Navigating the New Data Privacy Rules in India: HR's Role in Consent, Monitoring, and Breach Duties

On November 14, 2025, the Ministry of Electronics and Information Technology (MeitY) notified the Digital Personal Data Protection Rules, 2025, thereby operationalising the DPDP Act, 2023. A government note confirmed these rules on November 17, after nationwide consultations. For employers, this shifts data privacy from being a policy discussion to becoming a part of day-to-day operations like payroll, HRIS, background checks, CCTV, BYOD, productivity tools, and vendor portals. Employers should expect explicit duties on notices and consent, purpose limitation, retention schedules, grievance redress, children's data protections, and fast breach reporting to the Data Protection Board. There will also be clearer accountability for data processors such as payroll, insurtech, ATS, and background-check partners. Reports suggest that the Centre may tighten compliance timelines after industry feedback, which could accelerate HR tech transitions.

The emotional reality within companies is that most employees didn't sign up to be "data subjects", yet their most intimate details—health claims, family IDs, bank accounts, grievance notes, even keystroke logs—reside across multiple systems. Trust will depend on whether leaders can clearly explain what's collected, why, for how long, and how to refuse (or delete) without risking their careers. HRBPs and IT are anxious over legacy spreadsheets, WhatsApp workflow leaks, and vendors who promise compliance but can't prove it. Employees want dignity and control; managers want workable processes; auditors want evidence. If your privacy posture relies on hope, staff will feel watched, not protected.

From a compliance and leadership perspective, you should run an HR data map (fields, systems, processors), establish a retention schedule, and update collection notices at source (forms, portals, cameras). Privacy should be integrated into policy and UI: separate consent from employment acceptance, default to least data, and make access and correction routes obvious. Execute vendor DPAs with security and sub-processor clauses; verify cross-border handling in your HR stack; and stage breach drills. Train line managers not to over-collect "just in case". Publish a one-page staff explainer in English and the local language. Remember, what you can't document, you can't defend.

What is one employee data flow you'll stop or simplify this week (e.g., medical notes on email, IDs on open spreadsheets)?

Which two vendor systems will you audit first for lawful basis, retention, and breach response?

To address the first part of your question, one employee data flow that could be simplified is the process of handling medical notes. Instead of using email, which can be insecure, consider implementing a secure HR portal where employees can upload their medical notes directly. This not only enhances data security but also streamlines the process.

As for the second part of your question, the two vendor systems that should be audited first for lawful basis, retention, and breach response are the HRIS (Human Resource Information System) and the payroll system. These two systems typically hold the most sensitive employee data and are therefore the most critical to secure.

1. For the HRIS, ensure that it collects only the necessary data, retains it only for as long as necessary, and has robust breach response mechanisms in place.
2. For the payroll system, verify that it complies with all relevant tax laws and regulations, retains data for the required period, and has a strong breach response protocol.

Remember, the goal is to ensure that all systems handling employee data are compliant with the new Digital Personal Data Protection Rules, 2025.