Every keystroke tracker, every CCTV camera, every biometric scanner in the workplace processes personal data under the DPDPA. AMLEGALS builds the notice, lawful-basis and retention architecture that lets employers monitor within the statute while meeting Labour Code obligations.
Employers have always monitored employees. What the DPDPA changes is that every monitoring activity — email surveillance, productivity tracking, biometric attendance, CCTV footage, location tracking of field staff, wellness-programme health data, performance analytics — is now a regulated data processing activity with notice, lawful-basis and safeguard obligations. The employer is the Data Fiduciary and the employee is the Data Principal with rights under Sections 11–14.
AMLEGALS advises employers across sectors on building DPDPA-compliant employee monitoring and HR analytics frameworks. The practice covers the full spectrum: device and email monitoring policies, productivity-tracking notice architecture, biometric data governance, CCTV workplace policies, background verification consent frameworks, performance and wellness analytics boundaries, post-exit data retention schedules calibrated to Labour Code statutory periods and DPDPA erasure obligations, and the interaction between Section 7 legitimate use and Section 6 consent for different monitoring purposes.
Drafting comprehensive monitoring policies covering email, device, productivity, CCTV and location tracking with Section 5 notice and lawful-basis mapping.
Structuring the notice, lawful-basis and safeguard framework for fingerprint, facial recognition and iris-scan attendance systems.
Assessing which HR analytics activities (performance scoring, attrition prediction, wellness monitoring) require consent versus legitimate use, and where proportionality limits apply.
Building the consent, notice and retention framework for pre-employment and periodic background verification data.
Calibrating employee data retention to Labour Code statutory periods, limitation periods for potential disputes and DPDPA erasure obligations.
Auditing the overlap between Labour Code record-keeping obligations and DPDPA notice, safeguard and erasure requirements.
Employee email and device monitoring involves processing personal data. Under the DPDPA, the employer (Data Fiduciary) must provide an itemised Section 5 notice explaining the monitoring purpose, scope and extent. The lawful basis is typically Section 7 legitimate use (employment purpose) for monitoring necessary for security, compliance or performance management. However, monitoring that goes beyond what is reasonably necessary for the stated purpose — such as tracking personal browsing during breaks — may not be covered by the employment legitimate-use basis and would require separate consent under Section 6.
Software that tracks keystrokes, screenshots, application usage, mouse movements or active/idle time processes personal data of the employee. Each tracking dimension requires a specific Section 5 notice. The employer must demonstrate that the monitoring is proportionate to a legitimate purpose (security, performance management, compliance) and not excessive. The DPDPA does not explicitly codify proportionality, but Section 33 factors (including nature of contravention and proportionality) will guide Board adjudication of complaints.
Section 38 of the DPDPA provides that the Act applies in addition to other laws. The Labour Codes (Code on Wages 2019, Industrial Relations Code 2020, Code on Social Security 2020, Occupational Safety Code 2020) require employers to maintain certain employee records (wages, attendance, leave, safety). Processing personal data for these statutory obligations falls under Section 7 legitimate use (compliance with law). The DPDPA obligation — notice, safeguards, retention limits — applies on top of the Labour Code obligation to maintain records.
Pre-employment and periodic background verification involves processing personal data including criminal records, education credentials, previous employment and reference checks. The employer must provide a Section 5 notice explaining the verification purpose and scope. Consent under Section 6 is typically required because background verification goes beyond the employment contract itself. The data should be retained only as long as necessary and destroyed when the verification purpose is fulfilled.
The DPDPA does not prescribe specific retention periods. Section 8(7) requires the Data Fiduciary to erase personal data when the purpose is fulfilled and consent is withdrawn or the Data Principal has not approached the Data Fiduciary for the specified purpose within a prescribed period. Post-exit retention should be calibrated to statutory requirements (provident fund records, gratuity records, tax records under specific retention periods) and legitimate business purposes (defending potential labour disputes within the limitation period).
No. No engagement is treated as accepted until conflicts, scope and terms are confirmed in writing.
Share the monitoring profile for a confidential assessment of workplace data privacy requirements.