No small business holds more sensitive personal data per person than an HR, payroll or staffing firm. One joining kit has an Aadhaar, a PAN, a bank account, a UAN, a salary, an address, often a medical form and a family nominee. Multiply that by every associate on your rolls, and a single salary sheet in the wrong WhatsApp group becomes a reportable breach under India's DPDP Act.
The general duties are in our DPDP Act checklist for small businesses. This page covers what is different for employee and candidate data. It is practical guidance, not legal advice.
When the duties start
The DPDP Rules were published on 13 November 2025. The duties below, and the Data Protection Board's power to fine, start 18 months later: mid-May 2027, or 13 May 2027 on a plain count (G.S.R. 843(E)). There is no size threshold and no exemption for small firms has been notified.
Employees: consent is not the main ground
Section 7(i) of the Act lets an employer process personal data "for the purposes of employment" or to protect itself from loss or liability, such as preventing corporate espionage or protecting trade secrets, and to provide a benefit the employee asked for. Payroll, attendance, PF and ESI filings, appraisals and exit formalities sit comfortably here.
What that does not remove:
- Security safeguards (section 8(5), Rule 6): encryption or masking, access control, logs kept for a year, backups.
- Breach reporting (section 8(6), Rule 7): tell the affected people and the Board without delay, with a detailed report to the Board within 72 hours.
- Erasure (section 8(7)): delete when the purpose ends, unless a law requires you to keep the record.
- A published contact person and a grievance process (Rule 9, Rule 14(3)).
Some law firms read the Act as saying that no consent notice is needed for data processed on the employment ground, because section 5 ties the notice to consent requests. Neither MeitY nor the Board has confirmed that. A short privacy note in the offer letter or HR policy costs little and covers you either way.
Candidates are not employees yet
The Act is silent on whether shortlisting, interviews and background checks count as "purposes of employment". Law firms are split (King Stubb & Kasiva). The cautious route:
- Collect only what the hiring step needs. A CV and contact details for shortlisting; ID and bank details only at offer stage.
- Before a background check, give the candidate a notice that says what will be checked, from which sources and why, and get their consent.
- When a candidate isn't hired, the purpose is over. Delete their documents after the one-year minimum in Rule 8(3), unless a law needs them kept.
Fiduciary or processor? It depends on the data set
The Act puts the main duties on the Data Fiduciary, the party that decides why and how data is used, and lets it use a Data Processor only under a valid contract (section 8(2)). The fiduciary stays liable for what the processor does (section 8(1)).
| Your situation | Usually | What it means |
|---|---|---|
| Your own employees | Data Fiduciary | All the duties are yours. |
| You run payroll on a client's instructions | The client's Data Processor | The client needs a contract with you that covers security (Rule 6(1)(f)). Follow its instructions, including erasure. |
| You are the legal employer of associates placed at clients | Data Fiduciary for their statutory data (payroll, PF, tax) | The client may be a fiduciary for data it collects itself, such as site access logs or performance notes. |
| Your background check, HRMS or payroll software vendor | Your Data Processor | You need a contract with security terms and a way to make them delete. |
The staffing case is the least settled. Commentators disagree on how the Act applies when two employers share one worker (Bar & Bench). The practical answer is the same everywhere: write each party's role, for each data set, into the contract.
The HR data checklist
- Map every HR data set. Candidates, employees, ex-employees, associates at clients, nominees and dependants. For each, note where copies sit: HRMS, payroll software, Excel, email, recruiters' phones, printed joining kits.
- Write down the ground for each. Employment use (section 7(i)) for employees; consent with a notice for candidates and background checks; legal duty for statutory filings.
- Stop collecting what payroll doesn't need. Full bank statements, full Aadhaar numbers and medical history are rarely required. A masked Aadhaar and a cancelled cheque usually do.
- Move documents off personal phones. Recruiters' WhatsApp is the biggest leak in most firms. Give candidates one upload route instead (how to collect documents securely).
- Lock down access by role. Salary data visible to payroll only, documents to HR only, and access removed the day someone leaves. Turn on two-step verification and check that your systems keep access logs for a year (Rule 6).
- Put roles into every contract. Client agreements, vendor agreements and background check agency terms should say who is fiduciary and who is processor for which data, require security safeguards, and require deletion at the end.
- Set retention periods. Labour, tax and PF laws require some records to be kept; keep those for the period the law sets and no longer. Everything else goes when its purpose ends, after Rule 8(3)'s one-year minimum.
- Plan for exits. When someone leaves, keep what the law and final settlement need, revoke their system access, and schedule the rest for deletion.
- Write the breach plan for HR's usual mistakes. A payslip to the wrong person, a salary sheet in a group, a lost laptop. Each one triggers Rule 7's notices. Name who calls the employee, who emails the Board and who writes the 72-hour report.
- Publish the contact person. Name the role and email that answers employees' and candidates' data questions, on the website and in the HR policy (Rule 9).
Aadhaar copies in joining kits
Collecting employee Aadhaar copies is not banned, but the UIDAI regulations set conditions that already apply, on paper and on screen: tell the person the purpose and whether giving Aadhaar is mandatory, get consent, never display it, keep it secure and don't keep it longer than needed (regulations 5 and 6). The Aadhaar Data Vault rule applies to entities that use UIDAI authentication or e-KYC, not to an employer that only keeps copies (UIDAI ADV FAQ).
Where NO SUS fits
Candidates and associates can send their ID and bank proof as a one-open link from nosus.foo: encrypted in their browser, no account, no phone number exchange, and the server copy is gone after you open it once. Offer letters and payslips can go out watermarked with the viewer's email, so a forwarded copy shows whose it was.
Want help setting this up for an HR, payroll or staffing firm in Mumbai (data map, contract roles, retention list, breach plan)? Email shubhamsahu@nosus.foo. It's practical setup help, not legal advice.