DPDP Consent Notice Template for Employee Monitoring — India (2026)

The 60-second answer: when monitoring needs consent vs when Section 7(i) covers you

The DPDP Act 2023 gives employers two main lawful routes for processing employee personal data: consent (Section 6) and the legitimate-use ground for employment purposes (Section 7(i)). The mistake most teams make is treating 7(i) as a blanket exemption for anything done on a work device. It is not drafted that way, the Data Protection Board has not yet tested its boundaries, and the prudent reading — the one most counsel will give you — is narrow: 7(i) comfortably covers the processing employment requires, not every form of observation employment makes possible.

Two hedges belong on the record. First, the “likely / arguable” columns are a risk reading, not settled law — Section 7(i)’s scope is untested and the table deliberately errs toward consent. Second, consent does not launder disproportionate capture: under the Puttaswamy proportionality standard, courts are likely to weigh whether the monitoring was necessary at all, not just whether a box was ticked. Verify your specific matrix with counsel.

What DPDP Rule 3 requires the notice to contain

Where you do rely on consent, the consent request must be accompanied or preceded by a notice, and the DPDP Rules (the notice rule — Rule 3 in the draft numbering; confirm the notified version with counsel) set the bar for what that notice looks like. In substance, the notice must be:

• Understandable and standalone — plain language, presented independently, not buried inside the employment contract or handbook;
• Itemised — a specific description of each category of personal data collected, not “activity data” in the abstract;
• Purpose-mapped — the specified purpose of the processing, with the uses enumerated category by category;
• Rights-forward — the concrete way the employee can exercise rights, withdraw consent as easily as it was given, raise a grievance, and complain to the Data Protection Board;
• Linguistically accessible — with the option to access it in English or any of the languages in the Eighth Schedule of the Constitution.

The template below is structured so each requirement maps to a numbered clause — which is also how you defend it later. If you are still drafting the underlying policy the notice summarises, start with our guide on how to write an employee monitoring policy; the notice is the employee-facing surface of that policy, not a substitute for it.

The annotated consent notice template (paste-ready, clause by clause)

Everything in the bordered blocks below is template text you can paste and adapt; [bracketed amber fields] are the variables you must complete. The annotation under each block explains what the clause is doing legally — read the annotations before deleting anything. This template is a starting point, not legal advice. Have qualified counsel review the adapted version against the notified DPDP Rules before circulating it to employees.

Consent record-keeping: proving free, specific, informed, unambiguous, revocable

A signed form is not yet a defensible consent record. If the Data Protection Board or an auditor asks, you need to reconstruct — per employee — exactly what was shown, when, and what has happened since. Map your record to the five statutory qualities of consent:

Operationally that means versioned notices, an immutable consent log (who, which version, when, which action), and re-consent triggered by any scope change — new capture category, new purpose, new vendor. If your monitoring vendor cannot export this evidence, put the fourteen questions in our DPDP Rules CISO questionnaire to them before renewal.

Withdrawal and grievance flow: what stops when consent stops

Withdrawal is where consent regimes fail in practice, because nobody wired the back end. The flow that survives scrutiny:

1. Withdrawal received through the mirrored channel (Clause 7) — log it the same day and acknowledge it to the employee.
2. Monitoring stops for that employee within your stated operational window — the agent is unenrolled or the profile suspended, and the stop is itself logged.
3. Data disposition — consent-based data follows your retention clause; do not quietly keep collecting “in the background”.
4. Other-ground processing continues — payroll, statutory records and security essentials grounded outside consent are unaffected; tell the employee this explicitly so the boundary is clear.
5. No retaliation — performance management proceeds on the evidence you still legitimately have; treating withdrawal as a red flag is the fastest way to prove the original consent was never free.

Grievances follow the Clause 8 route: grievance officer first, within the response timeline the notified Rules prescribe, then the Data Protection Board. The Board can examine the consent record from the previous section — which is the reason that section exists. Timelines and Board procedure are still settling as the Rules phase in; verify the current state with counsel.

5 consent mistakes that void it

How gStride operationalises consent-first monitoring

The cleanest way to make this template easy to honour is to shrink what it has to cover. gStride measures productivity from outcome signals — calendar, repo, ticket and focus artefacts — with no keystroke logging and screenshots off by default, so Clause 2 stays short and Clause 4 stays true. Employee-facing notice templates ship linked to each feature, monitoring is visible by design, and every AI inference carries a why-trail a grievance officer can actually answer with. Teams comparing vendors on exactly this surface usually start from the best DPDP-compliant employee monitoring software for India in 2026 shortlist.

Shorter capture list, shorter notice, fewer consent records to defend — that is the entire privacy-first thesis, applied to paperwork.