Employee Data and CCTV Under the DPDP Act: A Guide for Small Employers

Do I need my employees’ consent under the DPDP Act?

Generally not, for employment purposes. Section 7 lists legitimate uses for which a Data Fiduciary may process personal data without consent, and one of them is processing for the purposes of employment or for safeguarding the employer from loss or liability, such as preventing corporate espionage or protecting confidential information.

Payroll, statutory deductions, PF and ESI filings, attendance, leave, performance reviews and access control all fit within that purpose. Using the same data for something unrelated, such as marketing an employee’s family a product or sharing it with a lender for a cross-sell, does not.

Telling employees how their data is used is still good practice and reduces disputes. A short employee privacy notice in the onboarding pack, covering what you hold, why, who it is shared with and how long you keep it, costs little and answers most questions before they are asked.

What duties still apply to employee data?

Section 8(5) requires reasonable security safeguards, which Rule 6 describes as measures such as encryption or masking, access control, logs and backups. Payroll spreadsheets on shared drives, KYC copies in personal email and HR files in an unlocked cabinet that is later scanned are the usual weak points.

Section 8(6) and Rule 7 require a personal data breach to be intimated to affected individuals and to the Data Protection Board. A lost laptop with an unencrypted salary file is a breach that triggers these duties, even if no one outside the business ever sees the data.

Section 8(7) requires erasure once the purpose is served, unless retention is necessary for compliance with law. The grievance and contact duties also apply: employees should know whom to ask about their data.

How should CCTV be handled?

CCTV recordings of identifiable people are digital personal data. Footage recorded for the security of premises and staff fits the employer’s legitimate use, and footage of customers in a shop or clinic is usually collected for the same security purpose.

Display clear signage that recording is in progress and why. Restrict who can view, copy or export footage, keep the recorder in a secure place and log any export. Avoid cameras in places where people reasonably expect privacy, such as washrooms or changing areas.

Set a retention period, typically a few weeks, after which footage is overwritten unless it is needed for an incident, complaint or legal matter. Do not reuse footage for unrelated purposes such as marketing or monitoring personal behaviour outside work.

How long should payroll and HR records be kept?

Retention is driven by the laws that require the records, not by DPDP alone. Books of account and supporting vouchers under the Companies Act are generally kept for eight years, GST records until 72 months after the due date of the relevant annual return, and income-tax, PF, ESI and labour-law records for the periods those laws and assessments require.

The DPDP Act allows retention needed for compliance with law, so keeping a salary register for its statutory period is permitted. Keeping copies of every former employee’s Aadhaar, bank statement and personal documents indefinitely is not.

A retention schedule that lists each HR data set, the law that governs it and the period after which it is deleted resolves this. It is one of the areas where a CA adds most value, because the statutory periods sit in tax and company law.

What about candidates, contractors and background checks?

Job applicants are not yet employees. A CV voluntarily sent for a specific vacancy can be used to assess that application, but keeping a large CV bank for future roles calls for a clear notice and a short retention period.

Background verification agencies, payroll processors, HRMS providers and insurance brokers that handle employee data for you are your Data Processors. Section 8(2) requires a valid contract with each of them, and you remain responsible for what they do.

Contract staff supplied by an agency are often the agency’s employees. Agree in writing who holds which records and who is responsible for their security.

Common employee data: basis and retention driver

Six steps to put employee data in order

1. List your HR data sets

   Payroll, KYC, PF and ESI, attendance, appraisals, CCTV, candidate CVs and exit records, with where each is stored.

2. Issue a short employee privacy notice

   Explain what you hold, why, who receives it and how long you keep it; add it to onboarding.

3. Restrict access

   Limit payroll and HR files to named people with individual logins, and remove access when roles change.

4. Secure KYC and salary files

   Encrypt laptops and backups, mask Aadhaar numbers where full numbers are not needed, and stop sharing salary files by personal email.

5. Sign processor terms with HR vendors

   Payroll, HRMS, background verification and insurance providers need contract terms on security, breaches and deletion.

6. Set and apply a retention schedule

   Tie each HR data set to its statutory period, then delete or anonymise former employees’ records on schedule.