Employee Monitoring Software Under DPDP: Purpose, Notice and Proportionality Control File
By Ravi Sisodia · Reviewed by CA Divyanshu Sengar · Updated 5 October 2026
2-minute summary
- Employee-monitoring tools can capture highly granular personal data: screenshots, app use, keystrokes, location, communications and productivity scores.
- Before substantive DPDP duties commence, employers should minimise monitoring and document why each data point is needed.
- Employment does not create an unlimited surveillance exemption; proportionality and labour/contract expectations still matter operationally.
Current position
Control and evidence map
| # | Control / evidence requirement | |
|---|---|---|
| 1 | List each monitoring feature and turn off fields that are not needed for security, attendance or a defined management purpose. | |
| 2 | Separate security telemetry from performance scoring; they have different risk and governance consequences. | |
| 3 | Inform employees through policy and tool-specific notices with practical examples of what is captured. | |
| 4 | Limit access to raw screenshots/messages and avoid broad manager browsing rights. | |
| 5 | Set deletion periods and a challenge/escalation route for automated or inaccurate productivity indicators. | |
Worked example
A remote-work tool captures screenshots every two minutes and also calculates a productivity score. The employer’s security need may justify a much narrower dataset than continuous screen capture. A better design could retain login/security events for a defined period while restricting screenshots to exceptional investigations, with governance around who can view them.
Common mistakes
- Buying a tool first and defining purpose later.
- Treating employees as having no privacy expectations at work.
- Using opaque scores for disciplinary action without human review.
- Collecting personal messaging content when system metadata would meet the security need.
Frequently asked questions
Does DPDP fully apply to employee monitoring today?
Most core duties are not yet commenced as of 5 October 2026, but transition preparation is necessary.
Should every feature in the tool be enabled?
No.
Can productivity scores be treated as fact?
They should be validated and reviewed in context.
What should be documented?
Purpose, data fields, access, retention, review process and employee communications.
Official sources
- Ministry of Electronics and Information Technology - Digital Personal Data Protection Act, 2023 (Act 22 of 2023; 2023-08-11)
- Ministry of Electronics and Information Technology - Digital Personal Data Protection Rules, 2025 (G.S.R. 846(E); 2025-11-13)
- Ministry of Electronics and Information Technology - DPDP Act commencement notification (G.S.R. 843(E); 2025-11-13)
Disclaimer
Educational and professional reference only; confirm the current law, rates and the facts of your case before relying on this page.