Employee Data from Offer to Exit: A DPDP Lifecycle Framework

Executive summary

An employer handles personal data at every point of a working life: the CV, the offer, the nominee form, the appraisal, the sick note, the complaint and, years later, the reference call. The Digital Personal Data Protection Act, 2023 (the DPDP Act) reaches all of it from 13 May 2027, when its main duties commence.

The employer is the data fiduciary, the person that decides why and how personal data is processed. Each candidate, employee and family member is a data principal, the individual the data is about. Payroll bureaux, verification agencies and HR software providers are usually data processors, acting on the employer's behalf.

This whitepaper follows the data through nine stages, setting out for each the ground, notice, retention anchor and main risk. Five conclusions run through it:

• No single ground covers the lifecycle. Section 7(i) carries most employment processing, but candidates and alumni rest on consent or section 7(a), statutory filings on section 7(d), and internal inquiries, in our view, on section 17(1).
• Families are data principals too. Dependants, nominees and emergency contacts never deal with the employer, yet the Act protects them, and children bring in section 9.
• Under-18 interns change the monitoring stack. Section 9(3) bars behavioural monitoring of children, and no exemption covers workplace analytics.
• Investigations have a statutory footing, with an end date. In our view s.17(1)(c), then 17(1)(a), can support internal and POSH inquiries while the inquiry or claim lasts.
• Exit is where records outlive their purpose. Labour, company and tax laws decide what stays; everything else needs a date.

Background

Employee data is unusual in three ways. It is deep: identity documents, salary, health, family and conduct sit in one file. It is long-lived: a ten-year career leaves records that statutes require to be kept after the person has gone. And it is shared: with verifiers, payroll bureaux, the Employees' Provident Fund Organisation (EPFO), the Employees' State Insurance Corporation (ESIC), the tax department, insurers, clients and overseas parents.

Trayambic has covered parts of this ground: our article on background checks and employee monitoring (section 7(i), productivity tracking and the rights gap), our HR tech study, our retention whitepaper and our article on processors. This paper connects them stage by stage and adds what they leave open: family data, minors, investigations, exit, alumni and requests from former staff.

Legal framework

The DPDP Act and Rules. Processing needs consent or a legitimate use (s.4). The uses that matter here are s.7(a), data a person voluntarily provides for a specified purpose; s.7(d), disclosures a law requires to the State; s.7(f), medical emergencies; and s.7(i), employment, safeguarding the employer from loss or liability, and the "provision of any service or benefit sought by a Data Principal who is an employee". A notice is required only with a consent request (s.5(1)). Access and correction rights run only against a fiduciary that relied on consent or s.7(a) (ss.11(1), 12(1)).

Every fiduciary must keep data complete, accurate and consistent where it drives a decision or is disclosed to another fiduciary (s.8(3)), adopt appropriate technical and organisational measures (s.8(4)), maintain reasonable security safeguards (s.8(5)), report breaches (s.8(6)) and erase data once the purpose ends unless a law requires retention (s.8(7)). Section 9 protects anyone under 18. Section 17(1) disapplies Chapter II (except ss.8(1) and 8(5)), Chapter III and s.16 where processing is "necessary for enforcing any legal right or claim" (clause (a)) or is "in the interest of prevention, detection, investigation or prosecution of any offence or contravention of any law for the time being in force in India" (clause (c)). Rules 6, 8(3), 10, 14 and 15 add security minimums, a one-year floor for processing records, parental-consent mechanics, a 90-day grievance limit and conditions on transfers.

Employment and related laws.

The four Labour Codes came into force on 21 November 2025. The Income-tax Act, 2025 applies from 1 April 2026; Form 130, the salary TDS certificate that replaces Form 16, is due to the employee by 15 June after the tax year. Under s.38 the DPDP Act applies alongside these laws, which work mainly through the "compliance with any law" exception in s.8(7).

Analysis

The master lifecycle table

Grounds are Trayambic's reading. Notice is required only where consent is sought; "voluntary" means we recommend one.

Recruitment

Our earlier pieces set the position: s.7(a) for an application to a named role, specific consent for background checks, talent pools and recorded interviews, and erasure when the role is filled. Two additions. A referral brings in someone who has never dealt with the employer; in our view s.7(a) does not fit, because the friend did not provide the data, so contact her once and invite her to apply. And on our retention whitepaper's reading, Rule 8(3) keeps a restricted one-year set of processing records after a rejected candidate's file is purged.

Offer and onboarding

Once an offer is accepted, s.7(i) carries identity, bank, education and appointment records; the OSH Code requires an appointment letter (s.6(1)(f)). Aadhaar is the exception: authentication and offline verification need consent under the Aadhaar Act whatever the DPDP ground. Section 142 of the Code on Social Security ("Application of Aadhaar") concerns identity for benefits under the Code; using that copy for a background check is a new purpose.

Health declarations need restraint. In our view s.7(i) supports assessing fitness for a stated role, recorded as fit or unfit with any adjustment needed, but not a general medical-history questionnaire. Section 5 requires no notice for s.7(i) processing; we recommend a short employee notice anyway, as a measure of the kind s.8(4) expects.

Payroll and benefits

Payroll runs on s.7(i). Filings with the EPFO and ESIC, and the reporting of salary TDS deducted under s.392 of the Income-tax Act, 2025, are disclosures a law requires to the State, so s.7(d) applies, as our HR tech study concluded. Every employee of an establishment covered by the ESI chapter must be insured (s.28), and benefits under the Code carry nominations (for example ss.41(6), 55 and 62(1)).

Two traps. In our view a group insurer is a separate fiduciary for the policy, not the employer's processor, so its own notice governs claims. And Form 124 brings in third parties: the employee must give the landlord's PAN where annual rent exceeds ₹1,00,000. Keep it in the tax file only.

Performance and monitoring

Our monitoring article covers what may be watched. The lifecycle point is accuracy. Ratings, improvement plans and calibration notes are used "to make a decision that affects the Data Principal", so s.8(3) applies. In our view that means recording the evidence for a rating, keeping drafts and peer comments out of the final record, and having a manager review any algorithmic score before it drives pay or exit.

Leave and medical data

Maternity benefit now sits in Chapter VI of the Code on Social Security (ss.59 to 72). A woman claiming it gives written notice (s.62(1)), and payment follows proof of pregnancy and of delivery as prescribed (s.62(5)). That proof, sick certificates and crèche records (s.67) are health and family data. Keep the outcome (leave dates, entitlement) in the HR record and the evidence in a restricted store with its own access log.

For disability, every establishment, private ones included, must notify an equal opportunity policy (RPwD Act, s.21(1)); the reasonable-accommodation duty in s.20(2) binds Government establishments. Ask for disability information only to deliver an adjustment the employee requests, and record the adjustment, not the diagnosis. Employee assistance counselling should reach the employer as usage numbers only; where a counsellor treats mental illness, s.23 of the Mental Healthcare Act, 2017 binds that professional to confidentiality.

Investigations and POSH inquiries

Inquiries into fraud, data theft or harassment involve complainants, respondents and witnesses, not all of them employees. A complainant under the POSH Act is "a woman, of any age whether employed or not" (s.2(a)), so a client's employee or a visitor falls outside s.7(i). In our view two exemptions do the work.

• Section 17(1)(c) covers processing in the interest of investigating "any offence or contravention of any law". Its words reach beyond crimes. A POSH inquiry asks whether s.3(1) of the POSH Act ("No woman shall be subjected to sexual harassment at any workplace") was contravened; a fraud inquiry asks whether an offence was committed. Consistent with Trayambic's view that the clause turns on purpose rather than on who processes, an employer can rely on it. It does not reach a pure policy breach with no law in view, such as a missed target; s.7(i) covers that for staff.
• Section 17(1)(a) takes over once there is a claim: recommendations open to appeal within 90 days (POSH s.18(2)), a dismissal likely to be challenged, or a recovery claim.

While they apply, notice, rights and s.8(7) erasure are lifted; accountability and security are not (ss.8(1), 8(5)). Four limits follow, in our view. Record on each file the contravention or claim relied on. The exemption ends with the inquiry, appeal window or litigation. The respondent's entitlement to the complaint comes from the POSH Rules (a copy within seven working days, r.7(2)) and natural justice, which the exemption does not displace. And although s.17(1) lifts the breach-notice duty for the inquiry processing itself, a staff file also serves the business under s.7(i); applying our breach whitepaper's reasoning, treat a leak as notifiable.

POSH adds its own rule. Section 16 bars publishing or making known to "the public, press and media" the complaint, the identities and addresses of the woman, respondent and witnesses, the proceedings, the recommendations and the action taken. The penalty follows the service rules or, failing them, ₹5,000 recovered by the employer (s.17; r.12). In our view the employer is the fiduciary for Internal Committee files, because it constitutes the committee (s.4) and must supply it with information (s.19(f)). The external member should sign handling terms, files should sit where only committee members can open them, and the employer's annual report should carry numbers only (s.22).

Exit, settlement and references

Final wages are due within two working days of removal, dismissal, retrenchment or resignation (Code on Wages, s.17(2)). A review of a leaver's recent activity for data loss fits s.7(i)'s "safeguarding the employer from loss", in our view, if limited to company systems and the last few weeks.

A reference is a disclosure to another fiduciary, so s.8(3)(b) applies. Act on the former employee's written authorisation, usually forwarded by the verifier, confirm only facts on file, and log what was said. A "do not rehire" flag also drives a later decision: give it a factual reason, an owner and an end date.

Alumni and former-staff requests

When employment ends, so does most of s.7(i). An alumni network, rehiring list or newsletter needs consent, or s.7(a) where a former employee signs up for a stated purpose.

On our reading, former employees whose data was processed only under s.7(i) have no statutory right of access or correction. Data given under consent or s.7(a), such as background-check consents, carries those rights, and every fiduciary must run a grievance channel (s.13) answered within 90 days (Rule 14). We recommend answering requests voluntarily, starting with a standard leaver pack: final payslip, tax certificate, service certificate and provident fund details. Where a claim is live or reasonably anticipated, the material held for it falls under s.17(1)(a), but only that material.

Family members, nominees and dependants

The Code on Social Security defines "family" to include a spouse, dependent children, dependent parents (including the parents-in-law of a woman employee) and, in some cases, a minor sibling (s.2(33)). Nominations, insurance cover, crèche use and emergency contacts bring them into HR systems. Each is a data principal.

In our view s.7(i) covers this data because it is framed by purpose: a benefit "sought by" the employee, though the data is someone else's. Section 7(a) does not fit, because the family member did not provide it. Four consequences follow.

1. 1.Families never see the employer's materials, so add a family paragraph to the enrolment screen and ask the employee to share it.
2. 2.Children bring in s.9(1). Rule 10(1)(a) lets a fiduciary rely on reliable identity and age details it already holds; in our view an onboarded employee's declaration through an authenticated HR portal meets that for her own child. Where the employee is not the parent or guardian, ask the guardian.
3. 3.A wellness or learning app offered to employees' children as a benefit must respect s.9(3): no tracking, behavioural monitoring or targeted advertising.
4. 4.A benefit nominee is not a nominee under s.14 of the DPDP Act, who exercises rights after death or incapacity, as Trayambic's rights article explains.

Erase dependants' data when cover ends, subject to the benefit rules.

Interns under 18

Anyone under 18 is a child (s.2(f)). Whether s.7(i) covers an unpaid intern is untested; s.9(1) applies regardless, so verifiable parental consent comes first. The employer rarely holds the parent's details, so use Rule 10(1)(b): details the parent provides, or a virtual token from an authorised entity such as a DigiLocker provider, as our parental-consent blog explains.

Section 9(3) is the harder duty. Part A of the Fourth Schedule exempts health providers, schools, crèches and child transport, not employers, and Part B's purposes do not cover workplace analytics. In our view productivity analytics, screenshots and behavioural risk scoring must be switched off for under-18 accounts. Access logs that Rule 6 requires are security records, not behavioural monitoring, and can stay if nobody profiles them. When an intern turns 18, seek her own consent, or rely on s.7(i) if she joins the payroll.

Cross-border HR systems

Global HR platforms and parent-company directories make most mid-size HR data cross-border. As of October 2026 no country is restricted under s.16(1); s.16(2) preserves stricter sector rules, which matter for regulated employers such as banks; and Rule 15 lets the Centre set requirements, by order, on making data available to foreign States. In Trayambic's view remote access from abroad is a transfer and no standard contractual clauses are needed, as our cross-border article explains.

The question that matters is role. A parent running your HR platform on your instructions is your processor. A parent using your staff data for its own purposes, such as a global talent review, is a separate fiduciary needing its own ground. Write that split into the intra-group agreement. Section 17(1)(d), on non-residents' data, does not help.

Labour Code and other record periods

Two cautions. The Central Rules govern establishments for which the Centre is the "appropriate Government", such as banking and insurance companies and central public sector undertakings (Code on Wages, s.2(d)); most private employers answer to State rules, which may set their own periods. And a period covers only the records it names.

Worked example: a 1,200-person IT services company

All facts and figures are illustrative. An IT services company with 1,200 staff in Hyderabad and Kochi serves US and UK clients, hires about 350 people a year, takes six 17-year-old interns each summer and uses an HR platform its US parent hosts abroad.

1. 1.Map. HR finds 14 systems holding staff data, from the applicant tracker to the Internal Committee's shared drive, each tagged by stage, ground and owner.
2. 2.Grounds. s.7(i) for core HR; s.7(d) for provident fund, ESI and TDS filings; consent for background checks, recorded interviews and alumni; a s.17(1) note on every inquiry file.
3. 3.Family. The benefits screen carries a four-line family notice; children's details come only through the employee's authenticated portal; emergency contacts are limited to name, relationship and phone number.
4. 4.Interns. Parents consent through a DigiLocker-verified form. Intern laptops sit in a device group with the productivity module disabled; security logging stays.
5. 5.An inquiry. A client's employee visiting the Kochi office complains of harassment by a company engineer. Section 7(i) cannot cover her data. The Internal Committee records s.17(1)(c), and the respondent receives the complaint within seven working days. After the recommendations, the file moves under s.17(1)(a) for the 90-day appeal window. When that closes, the final report and action taken stay in the engineer's disciplinary record and the rest is erased.
6. 6.Parent company. The intra-group agreement makes the parent a processor for HR operations and a fiduciary only for its global talent review, which receives grade and rating, not salary or medical data.
7. 7.Exit. A dismissed engineer asks for "all my data". The company sends the leaver pack and his HR file within 30 days, holds the data-loss evidence under s.17(1)(a) because he has threatened suit, and tells him how to raise a grievance.
8. 8.Retention. Registers follow the State rules for each office; books eight years; logs one year; rejected candidates six months.

Compliance framework

Phased roadmap to 13 May 2027

• Now to December 2026: map and owners; no new HR data fields without a stated purpose.
• January to March 2027: grounds register, notices, segregated stores, and intern and investigation protocols before the summer intake.
• April to 13 May 2027: retention jobs tested and switched on; vendor and intra-group terms signed; leaver pack live.
• After 13 May 2027: first purge with evidence; annual review of each stage; watch Rule 15 orders and State rules under the Labour Codes.

Recommendations

1. 1.Run HR privacy by stage: each has its own ground, notice, retention and risk.
2. 2.Treat family members as data principals: tell them, take less, and verify parents through the employee's authenticated account.
3. 3.Build an under-18 configuration into device and monitoring tools before the next intake.
4. 4.Put every inquiry on a written footing: the contravention or claim relied on, who may see the file, and when the exemption ends.
5. 5.Make exit a deletion event: pay on time, hand over a leaver pack, confirm only facts in references, and erase what no law requires.
6. 6.Answer former employees' requests even where the Act may not require it; a refusal invites a costlier dispute.

Key takeaways

• No single ground covers the employee lifecycle: s.7(i) carries most of it, but candidates and alumni rest on consent or s.7(a), statutory filings on s.7(d) and, in our view, internal inquiries on s.17(1)(c) and then s.17(1)(a).
• Dependants, nominees and emergency contacts are data principals; for children among them, an employee-parent's authenticated declaration can meet Rule 10(1)(a), in our view.
• Interns under 18 need verifiable parental consent, and s.9(3) means behavioural monitoring tools must be switched off for them.
• POSH files combine s.16 confidentiality with DPDP security duties, and the s.17(1) exemptions last only as long as the inquiry, appeal window or claim.
• Exit should be a deletion event: final pay within two working days, a leaver pack, fact-only references under s.8(3), and registers kept only for the period the applicable rules set.