DPDP Rules for Workplace AI: 14 Questions India CISOs Must Score Before Notification

DPDP Act 2023 backdrop & Rules timeline

The Digital Personal Data Protection Act 2023 is India's first cross-sector data-protection statute. It was passed in 2023 and covers digital personal data processed within India — including data of employees, contractors, and gig workers. The Act sets the obligations of data fiduciaries (the employer who decides why and how data is processed), data processors (the vendor who processes on instruction), and data principals (the individual). The Data Protection Board is the enforcement body. Penalty bands run up to INR 250 crore per violation in the statute — the exact amount depends on the violation class and is subject to revision in implementing Rules, so verify with counsel.

The DPDP Rules — the operative regulations that set the form of notice, the consent mechanics, the breach-notification timeline, and the Board's procedures — are expected to be notified in late 2025 or 2026. The exact date is subject to change as the Ministry finalises the draft; verify the current status with counsel for your jurisdiction. The working assumption in early 2026 is that the Rules close out by late 2026; many enterprise CISOs are scoring vendors against the statute now so that the Rule-specific tightening is patchable rather than blocking.

For India IT services and BPO firms serving global clients, the cross-border layer matters: data of EU workers processed in India falls under both DPDP and the EU AI Act. See our companion EU AI Act vendor readiness 14 questions for the EU-side framework; the practical sequence is to score the vendor under DPDP first, then run the EU AI Act scorecard on the same vendor where EU workers or EU clients are in scope.

The 14-question framework, grouped

The 14 questions split into five anchor blocks. Q14 is a halt question. Score each pass / partial / fail. The verdict math is at the bottom.

Block A — Consent & lawful basis (Q1-3)

1. Lawful basis declared per inference. For each AI inference the vendor produces (productivity score, idle classification, focus signal, allocation), has the vendor named the lawful basis under DPDP — consent under Section 6 or a legitimate use under Section 7? “We rely on the employer’s contract” without a specific basis is fail.
2. Consent mechanics shipped. Where consent is the basis, does the vendor ship the consent capture surface, the withdrawal path, and the consent log — or does the employer have to build it? An employer building consent infrastructure from scratch for a vendor is a partial at best.
3. Section 7 legitimate-use map. Where Section 7 employment provisions are the basis, does the vendor's deployer kit name which specific clause the inference rests on, with the narrative argument? Vague reliance on “legitimate interest” is fail.

Block B — Purpose & minimisation (Q4-6)

4. Stated purpose per data category. Does the vendor document the specific processing purpose for each data category captured — activity events, application context, focus signal, identifier, location? “Productivity” as a purpose is not specific enough.
5. Data-minimisation evidence. Can the vendor show that each captured signal is necessary for a stated purpose — not just useful? Purpose-limitation under DPDP is stronger than “could be helpful one day”.
6. Retention schedule per category. Is there a written retention schedule per data category with a documented destruction process? “Forever” or “until customer requests” is fail.

Block C — Data-fiduciary & processor duty (Q7-9)

7. Processor-fiduciary contract terms. Does the vendor's DPA explicitly position the vendor as data processor and the employer as data fiduciary, with the Section 8 obligations mirrored in writing? Many vendors are still on pre-DPDP DPA templates — check the date.
8. Sub-processor disclosure. Is there a current sub-processor list (cloud, analytics, model providers) with locations and a change-notification SLA? An out-of-date sub-processor list is a fail by definition.
9. Data residency option. Can the deployment be run with primary data residency in India, including model inference where AI is in use? Cross-border transfer is allowed under DPDP, but the option to keep data in-country matters for BFSI, gov, and regulated-sector buyers.

Block D — Breach, rights, audit (Q10-13)

10. Breach intake SLA. Is there a written 24-hour breach-intake SLA from vendor to employer, with a documented escalation chain and a forensics-ready audit trail? DPDP Board notification timing is set in Rules; the working assumption is 72 hours from employer to Board, so vendor-to-employer must beat that.
11. Data-principal rights routing. Can a worker exercise access, correction, erasure, and grievance rights through the deployment, with a documented path the employer can publish? “Email support” is partial.
12. Grievance officer point of contact. Is the vendor's grievance officer named in the contract, with response SLA? Significant data fiduciaries have specific obligations here; check if your deployment volume crosses any threshold.
13. Audit-trail export. Can the deployer pull a regulator-ready audit trail in under 30 minutes — capture, inference, decision, override — for any worker-affecting decision in the last 12 months?

Block E — Surveillance-on-default halt (Q14)

14. Surveillance-on-default halt. Does the vendor ship screenshots, keystroke capture, webcam or microphone surveillance switched off by default per role / team / per feature? If the default is on, score the vendor halt regardless of any other passes. DPDP's purpose-limitation and data-minimisation principles are not consistent with default-on surveillance, even where consent is technically obtained.

How buyers should score — the rubric primer

Score by evidence, not by intent. Vendors will offer to walk you through nuance, especially around Section 7 legitimate-use arguments. Resist that until the scorecard is done. The point of pass / partial / fail is to remove the nuance and put each anchor on a line; counsel handles the nuance after.

• Pass means written evidence with a date and an owner, viewable inside 24 hours of request. A slide deck is not evidence; the DPA clause, the consent log specimen, and the retention schedule are.
• Partial means a credible delivery date inside Q2-Q3 2026 with a named owner and a milestone visible this quarter. Where the anchor depends on Rule-specific language (breach SLA timing, grievance officer threshold), partial is the right score until notification.
• Fail means no answer, evasive answer, or an answer that contradicts the contract. Q14 fail is a halt — do not score the rest until the default is fixed.

Run the worksheet with two reviewers: a CISO or DPO who can read the DPA, and a procurement lead who controls the contract. Score independently, reconcile, then take counsel only the disputes.

Expected scorecard band by vendor archetype

The table below summarises how five common workplace-monitoring archetypes typically score against the 14-question DPDP framework. It describes vendor-archetype defaults observed in product documentation and marketing material as of May 2026; specific deployments may vary by configuration choices. Verify the actual configuration with the vendor in writing, and verify your specific obligations with counsel for your jurisdiction.

Reading note. Archetype band describes the out-of-the-box configuration as advertised in vendor marketing, not a per-tenant audit. The Q14 halt fires on default-on capture regardless of how many other anchors a vendor can configure into compliance — the principle DPDP enforces is purpose limitation, and default-on capture is not consistent with it.

Verdict bands — what to do at each

The Q14 halt — why it is the load-bearing question

Q14 carries weight because it is the cheapest fail to identify and the most expensive fail to live with. A vendor that ships surveillance switched on by default is making a design statement: capture first, justify later. That posture is inconsistent with DPDP's purpose-limitation and data-minimisation principles, with the EU AI Act's high-risk obligations for any cross-border deployment, and with the brand position of any India IT services or BPO firm serving global clients. The honest framing: surveillance-on-default vendors have known about DPDP since 2023; the fact that the default has not flipped tells you what the roadmap priorities are.

For the architecture that holds up under DPDP scoring — capture and inference separated, AI framed as recommendation to a human, off-default monitoring, and a deployer kit shipped with the product — see our behavior signals framework and the anti-surveillance productivity stack. The DPDP lens on screenshots specifically is in how often should you take employee screenshots.

India IT services & BPO — the cross-border angle

Most India IT services and BPO buyers also serve EU or US clients. The DPDP scorecard does not replace the EU AI Act scorecard for those deployments — it sequences before it. Run DPDP first because India is where you are headquartered and where the Board enforces; run the AI Act scorecard second on any vendor that touches EU worker data or informs decisions about EU workers. The cross-border data-flow question (Q9 in this scorecard) is the bridge: if your DPA does not let you choose primary data residency, your EU AI Act conformity argument gets harder.

For the BPO and India IT services lens specifically, see BPO workforce management software in India for the shift, attrition, and DPDP layering, and Hubstaff alternative for India for the INR pricing and payroll context.

This article describes the DPDP Act 2023 as it applies to workplace AI vendor selection as of May 2026. The DPDP Rules are expected to be notified in late 2025 or 2026; exact timing is subject to revision. Verify specific obligations, deadlines, breach SLA, grievance-officer thresholds, and penalty schedules with legal counsel for your jurisdiction. The 14-question worksheet is a buyer aid, not legal advice.