduciary that relies on 7(i).

Provision	What it asks of an employer	Note
Section 8(1)	Stay responsible for complying with the Act, including for processing done by a Data Processor on your behalf, “irrespective of any agreement to the contrary”.	Payroll, HRMS and background-check vendors do not take the responsibility over.
Section 8(2)	Engage a Data Processor only under a valid contract.	The sub-section is worded around offering goods or services to Data Principals. Whether it reaches HR and payroll vendors is a question for a lawyer. A written contract is sensible either way.
Section 8(3)	Where data is likely to be used for a decision that affects the employee, or is disclosed to another Data Fiduciary, ensure it is complete, accurate and consistent.	Think of appraisals, promotions and disciplinary records.
Sections 8(4), 8(5) and Rule 6	Technical and organisational measures and reasonable security safeguards. Rule 6(1) sets minimums: encryption, masking or tokens, access control, logs and monitoring, backups, and processor contract terms. Rule 6(1)(e) requires logs and personal data to be kept for one year unless another law requires otherwise.	The highest penalty ceiling in the Schedule, Rs 250 crore, sits on section 8(5).
Section 8(6) and Rule 7	Tell each affected employee without delay. Tell the Board without delay, then send a detailed report within 72 hours, or longer if the Board allows in writing.	The ceiling for failing this duty is Rs 200 crore.
Section 8(7), Rule 8(3)	Erase when it is reasonable to assume the specified purpose is no longer served, unless a law requires retention. Rule 8(3) sets a one-year minimum for personal data, traffic data and logs, for the purposes in the Seventh Schedule.	The Act ties “specified purpose” to a notice. No provision imposes a notice duty on 7(i) processing, though law firms disagree. How erasure applies to 7(i) data is an open question for a lawyer.
Section 8(9) and Rule 9	Publish prominently on your website or app the business contact of a Data Protection Officer, if you have one, or of a person who can answer questions about processing. Repeat it in every reply to a rights request.	Only a notified Significant Data Fiduciary must appoint a DPO. Everyone else names a contact.
Sections 8(10), 13 and Rule 14	Run an effective grievance mechanism. Publish how to make requests and the time you take to reply, which may not exceed 90 days.	Section 13 covers any act or omission of the Data Fiduciary and has no consent qualifier.

Penalties apply only after the Data Protection Board finds a significant breach following an inquiry and a hearing (section 33(1)). Ceilings: Rs 250 crore for section 8(5), Rs 200 crore for section 8(6), Rs 50 crore for any other provision. Sources: Act sections 8 and 33 and the Schedule; Rules 6, 7, 8, 9 and 14.

Risk

The most expensive misreading is treating section 7(i) as an exemption from the Act. It is a ground for processing, not an exemption. A failure of the section 8(5) safeguards carries a ceiling of Rs 250 crore, whatever ground you rely on.

Employee rights: what the text says

The rights in sections 11 and 12 are written around consent. Section 13 is not. Read the words the Act uses before you promise employees a process.

Right	What the text says	For processing that rests only on 7(i)
Information about your data (section 11)	The right runs against a Data Fiduciary “to whom she has previously given consent, including consent as referred to in clause (a) of section 7”.	The wording does not name clause (i), so on the text the right does not clearly reach 7(i)-only processing. A lawyer should confirm.
Correction, completion, updating and erasure (section 12)	Applies to data “for the processing of which she has previously given consent, including consent as referred to in clause (a) of section 7”.	Same reading: clause (i) is not named.
Withdraw consent (section 6(4))	Applies “where consent given by the Data Principal is the basis of processing”.	Not applicable to 7(i). It applies to anything you do on consent.
Grievance redressal (section 13)	Covers “any act or omission” of the Data Fiduciary. The employee must use this route before going to the Board (section 13(3)).	Applies: the text has no consent qualifier.
Nominate another person (section 14)	Lets a Data Principal nominate someone to exercise rights on death or incapacity. The text has no consent qualifier.	Applies on the text.

Practice

Practice, not law: many employers will answer employee requests for their own records anyway, for good relations and because a refused request can become a section 13 grievance. That is a business choice. As we read the wording above, the Act does not require it for 7(i)-only data.

Where the Act is silent

The Act does not mention monitoring tools, CCTV, biometrics, background checks, job applicants or contractors. Everything below that goes beyond the clause is interpretation.

Topic	Does the Act text address it?	What commentators say (not law)
Job candidates not hired	No. Clause (i) speaks of employment and of “a Data Principal who is an employee”.	Views split. Some say candidate data sits mostly outside 7(i). Others see room for basic checks.
Contractors, consultants, gig workers	No. “Employee” is not defined.	Views split. Some read the clause widely. Others point to clause (a) or call it a separate question.
Background verification	No.	Published views conflict, even within single pages. Some say consent is needed. Others list it under 7(i).
Biometric attendance and CCTV	No.	Commentary on this topic was not reviewed. Treat it as a case for your counsel.
Email, browsing and screen monitoring	No.	Commentators disagree on notice. Section 5(1) ties the notice duty to consent requests under section 6. Some say a notice is still needed, others say 7(i) triggers none.
Productivity software	No.	Commentary on this topic was not reviewed.
Data after an employee leaves	No employment-specific rule. The general rules apply: section 8(7), Rule 8(3) and Rule 6(1)(e).	Some read “purposes of employment” as ending with the relationship. Others do not.
A foreign parent company	Partly. Section 16 and Rule 15 on transfers begin 13 May 2027. As of 3 November 2026 we found no country notified and no Rule 15 order. That finding rests on secondary sources.	The Act does not address whether sharing for the parent’s own purposes stays inside 7(i).
Payroll and HRMS vendors	Partly. Sections 8(1), 8(2), 8(5) and 8(7), and Rule 6(1)(f) on processor contract terms.	No separate commentary noted. Section 8(1) is the rule.

Commentary comes from law-firm and vendor articles, which we treat as context only. None of it is official guidance. As of 3 November 2026 we found no MeitY, Data Protection Board or parliamentary statement on employee data.

Employee monitoring tools: a review list

The Act says nothing about monitoring tools, so no checklist can be called a legal requirement. This list is practice that keeps you inside the clause and the section 8 duties.

Write one line of purpose for each tool, and match it to a part of the clause.
List what each tool captures (screenshots, browsing logs, location, biometrics) and who can see it.
Check whether it captures more than the purpose needs, for example personal banking or health pages.
Set a retention period and record it. Know the vendor’s default.
Check the vendor contract against Rule 6(1)(f) (processor contract terms) and section 8(7) (processor erasure).
Ask whether data goes to a parent company or vendor abroad, and who can see it there.
Review the list whenever an HR or monitoring tool is added, because purposes drift.
Tell employees what is collected and why. The Act does not clearly require a notice for 7(i), but clear information supports trust and grievance handling.

Practice

Monitoring tools produce logs. From 13 May 2027 Rule 6(1)(e) asks you to keep logs and the personal data for a year unless another law requires otherwise, and Rule 8(3) sets a one-year minimum for the Seventh Schedule purposes. Consider how this sits with any shorter or longer period you apply today.

Key dates for employers

Until 13 May 2027, section 7(i) is not in force. Three dates matter, and only the last one starts the employment ground.

Provision	Commences	What it means
Sections 1(2), 2, 18 to 26, 35, 38 to 43, 44(1) and 44(3); Rules 1, 2 and 17 to 21	13 November 2025	In force. Definitions, the Board’s establishment and general provisions.
Section 6(9), section 27(1)(d) and Rule 4	13 November 2026	Consent Manager registration. Nothing here changes section 7 or 8.
Sections 3 to 5, 6(1) to (8) and (10), 7 to 17, 27 except (d), 28 to 34, 36, 37 and 44(2); Rules 3, 5 to 16, 22 and 23	13 May 2027	Section 7(i), the section 8 duties and the matching Rules begin.

The law

Dates are counted from the Gazette notices dated 13 November 2025: G.S.R. 843(E) for the Act and G.S.R. 846(E) for the Rules. They do not print the calendar date for the later phases, so 13 May 2027 is computed. Section 44(2) omits section 43A of the IT Act and clause 87(2)(ob) from that date. The Act does not name the SPDI Rules, 2011, and whether they lapse is a legal question the text does not answer.

Claims about employee data that the text does not support

Some statements about employee data travel from article to article. Here is how they compare with the official text.

Common claim	What the text says
Employers always need employee consent.	The Act gives two routes: consent, or a certain legitimate use (section 4(1)). Clause (i) of section 7 is a legitimate use that needs no consent.
Section 7(i) lists attendance checks and performance reviews.	It does not. The clause names employment purposes, safeguarding the employer from loss or liability, and a service or benefit the employee asked for.
Consent is mandatory for background checks and CCTV.	The Act mentions neither. Whether a legitimate use or consent applies depends on the purpose.
Data on candidates who are not hired must be deleted within 180 days.	No such period appears in the Act or the Rules. Rule 8(1) and the Third Schedule cover only three large platform classes, and Rule 8(3) sets a one-year minimum retention for specified purposes.
A written data processing agreement is mandatory.	Section 8(2) requires a valid contract. It does not use the words “written agreement”. A written contract is still sensible.
Employee monitoring needs a data protection impact assessment.	A DPIA and an independent audit are duties of notified Significant Data Fiduciaries (section 10, Rule 13). The Act has no separate “sensitive personal data” category.
The SPDI Rules are repealed.	Section 44(2) omits section 43A and clause 87(2)(ob) of the IT Act from 13 May 2027. It does not name the SPDI Rules.
Employees can demand deletion of any of their data.	Section 12 is written around data processed on consent, including under clause (a) of section 7. It does not name clause (i). Section 8(7) is a separate erasure duty on the employer.

What remains unresolved

These points are not settled by the text. Take legal advice before relying on any reading of them.

Does section 7(i) cover job applicants, rejected candidates, interns, contractors, consultants and gig workers?
Is “service or benefit sought” a third limb, or one of the “such as” examples?
Since “specified purpose” is tied to a notice and 7(i) needs none, how does the section 8(7) erasure duty apply to 7(i) data?
Does section 8(2), worded around “offering of goods or services”, require a contract with HR and payroll processors?
How do the one-year periods in Rules 6(1)(e) and 8(3) interact with any other log-retention rule you follow?
What happens to claims and compliance under the SPDI Rules once section 44(2) takes effect?
Does disclosure to a foreign parent company for its own purposes stay within section 7(i)?

Employee data under the DPDP Act: frequently asked questions

Does the DPDP Act apply to employee data?

Yes. Employee data is digital personal data, and an employer that decides why and how it is processed is a Data Fiduciary. The Act applies to digital personal data processed in India (section 3). The processing duties begin on 13 May 2027.

Do employers need employee consent under the DPDP Act?

Not for every activity. Section 4(1) allows processing with consent or for a certain legitimate use. Section 7(i) covers employment purposes and safeguarding the employer from loss or liability without consent. An activity outside the clause needs another ground, such as consent under section 6.

Can employers monitor email, devices or screens?

The Act neither mentions nor bans monitoring. Whether a particular tool fits section 7(i) depends on its purpose and on what it captures. The section 8 duties on security, vendors, breach and grievances apply either way. Take legal advice for your own tools.

Does section 7(i) cover job candidates who are not hired?

The Act does not say. The clause refers to employment and to a Data Principal who is an employee, and “employee” is not defined. Commentators disagree. As practice, not law, consider giving candidates a clear notice and relying on consent, and take advice on checks.

Is consent needed for background verification?

The Act does not mention background verification. Published views conflict. Some say consent is needed and others place it under section 7(i). Treat it as an open point and record the ground you choose.

Can employees ask an employer to delete or correct their data?

Sections 11 and 12 are written around data processed on consent, including under clause (a) of section 7. They do not name clause (i). Section 13 lets any Data Principal complain about any act or omission, and the employer still has the section 8(7) erasure duty. A lawyer should confirm how these fit together.

Do payroll and HRMS vendors need a contract?

You stay responsible for processing done on your behalf (section 8(1)). Section 8(2) requires a valid contract with a Data Processor, and Rule 6(1)(f) lists security terms to include. The wording of section 8(2) is built around offering goods or services, so whether it reaches HR vendors is a lawyer question. A written contract is sensible regardless.

Can employee data be sent to a parent company abroad?

Transfers are allowed subject to section 16 and Rule 15, which begin on 13 May 2027. As of 3 November 2026 we found no restricted country and no Rule 15 order. Section 16(2) keeps stricter laws. Whether sharing for the parent company’s own purposes stays within section 7(i) is unsettled.

Not sure which ground fits your HR processes?

Take the free readiness assessment to see where your data handling stands, or talk to an implementation partner.

Readiness assessment Find an implementation partner

Primary sources

Digital Personal Data Protection Act, 2023: sections 2 to 8, 10 to 14, 16, 17, 27, 28, 33, 38 and 44 and the Schedule. Gazette of India. Official text (MeitY)
Digital Personal Data Protection Rules, 2025, G.S.R. 846(E), 13 November 2025: Rules 1, 3, 4, 6, 7, 8, 9, 13, 14 and 15. Gazette of India. Official text (MeitY)
Commencement notification G.S.R. 843(E), 13 November 2025. Gazette of India. Official text (MeitY)
Removal of Difficulties Order, S.O. 5458(E), 5 October 2026, and corrigendum G.S.R. 892(E), 10 December 2025. Gazette of India. We relied on reports of both and did not open the Gazette copies.

Last reviewed: 3 November 2026. Section numbers, rule numbers, dates and quoted words were read from the Gazette text. Law-firm and vendor commentary was read for context and is never the source of a legal claim. This is general information about the DPDP Act and Rules, not legal advice, and is not affiliated with any government body. See our editorial policy.

The DPDP Act, explained

Find your sector

Not sure where to start?

Where do you stand?

Section 7(i) of the DPDP Act: what employers can and cannot do with employee data

What section 7(i) says

The clause, part by part

Does section 7(i) cover what you are doing?

What still applies when you rely on 7(i)

Employee rights: what the text says

Where the Act is silent

Employee monitoring tools: a review list

Key dates for employers

Claims about employee data that the text does not support

What remains unresolved

Employee data under the DPDP Act: frequently asked questions

Not sure which ground fits your HR processes?

Primary sources

Talk to a DPDP consultant

What section 7(i) says

The clause, part by part

Does section 7(i) cover what you are doing?

What still applies when you rely on 7(i)

Employee rights: what the text says

Where the Act is silent

Employee monitoring tools: a review list

Key dates for employers

Claims about employee data that the text does not support

What remains unresolved

Employee data under the DPDP Act: frequently asked questions

Related DPDP Act resources

Not sure which ground fits your HR processes?

Primary sources

The DPDP Action Brief