DPDP Act 2023 Workforce Monitoring — India Buyer's Guide (2026)

Why DPDP changes workforce monitoring

The Digital Personal Data Protection Act 2023 is India's first comprehensive data protection statute. It came into force on the date the President signed it; the operational rules — consent format, breach timing, transfer SCCs, grievance handling, fiduciary obligations — are expected to notify during 2026. The practical compliance gate is the Rules notification, not the Act passage. Verify with counsel for your specific obligations.

For Indian employers running 200 to 2,000 people in IT services, BPO, KPO, financial services, or healthcare administration, the immediate effect is that every workforce-monitoring tool currently in production becomes a regulated processing system. Keystroke loggers, screenshot capture, application-use trackers, mouse-activity sensors, idle-time detection: all are processing personal data of employees. Under DPDP, that processing requires explicit, granular, withdrawable consent under a documented purpose limitation. Bundling consent into the employment contract is no longer sufficient.

The category vendors that built their products in the keystroke-and-screenshot era — Hubstaff, Time Doctor, ActivTrak, Insightful, Teramind, Veriato — have not, as of public documentation, published explicit DPDP readiness statements. Their architectural choices (default-on monitoring, bundled consent, optional sub-processor disclosure) were built for jurisdictions where consent-by-default and broad-purpose contracts were acceptable. Under DPDP they are not.

This guide gives the buyer side of the conversation: the five obligations every vendor must meet, the fourteen questions to put in your evaluation call, the eight-vendor compliance scorecard with current public posture, the RFP redline language that translates DPDP into contract terms, and the penalty math under the INR 250-crore band.

The 5 obligations every workforce-AI vendor must meet under DPDP

These are the operative obligations on a vendor that processes employee personal data on behalf of an Indian employer. The employer is the data fiduciary; the vendor is the data processor. Both have liability, but the obligations split:

Vendor evaluation framework: 14 questions for India CISOs

Use these in the first 30 minutes of any workforce-AI vendor evaluation call. They are the same questions a Data Protection Board inquiry would ask the fiduciary after a breach — getting them answered upfront is the procurement defense. For deeper coverage on each question, see the companion piece on DPDP Rules: 14 questions for India CISOs evaluating workforce-AI vendors.

1. Data fiduciary designation: Will you sign a DPA that explicitly designates you as data processor and us as data fiduciary under DPDP Section 8? Provide the template.
2. Sub-processor list: Provide the current list of sub-processors with country-of-processing per entry. How do we get notified when this list changes?
3. India-hosting option: Can processing and storage be confined to Indian data centres on contract demand? What is the latency / feature impact?
4. Consent architecture: Walk through the per-employee, per-feature consent flow. Show the consent ledger UI. How does an employee withdraw consent for a single feature without disabling the entire product?
5. Purpose limitation enforcement: What technical controls prevent data collected for time-tracking from being repurposed for performance evaluation or wellbeing scoring? Is the exclusion architectural or admin-toggled?
6. Breach notification SLA: What is your vendor-to-fiduciary breach notification SLA? Document it in the DPA. Provide the most recent breach drill summary.
7. Grievance handling: What is the data-principal grievance handling process? Who is the designated Data Protection Officer at your end? What is the SLA?
8. Significant Data Fiduciary tier: Do you support enhanced controls if our deployment qualifies us as a Significant Data Fiduciary under Section 10 (likely for >1,000 employee or BFSI / healthcare verticals)? List the additional obligations you support: DPIA, independent audit, data-fiduciary appointment.
9. Children's data: If our workforce includes apprentices or trainees under 18, what additional controls apply? Verifiable parental consent flow, no targeted advertising, no behavioural tracking.
10. Cross-border transfer assessment: Provide the SCC-equivalent template you use for cross-border transfers. Is it on the DPB's approved list (when published)?
11. Audit logs: What audit logs are produced for fiduciary review? Frequency, retention, access controls. Can our DPO query the logs without raising a support ticket?
12. Right to correction and erasure: Walk through the data-principal correction and erasure flow. SLA. Verification process. What survives erasure (e.g. aggregated metrics) and why is that compatible with DPDP?
13. Exit and data portability: On contract termination, what is the data export format, retention period, and deletion certification process? Get the deletion certificate template.
14. Documented DPIA: Have you completed a Data Protection Impact Assessment for your product against DPDP obligations? Provide a copy or summary.

DPDP-compliance scorecard for 8 incumbent vendors

This is the snapshot as of May 2026 based on each vendor's publicly available trust, privacy, and product documentation. It is not a legal opinion. Where a vendor's public documentation does not address a specific DPDP obligation, the cell is marked Unknown — not Non-compliant. Vendors may have private DPDP statements available to enterprise buyers on request. Verify with counsel and request a written readiness statement from each vendor in your shortlist.

Two patterns: the keystroke-and-screenshot vendors carry the deepest DPDP architectural debt because purpose-limitation under DPDP is incompatible with default-on broad-spectrum monitoring. The time-only vendors (Toggl, Clockify) carry less architectural debt because they do not process the kinds of personal data DPDP scopes most heavily — but they also lack the workforce-AI signals that justify a productivity-intelligence buy in 2026. The architectural answer is a system that does produce productivity intelligence but does so from outcome signals (calendar, project, repository tools) rather than input capture.

DPDP Rules notification — what to expect in 2026

The Act sets out the structural obligations. The Rules operationalise them. As of May 2026, the Rules are in draft circulation; final notification is expected during 2026. The four areas where Rules will most directly affect workforce-AI procurement:

Consent format

The Rules will specify the form, language, and presentation of consent — including the minimum information that must accompany each consent request, the format of consent withdrawal, and the standard for verifiable proof of consent. Current draft language anticipates separate consent per processing purpose, presented in clear and accessible language in English plus the data principal's preferred Indian language (the eight Schedule VIII languages are likely default). Workforce-AI vendors that bundle all monitoring into a single yes/no checkbox will need to refactor their consent UI before Rules notification.

Breach notification

The 72-hour notification window is in the Act. The Rules will specify the format of the breach notification (likely a structured form to CERT-In and the Data Protection Board), the categories of "personal data breach" that trigger the obligation, and the threshold for notifying affected data principals individually. For workforce-AI vendors, this means a documented incident response runbook is no longer optional — it is a contractual deliverable.

Cross-border transfer assessment

The Act allows the central government to publish a list of countries to which personal data may be transferred without additional safeguards (a "white-list" approach). The Rules and subsequent notifications will populate this list. Until then, cross-border transfers require contractual safeguards — typically SCC-equivalent clauses. Vendors that process or store data outside India should already have transfer impact assessments available on request.

Significant Data Fiduciary designation

Section 10 of the Act allows the central government to designate certain data fiduciaries as Significant Data Fiduciaries based on volume of data, sensitivity, risk, and other factors. The Rules will specify the criteria and the additional obligations — likely including mandatory DPIA, independent audit, and appointment of a Data Protection Officer. Indian companies with >1,000 employees, BFSI, healthcare, and large platform businesses should plan for this designation. Workforce-AI vendors serving these segments need to support enhanced controls now.

Penalty exposure under the INR 250-crore band

The DPDP Act introduces a tiered penalty schedule under Section 33. The highest band is up to INR 250 crore per offence for failures of obligation. The Data Protection Board has discretion within each band based on the nature of the violation, the duration, the number of data principals affected, the gain or loss caused, and the mitigation effort by the entity. Verify with counsel; the figures here are statutory ceilings, not expected enforcement values.

For a 1,000-employee Indian IT services company that experiences a breach involving employee personal data, plausible first-year exposure is concentrated in two bands: the security safeguards failure (up to INR 50 crore) and the breach notification failure (up to INR 200 crore). The 250-crore band is reached when children's data or Significant Data Fiduciary obligations are involved. First-mover enforcement is expected to focus on egregious failures — bundled consent and undisclosed cross-border transfers are likely high-priority targets. Verify with counsel.

What to put in your next RFP

Translate DPDP into contract terms now — before Rules notification. Five contract clauses to add to your standard workforce-AI vendor RFP:

1. DPDP fiduciary/processor designation clause. Explicit designation of buyer as data fiduciary, vendor as data processor under DPDP Section 8. Vendor cannot independently determine processing purposes. Both parties indemnify per their respective obligations.
2. Granular consent and consent ledger clause. Vendor product must support per-feature consent capture per data principal, with timestamped ledger entries accessible to the fiduciary on demand. Consent withdrawal must take effect within an SLA (typically 24 hours).
3. 72-hour breach notification SLA clause. Vendor must notify fiduciary of any personal data breach within an SLA short enough that the fiduciary can meet its 72-hour CERT-In and DPB notification window (typically 24 hours from discovery). Vendor must provide a structured breach summary including affected data principal count, categories of personal data affected, root cause, and remediation timeline.
4. Cross-border transfer assessment clause. Vendor must maintain a current sub-processor list with country-of-processing per entry, notify fiduciary 30 days in advance of sub-processor additions, and execute SCC-equivalent contract language for any cross-border transfers. India-hosting option must be available on demand at no incremental cost.
5. Exit and deletion certification clause. On contract termination, vendor must export all personal data to fiduciary in a documented format within 30 days, certify deletion of all copies within 60 days, and provide a signed deletion certificate. Backups and aggregated metrics are excluded from the deletion obligation only if specifically scoped in the contract.

Sample redline language for clause 1:

The parties acknowledge that, under the Digital Personal Data
Protection Act 2023, the Buyer is the Data Fiduciary and the Vendor
is the Data Processor with respect to all personal data of Buyer's
employees, contractors, and other workforce data principals processed
through the Vendor's product. The Vendor shall process such personal
data only for the purposes specified in Schedule A and only on
documented instructions from the Buyer, except where required by
applicable law. The Vendor shall not transfer any personal data to a
sub-processor without the Buyer's prior written consent and shall
maintain a current list of sub-processors available to the Buyer on
demand.

gStride DPDP architecture

gStride is architected against DPDP Act 2023 obligations at the system level. The product is positioned as an AI productivity intelligence platform that reads outcome signals from work data — calendar, project, and repository tools — rather than capturing input behaviour at the keyboard layer.

Data fiduciary by default

Every deployment ships with a standalone Data Processing Addendum designating the customer as the data fiduciary and gStride as the data processor under DPDP Section 8. The DPA is signed at contract execution; there is no path to deploy without it.

Granular consent architecture

Each monitoring feature (time capture, idle detection, calendar parse, repository commit parse, project ticket parse) is a separate consent surface inside the product. Employees see per-feature toggles in their gStride profile with timestamped consent ledger entries. Withdrawal of consent for a feature disables only that feature; the employee remains in good standing with the platform.

No keystroke or screenshot collection

The product does not capture keystrokes. The product does not capture screenshots by default; the screenshot feature is available as a customer-toggled opt-in for verticals (e.g. BPO billing audits) where it is operationally required and contractually consented to, and the schedule is configurable per data principal.

Excluded categories

Emotion inference, stress scoring, and wellbeing prediction are excluded by architecture, not by admin toggle. The product cannot perform these inferences regardless of customer configuration. This maps to the DPDP purpose-limitation obligation and to the EU AI Act Article 5 prohibited categories.

72-hour breach notification process

The gStride incident response runbook commits to a 24-hour vendor-to-fiduciary notification SLA from discovery, giving the fiduciary 48 hours to meet the 72-hour CERT-In and DPB obligation. The runbook is reviewed annually and a redacted summary is available to enterprise customers.

India-hosting option

For India-based deployments, all processing and storage can be confined to Indian data centres (Mumbai region). For deployments spanning India and non-India workforce, cross-border transfers use SCC-equivalent contract language, with a transfer impact assessment available to the fiduciary on demand.