Template library

Employee data protection policy

Maps each stage of the employment lifecycle to its lawful ground — section 7 (i) for core HR, consent only where refusal is genuinely free — with restrained monitoring rules and post-exit retention. For any employer processing staff data in India.

An original template, drafted against the DPDP Act, 2023 and DPDP Rules, 2025. Not legal advice — review with counsel before use.

One of 14 DPDPA document templates, drafted in-house against the Act and the Rules. Free to read and generate after a free sign-in. The first clauses are open below.

Drafted against G.S.R. 846(E); citations open the gazette text inline.

About this document

What it covers

The placeholders this template asks you to fill in.

[Organisation Name][HR Privacy Contact Name or Role][HR Privacy Contact Email][Background Check Types, e.g. education, prior employment, criminal record][Candidate Data Retention Period][Payroll Data Items][Attendance Data Items][Performance Data Items][Safety Data Items][IT Data Items][Monitoring Description, e.g. network security logging on company systems and CCTV in common areas][Monitoring Exception Approver][Monitoring Disclosure Location][Post-Exit Retention Items and Periods, e.g. payroll records for the period income-tax law prescribes][Voluntary Access Scope, e.g. view and seek correction of your HR master data through the HR portal]

The document

The opening clauses — open to everyone

Who this policy covers — and who it does not

This policy governs how [Organisation Name] handles the personal data of its employees under the DPDP Act, 2023. Candidates, contractors, consultants and secondees are not employees for the Act's employment-purposes ground, so their data is handled on consent or another lawful ground, and this policy flags that wherever they appear. Our published contact for employee data questions is [HR Privacy Contact Name or Role], at [HR Privacy Contact Email].

The legal ground we use, stated plainly

Most employee data processing here rests on section 7 (i) of the DPDP Act, which permits processing "for the purposes of employment or those related to safeguarding the employer from loss or liability, such as prevention of corporate espionage, maintenance of confidentiality of trade secrets, intellectual property, classified information or provision of any service or benefit sought by a Data Principal who is an employee."

We do not take blanket consent in appointment letters for core HR processing: consent conditioned on keeping your job is not free, and it can be withdrawn — the wrong instrument for payroll or discipline. Where we do ask for consent (see below), refusing it never affects your employment.