Skip to main content

Q1 - How does DPDPA apply to employee data?

Answer

The Digital Personal Data Protection Act, 2023 (DPDPA) allows employers to process personal data for employment-related purposes under Section 7(i) — but this permission is not unlimited. Any monitoring or surveillance activity must still comply with the Act’s core principles of lawful purpose, necessity, and proportionality.

In simple terms, employers can collect or monitor data only when it is genuinely needed for work, safety, or compliance — not for unnecessary or invasive tracking.

1. What Counts as Legitimate Monitoring​

Employers may monitor employee activity when it is directly connected to a legitimate business function, such as:

  • Ensuring productivity or security in high-sensitivity environments.
  • Detecting data leaks, insider threats, or misuse of confidential systems.
  • Complying with legal or regulatory obligations (e.g., maintaining audit logs, preventing fraud).

However, even in these cases, data collection must be limited to what is necessary, and employees should be informed transparently about the nature and extent of monitoring.

Example

A financial firm records employee access to client databases to prevent insider trading.
Since this is security-related and legally necessary, it qualifies as a legitimate business purpose under DPDPA.

2. When Monitoring Becomes a Violation​

Problems arise when organizations extend surveillance beyond what’s reasonable or relevant to work. DPDPA discourages disproportionate tracking or constant surveillance that violates privacy rights — especially when consent is not meaningful due to the employer–employee power imbalance.

Some examples of potentially non-compliant practices include:

  • Work-hour tracking tools that log every keyboard stroke, mouse movement, or idle time — even when unrelated to performance evaluation.
  • GPS tracking of employees' personal devices or vehicles outside working hours.
  • CCTV or camera surveillance in non-sensitive areas such as cafeterias or restrooms.
  • Email or chat monitoring used to profile personal behavior or private conversations instead of addressing work-related misconduct.
  • AI-based productivity scoring systems that collect biometric or behavioral data without clear business justification.

Such activities may violate DPDPA’s principles of:

  • Purpose limitation – data used beyond the stated purpose;
  • Data minimization – collecting more than necessary;
  • Lawfulness and fairness – intrusive tracking without proportional need.
Example

If an organization installs software that records employee screen activity, webcam feed, or keystrokes to measure “engagement,” this can be considered excessive surveillance and a violation of Section 8(5) (security and fairness obligations) — even if the data was initially collected during employment.

3. Best Practices for Employers​

To remain compliant:

  1. Define a clear purpose for any monitoring activity (e.g., fraud prevention, attendance tracking).
  2. Inform employees through internal privacy notices and policies.
  3. Limit data collection to what is truly required for that purpose.
  4. Avoid tracking outside work hours or in private spaces.
  5. Regularly review monitoring tools for proportionality and fairness.
  6. Delete or anonymize monitoring data after it has served its purpose.

4. Key Takeaway​

DPDPA does not forbid employee monitoring — but it strictly limits it to lawful and necessary purposes. Excessive or intrusive tracking (like full-time webcam surveillance, location logging, or keystroke tracking) can expose the organization to privacy complaints and penalties under Section 33, up to ₹250 crore.

Referenced Provisions:

  • Section 7(i) – Legitimate use for employment and employer protection.
  • Section 8(4–5) – Obligations of Data Fiduciaries to ensure fair, necessary, and secure processing.
  • Section 33(1) – Penalties for violations of DPDPA obligations.