Employment data often needs no consent under the DPDP Act — but other duties still apply.
Section 7 lets you use employee data for employment purposes without asking for consent. The Section 5 notice duty is tied to a consent request, so it applies when you do ask for consent. Telling staff what you collect is still good practice.
Check your organisation's DPDP role — take the check →
Do these first. 1. Good practice: tell new staff what data you keep about them, and why. 2. Good practice: tell staff before you start any monitoring. 3. Good practice: ask for separate consent for background checks. 4. Good practice: write down how you tested any AI hiring tool for bias. 5. Law: follow the children's data rules for any intern under 18.
What matters most for you
Common situations
AI-assisted resume screening
Employee monitoring without disclosure
Onboarding data collection
Background verification
Start here
DPDP Applicability & Action Check
Eight questions to place your organisation, plus the notice and safeguard checklist that follows.
OpenDeep dives
Notice and consent
When a notice is needed, and when Section 7 removes the need for consent.
ReadEmployee rights requests
How staff can see, fix or delete their data.
ReadRetention and erasure
How long HR records may be kept, and statutory overrides.
ReadAI governance in hiring
Fairness, testing, and human oversight for screening tools.
ReadRun the readiness checklist
Notices, rights requests, retention, and breach response — mapped to HR data flows.
Run it nowWritten by Sandesh Kokate, reviewed against primary sources.Connect on LinkedIn →