Background Checks and Employee Monitoring Under the DPDP Act

Introduction

Employers hold more personal data about their staff than most businesses hold about their customers: identity documents, bank details, family information, health declarations, performance records and, increasingly, logs of what employees do on company devices. Before hiring, they gather even more through background verification.

The Digital Personal Data Protection Act, 2023 (the DPDP Act) gives employers a dedicated ground for this processing in section 7(i). Many HR teams have read it as a general licence. It is broad, but it has edges, and it has a side effect on employee rights that few employers have noticed. The relevant obligations commence on 13 May 2027.

The legal position

The employment ground. Section 7(i) permits processing without consent:

"for the purposes of employment or those related to safeguarding the employer from loss or liability, such as prevention of corporate espionage, maintenance of confidentiality of trade secrets, intellectual property, classified information or provision of any service or benefit sought by a Data Principal who is an employee."

The data principal is the individual whose data is processed. The employer is the data fiduciary.

Notice is tied to consent. Section 5(1) requires a notice to accompany or precede "every request made to a Data Principal under section 6 for consent". Where the employer relies on section 7(i), the Act does not itself require a notice.

Rights depend on the ground. The right of access in section 11(1) runs against a data fiduciary "to whom she has previously given consent, including consent as referred to in clause (a) of section 7". The right to correction and erasure in section 12(1) is framed the same way. Read literally, employees whose data is processed only under section 7(i) do not have these two statutory rights.

What still applies. The general obligations in section 8 apply whatever the ground: reasonable security safeguards (s.8(5)), breach intimation to the Board and affected individuals (s.8(6)), erasure when the purpose ends (s.8(7)), accuracy where data is used for decisions (s.8(3)), and a valid contract with any data processor (s.8(2)), meaning a vendor handling data on the employer's behalf. Section 9 applies to any employee or intern under 18.

Aadhaar. The Aadhaar Act, 2016 requires consent before authentication (s.8(2)(a)) and before offline verification (s.8A(2)(a)). Under regulation 14A of the Aadhaar (Authentication and Offline Verification) Regulations, 2021, an entity doing offline verification must not collect, use or store the Aadhaar number or biometric information.

Labour Codes and gig workers. The Code on Social Security, 2020 came into force on 21 November 2025 (S.O. 5319(E)). It defines gig workers, platform workers and aggregators separately from employees and provides for their registration and welfare schemes. Karnataka's Platform-Based Gig Workers (Social Security and Welfare) Act, 2025 goes further: section 13 requires platforms to explain how workers can obtain information about automated monitoring and decision-making, and section 14(2) requires written reasons and 14 days' notice before termination.

Analysis

Candidates sit at the edge of section 7(i)

"For the purposes of employment" can reasonably be read to include recruitment, because hiring is a purpose of employment. But the provision speaks elsewhere of "a Data Principal who is an employee", and a candidate is not one yet. The question has not been tested.

Background verification also goes beyond the candidate. It involves address checks, previous employers, education boards, court records and, sometimes, credit bureaus. The verification vendor is a processor, but the previous employer disclosing information is a data fiduciary in its own right and needs its own ground for doing so.

The safer approach is a two-part model. Rely on section 7(i) for core onboarding data once an offer is accepted. Obtain specific, recorded consent for background verification, naming each check, the vendor and how long results are kept. Consent also gives the candidate clarity and the employer a defensible record if a check is disputed. For Aadhaar-based identity checks, consent is required by the Aadhaar Act regardless.

One practical point: the police clearance certificate issued through Passport Seva is designed for Indians going abroad for residence or employment. Employers hiring for roles in India should not routinely demand it.

Security monitoring fits; productivity tracking strains

The examples in section 7(i), corporate espionage, trade secrets, intellectual property and classified information, give employers a clear basis for security monitoring: data-loss prevention tools, access logs, email scanning for confidential material, and device management on company laptops.

The ground is less comfortable for monitoring that is about productivity rather than loss. Keystroke logging, periodic screenshots, webcam checks and location tracking outside working hours are hard to describe as safeguarding the employer from loss or liability. The Act's own text pushes towards restraint in two ways. Section 7(i) permits processing for the purposes it names, so the employer must be able to point to a real loss or liability the monitoring guards against. And section 8(7) requires erasure once that purpose is served, which is hard to manage for data gathered without a defined purpose in the first place.

Staff phones used for work are the hardest case. The employer has a real interest in the company email on the device and none in the family photographs, so the tool it chooses should be able to see the first without reaching the second.

Employees may lack statutory access rights

The gap applies only to data processed solely under section 7(i). Information an employee volunteers for a stated purpose, such as nominee details for a benefit, may fall under section 7(a), which does carry these rights. For the rest, employers face a choice. They can rely on the literal reading, or they can provide access and correction voluntarily. We recommend the second. Accurate HR records are required anyway for decisions (s.8(3)). Employees can still use the employer's grievance mechanism under section 13(1), which applies whatever the ground, and must exhaust it before approaching the Board (section 13(3)). An employer seen to be withholding an employee's own records invites disputes under other laws.

Employee data has an expiry date

Section 8(7) requires erasure once the purpose is no longer served, unless another law requires retention. For employers, that turns on the difference between data the law makes them keep and data they keep by habit.

Labour, tax and social security laws require many employment records to be retained, including wage, attendance and contribution records, so these are covered by the exception. Much else is not: background verification reports long after hiring, rejected candidates' CVs, old monitoring logs and the personal documents of employees who left years ago. Each needs a fixed period tied to a stated reason, such as defending a likely claim, after which it is deleted.

Two points are often missed. Section 8(7)(b) requires the employer to make its processors erase data too, including payroll, verification and HR software vendors. And Rule 6 requires security logs to be kept for at least one year, so deletion schedules for monitoring data should start from that floor, not from zero.

Gig and platform workers fall outside section 7(i)

The Code on Social Security treats gig and platform workers as a category separate from employees. A delivery platform cannot assume that section 7(i) covers its riders. For them, consent is the safer ground. Section 7(a) may cover details a worker hands over for a specific purpose, such as bank details for payouts, but it is a stretch for continuous monitoring. In Karnataka, platforms must also be ready to explain their automated systems under the 2025 Act.

Practical implications

A worked example. A 400-person SaaS company in Pune hires about 80 people a year through a background verification vendor and runs data-loss prevention software on company laptops.

• Hiring. The offer letter attaches a background verification consent naming the checks (identity, education, two previous employers, address), the vendor and a six-month retention period for results.
• Vendor. The vendor contract limits use to the stated checks, requires Rule 6 safeguards, prompt incident notice and deletion at the end of the retention period.
• Monitoring. The company publishes a short monitoring policy: what is monitored, why, who can see it, and how long logs are kept. Productivity screenshots are dropped. Data-loss logs are kept for one year, in line with Rule 6.
• Rights. Employees can view and correct their HR records through the HR portal, even though section 7(i) may not strictly require it.

Key takeaways

• Section 7(i) lets employers process staff data without consent for employment and to safeguard against loss or liability.
• Background checks on candidates are safer with specific consent; Aadhaar checks always need consent.
• Security monitoring fits s.7(i); productivity surveillance such as keystroke logging and screenshots is hard to justify under it.
• Employees processed only under s.7(i) may not have statutory access and correction rights under ss.11–12; employers should offer them anyway.
• Gig and platform workers are not employees under the Code on Social Security, so s.7(i) is unlikely to cover them.