Sector guide · HR and recruitment
DPDP Act for HR and recruitment
By Suryansh Sagar, founder of Gevox. Last updated 3 October 2026.
Section 7(i) lets an employer process employee data for employment purposes and to safeguard itself from loss without consent. That ground covers payroll, attendance and access control. It does not cover keeping a rejected candidate’s CV for years, sharing staff data with a benefits vendor without a contract, or monitoring that goes beyond the purpose.
The employment ground and its edges
Section 7(i) permits processing for the purposes of employment or for safeguarding the employer from loss or liability, such as preventing corporate espionage, maintaining confidentiality, and providing a service or benefit sought by the employee. It removes the consent requirement for that processing; it does not remove the notice, security, breach, erasure or grievance duties.
Background verification, health checks and monitoring have to fit inside the purpose. Monitoring that extends to personal devices or personal accounts is hard to fit inside it.
Candidates are not employees
A CV submitted for a role is data provided voluntarily for that purpose, a Section 7(a) ground. Once the role is filled, the purpose is served and Section 8(7) requires erasure unless the candidate consents to being kept on file for future roles. A talent pool built from old applications without that consent has no ground.
The HR vendor chain
Payroll software, the HRMS, the background-check agency, the insurer, the learning platform and the applicant tracking system all process employee data on the employer’s behalf. Each needs a Section 8(2) contract, and Rule 6(1)(f) requires the contract to bind them to the security safeguards.
Rights requests will come from staff
Section 11 gives every employee the right to a summary of their data and the processing, and to know who it has been shared with. Section 12 gives correction and erasure. Rule 14 requires the means of making a request to be published and a response within the period the employer states, at most ninety days.
First five actions
- Write an employee notice under Rule 3 that names the employment purposes and the vendors.
- Set a candidate retention period and delete on it.
- Put Section 8(2) contracts in place with every HR vendor.
- Define what monitoring is for, and stop anything outside it.
- Publish the rights request route and the Section 8(9) contact on the intranet and in the offer letter.
Questions people ask
- Do we need employee consent for payroll?
- No. Section 7(i) covers processing for employment purposes. You still owe a notice, security safeguards and the other Section 8 duties.
- How long can we keep a rejected candidate’s CV?
- Until the purpose is served, which is when the role closes, unless the candidate agrees to be kept for future roles. Section 8(7) then requires erasure.
- Can employees ask what data we hold on them?
- Yes, under Section 11, and Rule 14 requires you to publish how they do it and to answer within your stated period, at most ninety days.
Read next
The DPDP brief
One email a month. What moved in the Act, and what our scans found.
Every claim cited to its section, the same way these pages are. No product news, no roundups of other people’s blogs.