What Employee Data Can a Company Legally Collect in India?

The legal floor: DPDP Act 2023 in one paragraph

The Digital Personal Data Protection Act 2023 (DPDP) is India’s first comprehensive personal-data law, and employee data sits squarely inside it. The core idea is simple: you may process personal data for a lawful purpose that you have told the person about (notice, Section 5) and for which you have consent or a recognised legitimate use (Section 6 and related provisions). On top of that sit principles you will meet repeatedly in this article — purpose limitation, data minimisation, storage limitation and security safeguards. None of this prohibits running a payroll, tracking attendance or measuring whether work is moving. It simply means each category of employee data needs an answer to four questions: why are we collecting it, did we tell the employee, is it proportionate, and when do we delete it.

Because the Act is principle-based and rules are still maturing, the conservative reading is the safe one. Where a legitimate-use ground is unclear, fall back to clear notice plus consent. Throughout this guide, treat the specifics as fact-dependent and verify with counsel.

What you can clearly collect

Most routine HR and payroll processing is on solid ground when it is tied to an obvious employment purpose and covered by notice. The categories below are the everyday backbone of an India employment relationship:

• Identity and contact: name, employee ID, personal and official email, phone, address, emergency contact — needed to administer the relationship.
• Statutory payroll and tax: PAN, bank account, PF/UAN, ESI, Professional Tax, TDS records. These are not just permitted; other laws require them, which also drives their retention periods.
• Attendance and working hours: clock-in/out, leave, shift records — proportionate operational data.
• Role and performance: designation, reporting line, appraisal records, training history — collected for managing and developing the employee.
• Proportionate work-system activity: aggregate productivity signals tied to a stated purpose — calendar load, ticket and project flow, focus-time artefacts — where the employee has been told what is measured and why.

The common thread is necessity. If you can articulate the purpose in one sentence and the data is the minimum needed to serve it, you are usually in the clear — provided the employee received notice. Verify with counsel.

What employee data needs a stronger justification?

Some data is collectible but carries higher scrutiny because it is more intrusive or more easily abused. Collecting it is a deliberate decision, not a default:

• Biometric attendance (fingerprint, face): treat as sensitive. Use clear notice, strict access control, a short retention window, and prefer a less intrusive method if one achieves the same goal.
• Location data from company devices or field apps: justifiable for field roles on duty; hard to justify for off-duty tracking.
• Screen captures and detailed activity logs: defensible only when proportionate, disclosed, and limited — not continuous, not covert.
• CCTV in the workplace: permitted for safety/security with signage and a defined purpose; avoid private zones.

What you should not collect

The fastest way to reduce both legal exposure and breach risk is to not collect data you cannot tie to a purpose. The DPDP Act’s minimisation principle and plain operational sense point the same direction. Steer clear of:

• Private social-media accounts and off-duty online activity.
• Personal-device contents (photos, personal messages) on BYOD hardware.
• Health, family or financial details beyond what statute requires.
• Keystroke logging and email/chat content capture for ordinary productivity visibility — the heaviest possible surface for the smallest real benefit.
• Covert monitoring of any kind, which is the hardest configuration to defend.

Every category you remove is one fewer notice to write, one fewer purpose to defend, one fewer retention schedule to maintain and one fewer thing that can leak in a breach.

How much consent and notice do you actually need?

Notice is non-negotiable: before or at the point of collection, the employee should know what is collected, why, and how to exercise their rights. Consent is required in most cases, although the Act recognises certain employment-related legitimate uses. The pragmatic posture is a layered approach — a clear, plain-language employee privacy notice that maps each data category to a purpose and a retention period, plus explicit consent for anything outside the obvious legitimate-use core (for example, optional wellness data or anything sensitive). Where the legitimate-use basis is uncertain, default to consent. Because the boundary is fact-specific and guidance is still developing, verify the basis for each category with counsel.

Data category decision table

This table is a planning aid, not legal advice; the correct basis for any category depends on your facts. Verify with counsel.

A practical compliance checklist

If you are setting up or reviewing employee data collection in India, work through this short list:

1. Inventory: list every category of employee data you collect today and where it lives.
2. Purpose: write a one-line purpose for each. If you cannot, stop collecting it.
3. Notice: publish a plain-language employee privacy notice mapping category → purpose → retention.
4. Basis: confirm legitimate use or capture consent for each category; default to consent when unsure.
5. Minimise: remove anything not tied to a purpose — especially content capture and off-duty data.
6. Retention: set and enforce a delete schedule per category; honour statutory periods.
7. Security & rights: restrict access, log it, and give employees a route to access and correct their data.

Choosing tools that measure outcome signals rather than capturing screen or keystroke content keeps most of this checklist short by design — there is simply less data to govern.