Employee and HR Data Privacy: Payroll, KYC, Medical and Exit Records
Reviewed by CA Nikhil Gupta · Last reviewed 29 May 2026
An HR-data control framework for recruitment, payroll, attendance, background checks, medical records, performance and employee exit.
For broader context, see the Employee Data Privacy and Digital HR Hub.
Employee data is operationally essential but easily overexposed because HR, payroll, managers, insurers, consultants and IT administrators all touch it.
The DPDP framework is phased. The 14 November 2025 commencement notification brought specified institutional and enabling provisions into force immediately; section 6(9), section 27(1)(d) and rule 4 follow after one year; most operating duties and rules follow eighteen months after Gazette publication. As of 22 June 2026, readiness should distinguish current law from future-state DPDP controls.
The Act includes legitimate uses relevant to employment and protecting employers from loss or liability, but the exact provision and commencement must be applied carefully.
Employment records should remain purpose-limited, secure, accurate and retained only as required by employment, tax, social-security, dispute and other law.
Medical, disciplinary, background-check and compensation data require stronger segmentation even though the Act does not use the older sensitive-data category.
What the organisation should understand
- The DPDP framework is phased. The 14 November 2025 commencement notification brought specified institutional and enabling provisions into force immediately; section 6(9), section 27(1)(d) and rule 4 follow after one year; most operating duties and rules follow eighteen months after Gazette publication. As of 22 June 2026, readiness should distinguish current law from future-state DPDP controls.
- The Act includes legitimate uses relevant to employment and protecting employers from loss or liability, but the exact provision and commencement must be applied carefully.
- Employment records should remain purpose-limited, secure, accurate and retained only as required by employment, tax, social-security, dispute and other law.
- Medical, disciplinary, background-check and compensation data require stronger segmentation even though the Act does not use the older sensitive-data category.
- Former employees remain data principals; exit should revoke access and trigger retention or deletion decisions.
For the connected rule, example or next step, see Fintech Data Sharing: Loan Apps, Consent and Grievance Records.
The five-point review
| Check | What to examine |
|---|---|
| Stage | Applicant, employee, contractor or former employee. |
| Purpose | Hiring, payroll, benefits, safety or defence. |
| Access | HR, manager, vendor, insurer and IT. |
| Retention | Statutory, contractual and dispute needs. |
| Exit | Account, device, mailbox and records. |
For the connected rule, example or next step, see Aadhaar and KYC Data: Biometric Lock, Masking and Storage Caution.
Practical example
A manager receives a spreadsheet containing every employee’s salary, bank account, PAN and medical claim to approve one team bonus. A role-specific report should remove unrelated fields.
How to apply the framework
Build an HR-record schedule by document type. Separate the employee master from restricted medical, grievance and investigation files.
Contract payroll, benefit and background vendors according to their role and require access revocation, return or deletion when services end.
Operating workflow
Define the processing or incident precisely
Identify the people, data, system, purpose, owner, vendor and transaction or event. Review stage, purpose and access together. Do not start from a policy template or software feature; start from what the business and system actually do.
Separate current duties from future-state DPDP readiness
Apply the 14 November 2025 commencement notification provision by provision. Continue complying with currently operative IT, CERT-In, telecom, banking, insurance, employment, consumer, contract and criminal-law requirements. Build the future DPDP process now, but do not describe a scheduled rule as already legally operative.
Preserve proof and improve the system
Keep the approved decision, notice or workflow version, access or event logs, vendor evidence, user communications and remediation record. Update product design, role access, retention, support scripts or incident playbooks so the same weakness does not recur.
Action checklist
- Map recruitment-to-exit data.
- Apply role-based access.
- Minimise manager reports.
- Separate medical files.
- Set retention rules.
- Complete exit checklist.
Evidence to keep
- HR processing register
- Access matrix
- Employee notices
- Vendor agreements
- Exit records
Warning signs
- Shared payroll workbook
- Personal email resumes
- Medical records visible to managers
- Background reports kept indefinitely
- Former employee access
Finin2min takeaway
Privacy governance is an operating system, not a policy PDF. The data map, purpose, access, vendor, retention, user workflow, incident response and evidence file must all tell the same story.
Frequently Asked Questions
Source and review trail
Use the current official instrument, portal or regulator publication before acting. This panel separates the category authority from page-specific references.
- Primary category
- Labour, Payroll & Social Security
- Official starting point
- labour.gov.in