A data breach can become a legal, financial and reputational crisis within hours. For Indian businesses, data breach response for businesses now requires more than technical containment. Organisations must assess the incident, preserve evidence, determine applicable reporting duties and coordinate legal, security and business teams. The regulatory landscape is also evolving. India's Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025 introduce a dedicated framework for personal data breaches, while CERT In continues to impose separate cyber incident reporting obligations. A strong response therefore starts before an incident occurs. Businesses need a tested response plan, clear responsibilities, reliable logs and a process for making fast legal decisions. What Is a Data Breach? A personal data breach generally involves unauthorised processing or accidental disclosure, acquisition, sharing, use, alteration, destruction or loss of access to personal data in a manner which compromises its confidentiality, integrity or availability. A breach does not always involve a sophisticated cyberattack. A phishing attack, misdirected email, exposed database, stolen laptop, compromised employee account or careless vendor can create a reportable incident. Businesses should also distinguish between a cybersecurity incident and a personal data breach. A system outage may not involve personal data. A stolen database may involve both a cybersecurity incident and a personal data breach. This distinction matters because different legal and regulatory reporting duties can apply at the same time. India’s Legal Framework for Data Breach Response Indian businesses may face several overlapping legal requirements following a security incident. The Digital Personal Data Protection Act, 2023 creates obligations for Data Fiduciaries concerning reasonable security safeguards and personal data breach notification. Section 8 requires a Data Fiduciary to take reasonable security safeguards to prevent personal data breaches. Section 8(6) also provides for intimation of a personal data breach to the Data Protection Board and affected Data Principals. The DPDP Rules, 2025 provide operational detail concerning breach notifications. Rule 7 requires a Data Fiduciary, on becoming aware of a personal data breach, to notify affected Data Principals without delay. The Data Protection Board must also be informed without delay, followed by detailed information within 72 hours unless a longer period is permitted. However, businesses should not assume the DPDP regime has replaced all existing cyber incident requirements. The CERT In Directions issued under Section 70B of the Information Technology Act, 2000 continue to require specified cyber incidents to be reported within six hours of noticing the incident or being informed about it. CERT In expressly identifies data breaches and data leaks among incidents requiring reporting. The result is a potentially overlapping reporting environment. The Two Regulatory Clocks Businesses Must Understand One of the most important practical lessons for businesses is to avoid treating breach reporting as a single deadline. The CERT In framework operates on a six hour reporting requirement for covered cyber incidents. CERT In's official FAQs clarify that an organisation may initially provide the information available within the reporting period and supplement it later. This means uncertainty about the full scope of an incident should not automatically become a reason for delaying a required report. The DPDP Rules create a separate process for personal data breaches. Affected Data Principals must be informed without delay. The Data Protection Board must also receive an initial intimation without delay, followed by detailed information within 72 hours, subject to the applicable rules and any extension permitted by the Board. Businesses should therefore build their incident response process around parallel regulatory assessments, rather than waiting for one investigation to finish before considering another reporting obligation. Step One: Activate the Incident Response Team The first legal step after detecting a potential breach is to activate the organisation's incident response structure. The team should normally include representatives from information security, IT, legal, compliance, senior management and communications. Depending on the incident, HR, finance, insurance, forensic specialists and external counsel may also be required. One person should have clear authority to coordinate the response. Confusion over responsibility can waste valuable time during the first few hours. Businesses should maintain an updated contact list for legal counsel, forensic specialists, cybersecurity providers, insurers, CERT In and relevant sector regulators. CERT In itself recommends maintaining current contacts and having response arrangements in place before an incident occurs. Step Two: Contain the Incident Without Destroying Evidence Containment is essential, but businesses should avoid making rushed technical changes which destroy useful evidence. The security team may need to isolate affected systems, disable compromised accounts, revoke credentials, block malicious access and preserve affected infrastructure. Legal and forensic teams should coordinate evidence preservation. Relevant logs, access records, emails, system images, authentication records and communications should be retained where appropriate. This is particularly important if litigation, regulatory proceedings, insurance claims or law enforcement investigations may follow. CERT In has specifically advised organisations to preserve logs when suspicious activity is identified and to report relevant information as required. Step Three: Establish What Happened The next stage is incident classification. The organisation should determine when the incident began, when it was detected, which systems were affected and whether unauthorised access actually occurred. The investigation should identify the categories of information involved. Customer contact details create different risks from financial information, identity documents, authentication credentials, health information or information relating to children. The organisation should also establish whether the information was merely exposed, actually accessed, copied, altered, destroyed or transferred. A preliminary assessment should be documented even when the investigation remains incomplete. Step Four: Determine Whether Personal Data Is Involved Not every cyber incident creates a personal data breach. For example, a denial of service attack may disrupt business operations without exposing personal information. Conversely, a compromised employee account may provide access to customer records even if no evidence of mass extraction has yet been found. Businesses should therefore map affected systems to the categories of personal data stored within them. The assessment should also consider whether the organisation is a Data Fiduciary, whether another entity is involved as a Data Processor and whether the affected data belongs to customers, employees, applicants, suppliers or other individuals. This distinction can affect contractual responsibilities and notification strategy. Step Five: Assess CERT In Reporting Obligations Businesses covered by the CERT In Directions should assess whether the incident falls within the specified reporting categories. The official CERT In Directions require covered entities to report specified cyber incidents within six hours of noticing them or being brought to notice. The official CERT In FAQs further clarify that data breaches and data leaks fall within the incidents requiring reporting. They also recognise situations where all information may not be available within the initial six hour period. Available information can be provided first, with additional information supplied later. Businesses should therefore avoid waiting for a perfect forensic report before making a legally required preliminary report. CERT In Cyber Security Directions and official guidance Step Six: Assess DPDP Notification Requirements Where the DPDP Act and Rules are applicable, the organisation must assess its obligations towards affected Data Principals and the Data Protection Board. Rule 7 requires affected Data Principals to receive information without delay. The notification should explain the nature, extent and timing of the breach, likely consequences, mitigation measures, safety steps the individual can take and relevant contact information. The Board notification process requires an initial intimation without delay and a detailed report within 72 hours, subject to the possibility of an extension permitted by the Board. This makes advance preparation extremely valuable. Businesses should maintain draft notification templates and an internal approval process before an incident occurs. Step Seven: Consider Sector Specific Reporting Duties A breach may trigger obligations beyond the general cyber and data protection frameworks. Banks and financial institutions may have reporting requirements under RBI regulations. Listed entities may face SEBI requirements. Insurance businesses may have IRDAI obligations. Other regulated sectors can have their own incident reporting frameworks. A business should therefore maintain a regulatory matrix covering the sectors and jurisdictions in which it operates. A single incident can create several reporting obligations with different thresholds, authorities and deadlines. Step Eight: Manage Third Party and Vendor Breaches Many businesses assume a vendor breach is solely the vendor's problem. This approach can create serious legal risk. Cloud providers, payroll companies, SaaS platforms, payment processors, marketing providers, background verification agencies and outsourced IT providers may process personal data on behalf of a business. The organisation should therefore know which vendors hold personal data and how quickly they must report incidents to the business. Vendor contracts should contain appropriate incident notification, cooperation, security, investigation, evidence preservation and remediation provisions. A business should also maintain an escalation process for vendor incidents so legal and security teams are notified immediately. Step Nine: Preserve Legal Privilege Where Appropriate A serious breach can lead to regulatory inquiries, litigation, customer claims and insurance disputes. Businesses should consider involving legal counsel early. Legal counsel can help structure the investigation, identify reporting obligations, manage communications and assess potential exposure. The organisation should also distinguish legal advice from ordinary technical or operational communications. Confidentiality and privilege considerations can become complicated if investigation material is widely circulated internally. A clear legal response structure can help reduce unnecessary disclosure of sensitive investigative information. Step Ten: Control External Communications A breach creates pressure to communicate quickly. Speed matters, but accuracy matters too. Businesses should avoid making speculative statements about the cause, number of affected individuals or identity of attackers before the facts are established. Customer notifications should be clear, factual and useful. Individuals should understand what happened, what information may be affected, what the business has done and what protective steps they should consider. Communications should be coordinated between legal, security, management and public relations teams. Overly technical language can confuse customers. Overly reassuring language can create credibility problems if later facts are different. Step Eleven: Assess Contracts and Insurance A breach can trigger contractual obligations even when no regulator becomes involved. Customers may require immediate notification under commercial agreements. Technology vendors may have contractual incident reporting duties. Insurance policies may contain strict requirements concerning notification, approved forensic providers and cooperation. Businesses should therefore review relevant contracts and cyber insurance policies as part of the response. Failing to follow contractual or insurance procedures can create additional financial exposure. Step Twelve: Document Every Major Decision Incident response is not only about what the organisation does. It is also about demonstrating why it made particular decisions. Businesses should maintain an incident chronology recording key events, assessments, notifications, containment measures and remediation steps. The record should explain important decisions such as why a notification was made, why a particular regulator was contacted, what information was initially available and how the organisation responded as new facts emerged. Good documentation can become valuable evidence of responsible governance. Penalties for Data Breach Failures The financial consequences under the DPDP Act can be substantial once the relevant provisions become operative. The Schedule to the Act provides for penalties of up to ₹250 crore for failure to take reasonable security safeguards to prevent personal data breaches. Failure to notify the Board or affected Data Principal can attract a penalty of up to ₹200 crore. These figures represent statutory maximum penalties rather than an automatic fine for every incident. Businesses should also consider the wider consequences. A breach can cause customer claims, contractual disputes, regulatory scrutiny, operational disruption, investigation costs and reputational damage. The Importance of a Pre Incident Response Plan The best time to design a breach response plan is before an incident occurs. A useful plan should identify the incident response team, escalation procedures, forensic contacts, legal contacts, notification templates, regulatory contacts, communication protocols and evidence preservation requirements. The plan should also distinguish between cyber incidents and personal data breaches. CERT In has recommended structured incident response planning, regular cyber drills and post incident reviews. Tabletop exercises can reveal practical weaknesses. For example, a company may discover during a simulation that nobody knows who can approve a regulatory notification or which vendor holds the affected database. Post Incident Remediation Closing the incident is not the same as completing the response. After containment, the organisation should determine the root cause and identify control failures. Was the breach caused by a stolen password? Was multi factor authentication missing? Did a vendor have excessive access? Was sensitive data stored without adequate protection? Did employees lack appropriate training? The organisation should convert these findings into corrective actions with owners and deadlines. Post incident remediation can include access control changes, security testing, employee training, vendor reassessment, policy updates and system redesign. The organisation should also consider whether its data breach compliance framework needs to be updated based on lessons from the incident. How Businesses Can Reduce Future Breach Risk Effective prevention begins with understanding where personal data exists. Businesses should maintain data inventories, restrict unnecessary access, establish retention rules and regularly review third party access. Technical safeguards should be supported by governance. Security controls are less effective when nobody knows who owns the underlying risk. Regular testing is also important. Businesses should assess their applications, cloud infrastructure, authentication systems and APIs for weaknesses. Employee awareness remains equally important. Phishing, credential theft and social engineering continue to create significant risks. Incident response should therefore form part of broader corporate risk management, rather than being treated as an IT only function. Current Position During DPDP Implementation Businesses should be careful when describing the DPDP Act as fully operational. The Government notified the DPDP Rules, 2025 on 13 November 2025 and adopted a phased commencement structure. The core provisions concerning processing obligations, rights and several substantive duties have a later commencement date under the notification. This does not mean businesses should wait. CERT In's existing cyber incident reporting framework continues to matter now. Businesses may also have contractual and sector specific obligations independent of the DPDP Act. The transition period is therefore an opportunity to build a mature incident response system before the full DPDP compliance regime becomes operational. Conclusion A data breach should never be treated as only an IT problem. It can quickly become a legal, regulatory, contractual and reputational event. The most effective data breach response for businesses combines technical containment with legal assessment, evidence preservation, regulatory reporting and controlled communications. Indian businesses should pay particular attention to the different regulatory timelines. CERT In reporting can require action within six hours for covered cyber incidents, while the DPDP Rules provide separate notification requirements for personal data breaches. Preparation is therefore critical. A tested incident response plan, clear ownership, reliable logs, vendor controls and prepared notification procedures can significantly improve an organisation's ability to respond when an incident occurs. Frequently Asked Questions What should a business do immediately after discovering a data breach? The business should activate its incident response team, contain the incident, preserve relevant evidence, assess whether personal data is involved and identify applicable regulatory reporting requirements. Legal counsel and forensic specialists should be involved where appropriate. Does every data breach have to be reported to CERT In? Not every operational problem is necessarily a reportable cyber incident. Businesses should assess the incident against the categories covered by the CERT In Directions. CERT In's official guidance expressly includes data breaches and data leaks among incidents requiring reporting. How quickly must a business report a cyber incident to CERT In? Covered cyber incidents must generally be reported to CERT In within six hours of noticing the incident or being brought to notice. What is the DPDP breach notification timeline? Under Rule 7 of the DPDP Rules, 2025, affected Data Principals must be notified without delay. The Data Protection Board must also be informed without delay, followed by detailed information within 72 hours, subject to the applicable rules and any extension permitted by the Board. Can a company wait until the investigation is complete before reporting? Not necessarily. Waiting for a complete forensic investigation can create regulatory risk where a reporting deadline has already started. CERT In specifically permits available information to be submitted initially, with additional information provided later. Who should lead a data breach response? The response should be coordinated through a designated incident response structure involving security, IT, legal, compliance and senior management. The appropriate participants will depend on the nature and scale of the incident. What if a third party causes the breach? The business should immediately assess the vendor's contractual duties, contain the incident, obtain relevant evidence and determine whether the business itself has notification or regulatory obligations. Vendor contracts should include clear incident reporting and cooperation requirements. Should customers always be notified after a data breach? Customer notification depends on the applicable legal and regulatory framework and the nature of the incident. Where the DPDP Rules apply, affected Data Principals must be notified without delay in accordance with Rule 7. What penalties can apply for failing to report a personal data breach under the DPDP Act? The DPDP Act provides for a penalty of up to ₹200 crore for failure to notify the Board or affected Data Principal of a personal data breach. Failure to take reasonable security safeguards can attract a penalty of up to ₹250 crore. Is a data breach response plan legally necessary? A written response plan is an important governance measure even where a particular law does not prescribe a document with that exact title. CERT In guidance encourages structured incident response planning, cyber drills and post incident reviews. How can businesses prepare for the DPDP breach notification requirements? Businesses should map personal data, identify responsible teams, establish escalation procedures, prepare notification templates, review vendor contracts, establish evidence preservation procedures and conduct tabletop exercises. Does the DPDP Act replace CERT In reporting? No. The two frameworks address different aspects of the regulatory environment. Businesses may have obligations under both, depending on the nature of the incident and their activities. CERT In's six hour reporting requirement can operate alongside DPDP breach notification requirements.

Employee data privacy is no longer only an HR policy issue. Employers collect extensive personal information during recruitment, onboarding, payroll, performance management, benefits administration and exit formalities. As India moves towards full implementation of the Digital Personal Data Protection Act, 2023, businesses must understand how employee information is collected, used, stored, shared and deleted. For employers, employee data privacy for employers now requires coordination between HR, legal, IT, information security and senior management. India's privacy framework is also moving through a transition period. The Digital Personal Data Protection Act, 2023 was enacted on 11 August 2023. The Government notified the Digital Personal Data Protection Rules, 2025 on 13 November 2025. Several provisions are being introduced in phases, with the core processing provisions scheduled to commence 18 months after the November 2025 notification. Why Employee Data Privacy Matters for Employers? HR departments handle some of the most commercially and personally significant information within an organisation. Employee records may include names, addresses, contact details, identification documents, bank account information, salary records, tax information, health and insurance details, attendance records, photographs, performance reviews and background verification information. Modern workplaces also generate digital records through access control systems, CCTV, company email, endpoint security tools, attendance applications, collaboration platforms and employee monitoring software. Remote working and Bring Your Own Device arrangements can increase the volume and complexity of personal data processing. Recent legal commentary on workplace monitoring highlights the need to consider both the purpose and scope of such monitoring. The risk is not limited to external cyberattacks. Unauthorised internal access, excessive data collection, inappropriate sharing with vendors, poor retention practices and unsecured spreadsheets can also expose an organisation to legal and operational risk. The Indian Legal Framework Governing Employee Data The constitutional right to privacy forms an important background principle. The Supreme Court recognised privacy as a constitutionally protected right under Article 21 in Justice K.S. Puttaswamy v Union of India. For private employers, however, practical obligations also arise through legislation, contracts, confidentiality duties and data protection requirements. The Digital Personal Data Protection Act, 2023 is India's principal comprehensive framework for digital personal data. Under the Act, an employer generally acts as a Data Fiduciary because it determines the purpose and means of processing employee information. Employees are Data Principals in relation to their personal data. The DPDP Act creates two principal grounds for processing personal data: consent and certain legitimate uses. Importantly for HR departments, Section 7 recognises processing necessary for employment purposes and certain activities connected with safeguarding the employer from loss or liability as a legitimate use. This means employers should not assume consent is required for every HR activity. At the same time, the employment related provision should not be treated as a blanket exemption. Processing must still be connected with the relevant legitimate purpose. Employers should distinguish between necessary employment processing and additional activities such as optional profiling, intrusive monitoring or unrelated secondary uses.The Information Technology Act, 2000 and the Information Technology Rules concerning reasonable security practices and sensitive personal data or information remain relevant during the transition. The existing SPDI framework covers categories such as financial information, health information, biometric information and certain other sensitive information. The legal position is therefore transitional rather than a simple switch from one regime to another. Businesses should monitor the commencement notifications carefully instead of assuming every provision of the DPDP Act became operational immediately upon enactment. What Employee Data Can Employers Collect? An employer may legitimately need considerable information to establish and manage an employment relationship. Recruitment data may include CV information, qualifications, professional history, references and verification details. Onboarding may require identification documents, tax information, bank details and emergency contact information. During employment, HR may process attendance information, leave records, payroll data, benefits information, insurance details, performance assessments and disciplinary records. Some organisations also process biometric information for attendance or access control. The key question is not simply whether the organisation can collect a particular category of information. The organisation should ask why the information is required, whether the purpose is legitimate, whether less intrusive information would be sufficient, who needs access and how long the information should remain available. Data minimisation should therefore become part of everyday HR decision making. Notice and Transparency Obligations Transparency is a central part of a mature privacy programme. Employees should understand what personal data an organisation processes, why it is required and how it is handled. The notified DPDP Rules, 2025 provide important detail on privacy notices. Rule 3 requires a notice to be presented independently and in clear and plain language. It must include an itemised description of personal data and the specified purpose or purposes of processing. It must also provide relevant means for exercising rights and withdrawing consent where consent is the applicable basis. Employers should therefore review onboarding documents, HR portals, recruitment forms and employee handbooks. A generic privacy statement copied from a consumer website may not adequately explain employment related processing. A practical employee privacy notice should explain the categories of information collected, purposes of processing, relevant disclosures, retention approach, rights, grievance channels and methods for contacting the organisation. When Is Employee Consent Required? Consent remains an important legal basis under the DPDP framework, but it is not the answer to every employment processing activity. Section 7(i) of the DPDP Act permits certain processing necessary for employment and for specified purposes connected with protecting an employer from loss or liability. This can cover activities linked with employment administration, protection of trade secrets, prevention of corporate espionage and provision of benefits or services to employees. Employers should avoid using consent as a substitute for proper legal analysis. For example, collecting bank information to process salary may have a clear employment related purpose. By contrast, using employee information for an unrelated marketing activity may require a different legal basis. The employment relationship also creates a practical power imbalance. A consent mechanism should therefore not be designed as a meaningless tick box. Organisations should document why processing is necessary and identify cases where separate consent is appropriate. Employee Monitoring and Workplace Surveillance Technology has made employee monitoring easier. Employers may use CCTV, access logs, email security tools, device management systems, location information, productivity tools and cybersecurity platforms. The existence of a legitimate business purpose does not automatically make every form of monitoring proportionate. Employers should define the purpose of monitoring, restrict access, establish appropriate safeguards and communicate relevant practices to employees. Monitoring company email for cybersecurity or preventing data leakage is different from accessing an employee's personal communications. Similarly, collecting location information during working hours may require a different assessment from continuous location tracking. A good governance approach asks four questions: what is being monitored, why it is being monitored, who can access the information and when the monitoring stops. Security Responsibilities of Employers Security is one of the most important responsibilities associated with employee data. HR information should not be accessible to every employee simply because it is stored on an internal system. Organisations should implement appropriate technical and organisational safeguards. These can include access controls, authentication, encryption where appropriate, secure backups, audit logs, vulnerability management and employee awareness programmes. Vendor access also requires careful control. Payroll providers, background verification agencies, HR technology platforms, insurers and cloud service providers may process employee information on behalf of an employer. Contracts should clearly address permitted processing, confidentiality, security measures, incident management, access controls and deletion or return of information. The notified DPDP Rules provide further security requirements as part of the emerging compliance framework. Retention and Deletion of Employee Information One common weakness in HR privacy programmes is indefinite retention. An organisation may retain an employee's information for years simply because nobody has decided when it should be deleted. This creates unnecessary exposure. Former employee information can remain in HR folders, email archives, cloud drives, payroll systems and vendor platforms long after the original purpose has ended. Employers should create retention schedules linked to specific categories of records. The schedule should consider employment requirements, tax obligations, labour requirements, litigation holds and other applicable legal duties. Deletion should also cover practical copies. Removing a document from the HR system is not enough if duplicate copies remain in shared drives, email accounts or third party systems. Recruitment and Former Employee Data Privacy compliance should begin before an individual becomes an employee. Recruitment teams often collect CVs, photographs, identification documents, references, assessment results and background verification information. Employers should explain why these details are being collected and avoid retaining unsuccessful candidates' information indefinitely. The same principle applies after employment ends. Exit formalities may require certain records to be retained for legitimate legal or business reasons. Other information may no longer have a continuing purpose. An effective HR privacy framework therefore covers the complete employee lifecycle, from candidate application to post employment retention. Employee Rights and Grievance Handling The DPDP Act provides rights for Data Principals, including mechanisms relating to access to information, correction and erasure, subject to the statutory framework and applicable exceptions. Employers should create an internal process for handling employee privacy requests. HR teams should know who receives a request, how identity is verified, which systems are searched, who approves the response and how the organisation records its decision. A grievance mechanism is equally important. Employees should have a clear route for raising concerns about inappropriate collection, access, disclosure or use of their information. Businesses should begin preparing these processes before the relevant provisions become fully operational rather than waiting until the statutory deadline. How Employers Can Build Stronger Employee Privacy Governance? A practical programme begins with a data inventory. HR should identify every major category of employee information and record where it comes from, where it is stored, who can access it and which vendors receive it. The next step is to map purposes. Each processing activity should have a defined business or legal purpose. Unnecessary information should be removed from forms and systems. Organisations should then review privacy notices, HR policies, vendor contracts, retention schedules and security controls. Employee monitoring practices deserve a separate review because they can create heightened privacy concerns. Training is also essential. A technically strong privacy framework can fail if HR personnel routinely send salary information to the wrong recipient or store identity documents in unsecured folders. For organisations with complex operations, employee data privacy should be integrated into wider governance rather than treated as a standalone HR document. The Role of Legal and Compliance Teams Privacy compliance is not solely an IT responsibility. Legal teams help determine the appropriate legal basis, review contracts, assess regulatory exposure and interpret changing requirements. HR teams understand the operational context. IT and security teams implement safeguards. Senior management provides oversight and resources. Organisations may also require specialist corporate legal responsibilities guidance where employee monitoring, cross border data flows, mergers, acquisitions, outsourcing or large scale HR technology deployments create additional legal questions. The strongest approach is collaborative. Privacy should become part of the organisation's standard decision making process. Preparing for the DPDP Transition The Government notified the DPDP Rules, 2025 on 13 November 2025 and established a phased commencement structure. Under the commencement notification, the core provisions covering processing of personal data, including Sections 3 to 17, are scheduled to take effect 18 months after publication of the notification. This transition period gives employers an important opportunity. They can audit HR databases, review employee notices, assess vendor arrangements, establish retention schedules, test breach response procedures and train HR personnel before the substantive provisions become fully applicable. The official Ministry of Electronics and Information Technology resources provide access to the notified Act, Rules and implementation information. Digital Personal Data Protection Act, 2023 on MeitY Digital Personal Data Protection Rules, 2025 on MeitY Conclusion Employee data is an essential part of modern business operations, but it should not be treated as an unrestricted corporate asset. Employers must understand why information is collected, establish appropriate legal grounds, provide meaningful transparency, protect records, control vendor access and delete information when continued retention is no longer justified. The transition to India's new data protection framework makes this an appropriate time to review existing HR practices. Businesses that build privacy into recruitment, onboarding, employment monitoring, payroll, vendor management and exit processes will be better positioned to meet their legal responsibilities and maintain employee trust. Where an organisation needs specialised support, data protection compliance can be incorporated into broader governance, HR policy and corporate risk management programmes. Frequently Asked Questions (FAQs) Q1. Does the DPDP Act apply to employee data? Yes. Employee personal data can fall within the scope of the DPDP Act when it is digital personal data covered by the legislation. Employers generally act as Data Fiduciaries while employees are Data Principals. Q2. Do employers always need employee consent to process personal data? No. Section 7 of the DPDP Act recognises certain legitimate uses, including specified processing necessary for employment and for safeguarding an employer from certain losses or liabilities. Consent may still be relevant for processing outside those legitimate uses. Q3. Is employee health information protected in India? Yes. Health information can constitute personal information requiring appropriate protection. The existing SPDI framework also treats medical records and physical or mental health information as sensitive personal data or information. Employers should consider the applicable regime during the DPDP transition. Q4. Can an employer monitor employee emails? An employer may have legitimate reasons to monitor company systems for cybersecurity, compliance or protection of business information. However, monitoring should be connected to a legitimate purpose and implemented proportionately. Accessing personal communications raises different privacy considerations. Q5. How long can an employer retain employee data? There is no single retention period for every category of employee information. Retention should depend on the purpose of processing and applicable legal, regulatory, contractual and litigation requirements. Q6. Do former employees have privacy rights? Former employees may continue to have rights and protections concerning personal information held by an organisation, subject to the applicable legal framework and commencement of relevant provisions. Employers should therefore have a clear post employment retention and deletion policy. Q7. What should an employee privacy notice contain? It should explain the categories of personal data collected, purposes of processing, relevant disclosures, rights, grievance mechanisms and other information required under the applicable legal framework. The DPDP Rules, 2025 provide specific requirements concerning clear and plain language notices. Q8. What is the biggest employee data privacy risk for employers? One major risk is uncontrolled data accumulation. Organisations often collect information without clearly defining the purpose, retain it indefinitely and provide access to more people or vendors than necessary. Strong data mapping, access controls, retention rules and staff training can reduce this exposure. Q9. Should employers review their HR technology vendors? Yes. Payroll providers, HR management platforms, recruitment systems, background verification companies, insurers and cloud service providers may process employee information. Employers should assess their contractual and security arrangements before sharing personal data. Q10. Is employee consent required for payroll processing? Not necessarily under the future DPDP framework. Processing necessary for employment can fall within the legitimate use recognised under Section 7. Employers should still provide appropriate transparency and comply with applicable security, governance and other obligations.

Human Resources departments handle some of the most extensive collections of personal information within an organisation. Recruitment records, identity documents, salary details, bank information, attendance records, health information, performance reviews and employee communications can all involve personal data. For this reason, data protection laws for HR departments are no longer simply an IT or legal concern. They directly affect recruitment, onboarding, payroll, employee monitoring, benefits administration, vendor management and employee exits. India's privacy framework has changed significantly with the Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025. The framework is being introduced through a phased commencement structure. HR teams therefore need to understand both the substantive requirements and the dates on which different obligations become operational. What Data Protection Laws for HR Departments Mean in India? The central legislation is the Digital Personal Data Protection Act, 2023. It regulates the processing of digital personal data and places primary responsibility on the Data Fiduciary, meaning the organisation deciding why and how personal data is processed. India Code identifies the employer's processing activities within the wider framework of the Act rather than creating a general exemption for employee information. In an HR setting, a Data Principal may be an employee, job applicant, former employee, intern, consultant or other individual whose personal information is processed by the organisation. The employee relationship therefore creates a continuing flow of personal data across multiple systems. The important point for HR leaders is simple: employee information does not become outside the privacy framework merely because it is collected for employment purposes. Which Employee Information Can Fall Within the Framework? HR departments routinely process names, addresses, contact details, identity information, educational records, employment histories and financial information. They may also handle information relating to health, insurance, attendance, performance, disciplinary proceedings, workplace access and employee benefits. Modern HR systems make the data environment even broader. Applicant tracking systems, payroll platforms, biometric attendance systems, learning management tools, background verification providers, cloud storage platforms and employee engagement applications may all process information relating to individuals. A useful compliance exercise therefore begins with data mapping. HR should identify what information is collected, why it is required, where it is stored, who can access it, which vendors receive it and when it should be deleted. This approach is consistent with the practical compliance focus emerging around India's new privacy framework. Does HR Always Need Employee Consent? Consent is important under the DPDP Act, but HR departments should avoid assuming every employment related activity requires a separate consent form. Section 7 of the Act recognises certain legitimate uses. Section 7(i) specifically covers processing necessary for employment or purposes connected with safeguarding an employer from loss or liability. It also covers providing a service or benefit sought by an employee. This can be relevant to activities such as administering employment benefits, managing workforce responsibilities and protecting confidential information. Processing connected with preventing corporate espionage or protecting intellectual property may also fall within the statutory legitimate use framework. However, the existence of a legitimate use does not give HR unrestricted authority to collect or use personal information. The purpose still matters. Necessity still matters. Security still matters. An organisation should be able to explain why particular information is collected and how it relates to the relevant employment activity. For example, using employee information for payroll administration is materially different from using the same information for unrelated marketing. HR should therefore distinguish between necessary employment processing and secondary uses requiring separate legal assessment. Privacy Notices and Transparency Are Important HR Controls HR teams should ensure employees and candidates receive appropriate information about how their personal data is processed. A privacy notice should reflect actual processing activities. It should not simply reproduce a generic privacy statement prepared for customers Recruitment notices may need to address information obtained through applications and background checks. Employee notices may need to address payroll, benefits, attendance, workplace security, internal investigations and other employment related activities. The DPDP Rules, 2025 provide detailed requirements concerning notices, including clear information about personal data and processing purposes. The notified Rules are being implemented in stages, so organisations should distinguish between provisions already operational and provisions scheduled to commence later. A well drafted notice also helps HR answer a practical question employees increasingly ask: “Why does the organisation need this information?” Employee Monitoring Requires Particular Care Workplace monitoring can create significant privacy risks. Employers may use CCTV, access control systems, device monitoring, email systems, location tools and security software for legitimate organisational purposes. Yet HR and IT teams should avoid treating the ability to collect information as evidence of a legal entitlement to collect it. The purpose and scope of monitoring should be carefully assessed. Monitoring should have a genuine business or legal justification and should not become excessive simply because technology makes extensive surveillance possible. For example, security logging designed to investigate unauthorised access is different from continuously tracking an employee's personal device outside working hours. HR policies should explain relevant monitoring practices clearly. Access to monitoring information should also be restricted to personnel with a legitimate need to use it. Background Verification and Recruitment Data Recruitment creates another significant privacy risk. Candidates may provide CVs, addresses, identification documents, references, educational records and previous employment details. Employers may also appoint external background verification agencies. HR should understand the source of candidate information and the purpose for which it is being obtained. It should also review the contractual and operational controls governing external vendors. Candidate data should not remain indefinitely in recruitment systems merely because deletion was never considered. Retention should be linked to legitimate business, legal or regulatory requirements. The same principle applies to unsuccessful applicants. An organisation should establish a defined approach for deciding how long recruitment information remains accessible. Health, Biometric and Financial Information Need Strong Controls HR departments often handle information carrying a high degree of practical sensitivity, even though the DPDP Act does not reproduce the older SPDI classification as its central organising principle. Examples include medical information, biometric identifiers, salary information, bank details and identity documents. Such information should receive appropriate security protection. Access should be based on business need. Copies should not be created unnecessarily. Documents should not be circulated through informal channels merely because doing so is convenient. The earlier Information Technology Act framework and the SPDI Rules also remain relevant during the transition period in circumstances covered by their continuing operation. Current employment law commentary notes the continuing relevance of Section 43A and the SPDI Rules during the phased transition. HR should therefore avoid assuming the DPDP Act is the only legal instrument relevant to employee information. HR Vendors and Data Processors Most organisations do not manage employee information entirely within internal systems. Payroll providers, recruitment platforms, cloud providers, benefits administrators, background verification agencies and other technology vendors may process employee or candidate information. The employer remains responsible for understanding how such processing occurs. Contracts should therefore address permitted processing, confidentiality, security measures, incident reporting, assistance with legal requests and deletion or return of information where appropriate. Vendor due diligence should also be proportionate to risk. A provider handling payroll information deserves closer scrutiny than a supplier with no access to personal data. HR, procurement, information security and legal teams should work together rather than treating vendor privacy as a purely procurement issue. For organisations requiring specialist data protection compliance, a structured assessment can help identify gaps across HR systems, contracts, policies and operational processes. Data Security Is an HR Responsibility Too A data breach does not necessarily begin with sophisticated hacking. An unlocked computer, an incorrectly addressed email, excessive access permissions, an unsecured spreadsheet or an employee sharing payroll information through an informal channel can create serious risks. The DPDP Act requires Data Fiduciaries to implement reasonable security safeguards to prevent personal data breaches. The precise controls should reflect the nature and volume of processing and the associated risks. HR should therefore work with information security teams to establish access controls, authentication measures, secure storage, incident reporting procedures and employee awareness programmes. Training is especially important because HR personnel frequently handle information other employees cannot access. Retention and Deletion Should Be Planned One of the common weaknesses in HR data governance is indefinite retention. Employee information can remain scattered across email accounts, shared drives, HR software, archived recruitment folders and vendor systems long after the original purpose has ended. Retention should be linked to the purpose for which information is held and to applicable legal requirements. HR should also consider whether information exists in multiple systems and whether deletion from one platform leaves copies elsewhere. A practical retention schedule can identify categories such as recruitment records, payroll information, employee files, disciplinary records and benefits information, along with applicable retention requirements and responsible owners. Employee Rights and Grievance Handling The DPDP Act gives Data Principals rights including access to information about personal data, correction and erasure in applicable circumstances, and grievance redressal. HR departments will therefore need processes for handling employee requests. A request should not sit unanswered because HR does not know which system contains the relevant information. Organisations should establish an internal process for identifying the requester, locating relevant information, assessing the request and coordinating with legal, IT or other teams where required. A central point of contact can reduce confusion and improve consistency. The Role of HR Policies and Employment Documentation Privacy compliance should extend beyond the company's website privacy policy. Employee handbooks, onboarding documents, HR policies, monitoring policies, vendor contracts and internal procedures should reflect actual data practices. Where HR uses new technologies, privacy implications should be assessed before implementation. This is especially relevant to artificial intelligence tools, automated recruitment systems, employee analytics and workplace monitoring technologies. A written policy is useful only when operational teams follow it. HR should therefore periodically test whether its systems and processes match its stated commitments. Organisations can also review broader corporate legal compliance through an integrated governance exercise covering employment, technology, contractual and privacy obligations. Current Implementation Position Under the DPDP Framework Businesses should pay close attention to the commencement framework. The Digital Personal Data Protection Act received Presidential assent on 11 August 2023. The Government subsequently notified the Digital Personal Data Protection Rules, 2025 and an implementation timeline on 13 November 2025. Some provisions became operational on notification, while substantive provisions have later commencement dates. This means HR departments should not use the later commencement date for certain obligations as a reason to delay preparation. Changing HR platforms, contracts, retention processes and internal governance can take considerable time. Early preparation also helps organisations identify unnecessary data collection before it becomes embedded in systems. The official Digital Personal Data Protection Act, 2023 on India Code and Digital Personal Data Protection Rules, 2025 published by MeitY should be treated as primary reference sources for statutory requirements and implementation developments. Why HR Teams Need a Practical Privacy Governance Model? Effective employee data protection cannot sit entirely with the legal department. HR owns many of the processes through which employee information enters and moves across an organisation. IT controls systems. Cybersecurity manages technical safeguards. Procurement manages vendor relationships. Finance processes payroll. Legal interprets obligations and manages risk. A practical governance model connects these functions. HR should maintain visibility over its data flows, define ownership, review vendor access, establish retention practices, train personnel and coordinate with legal and security teams when new processing activities are introduced. This approach turns privacy from a document exercise into an operational control system. Conclusion The growing importance of data protection laws for HR departments reflects a simple reality: employee information is central to almost every stage of the employment lifecycle. The DPDP Act and Rules provide a new statutory framework, but compliance cannot be achieved by adding another clause to an employment contract. HR departments need to understand their data flows, distinguish consent from legitimate use, protect high risk information, control vendor access, establish retention practices and prepare for employee rights. The strongest approach is practical. Identify the information. Understand why it is processed. Limit access. Protect it properly. Retain it only as long as necessary. Review the process whenever the organisation, technology or law changes. Frequently Asked Questions (FAQs) Q1. Does the DPDP Act apply to employee data? Yes. Employee personal data can fall within the DPDP framework when processed in digital form, subject to the Act's scope and applicable exemptions. Employment related processing may qualify as a legitimate use in specified circumstances. Q2. Is employee consent required for payroll processing? Not necessarily. Processing necessary for employment can fall within the legitimate use provision under Section 7(i). HR should still assess the purpose, necessity, transparency and security of the processing. Q3. Does an employee have privacy rights under the DPDP Act? Yes. The Act provides Data Principal rights including access to information, correction and erasure in applicable circumstances, grievance redressal and nomination. Q4.  Can employers monitor employees? Monitoring may be possible for legitimate employment, security or compliance purposes, but organisations should assess the purpose, scope and necessity of the monitoring and implement appropriate safeguards. Q5. How should HR manage employee data held by third party vendors? HR should identify the information shared with each vendor and ensure appropriate contractual, security, confidentiality and incident management controls are in place. Vendor access should be limited to what is necessary. Q6. How long can HR retain employee data? There is no single universal retention period for every category of employee information. Retention should be assessed against the purpose of processing and applicable legal, regulatory and contractual requirements. Q7. Is a privacy policy sufficient for HR compliance? No. A privacy policy is only one component. Effective compliance also requires data mapping, appropriate processing grounds, notices, security measures, vendor governance, retention controls, rights handling and incident response. Q8. What should HR do first when preparing for DPDP compliance? HR should begin by mapping its personal data. Identify employee and candidate information, processing purposes, systems, vendors, access rights and retention practices. This provides the foundation for identifying legal and operational gaps.

Businesses collect personal data through websites, mobile applications, customer accounts, marketing forms, financial transactions and digital services. As data use becomes more complex, consent management is no longer simply a matter of adding an “I agree” button to a website. It involves obtaining valid consent, recording the decision, connecting it to a specific purpose, respecting withdrawal and ensuring the choice is reflected across relevant systems. India's Digital Personal Data Protection Act, 2023 introduces a detailed statutory framework for consent. The Digital Personal Data Protection Rules, 2025 add operational requirements and establish a framework for registered Consent Managers. The provisions are being brought into force in phases, making it important for businesses to understand both the legal requirements and the implementation timeline. What Is Consent Management? Consent management is the process through which an organisation obtains, records, maintains and acts upon an individual's permission concerning the processing of personal data. A reliable system should answer several basic questions. What did the individual agree to? For what purpose? When was consent given? Which notice was presented? What personal data was involved? Can the individual withdraw consent? Has the withdrawal reached the systems and service providers processing the information?  This makes consent management broader than consent collection. It is an ongoing governance process covering the entire consent lifecycle. A business may manage consent through internal processes, software, a consent management platform or, where relevant under the DPDP framework, through a registered statutory Consent Manager. Consent Under India's DPDP Act The DPDP Act establishes consent as one of the grounds for processing personal data. Section 4 permits processing for a lawful purpose based on consent or certain legitimate uses specified under the Act. Section 6 establishes the legal standard for valid consent. Consent must be free, specific, informed, unconditional and unambiguous. It must involve clear affirmative action and relate to the specified purpose. It must also be limited to personal data necessary for that purpose. This requirement has direct implications for how businesses design forms, applications and websites. A customer should not be asked to provide unnecessary information merely because it may be useful at some future point. Similarly, unrelated purposes should not be hidden inside a single blanket permission. Consent Is Not the Same as a Privacy Notice Privacy notices and consent serve different functions. A privacy notice provides information. It explains what personal data is being processed, why it is being processed and how relevant rights can be exercised. Consent is the individual's affirmative agreement where consent is the applicable legal basis. Section 5 of the DPDP Act requires notice to accompany or precede a request for consent. The 2025 Rules provide further requirements concerning the content and presentation of this notice. The official explanatory note states the notice should be clear, standalone and understandable, with an itemised description of personal data and the purpose for processing. Businesses should therefore avoid treating a long privacy policy as a substitute for a clear consent request. What Makes Consent Legally Valid? A valid consent process begins with meaningful information. The individual should understand what information is being requested and why. The purpose should be specific enough to understand the proposed processing. Consent should also involve a genuine choice. A business should not design its user journey in a manner which makes acceptance unavoidable where consent is not genuinely necessary for the service. The DPDP Act also prevents consent from being used to override statutory protections. Section 6 provides, among other things, that consent infringing the Act, Rules or another applicable law is invalid to the extent of the infringement. For businesses, this means consent is not a mechanism for contracting out of legal obligations. Consent Withdrawal Is Part of Consent Management Obtaining consent is only the beginning. Section 6 provides individuals with a right to withdraw consent at any time. The process for withdrawal must be as easy as the process for giving consent. Once consent is withdrawn, the Data Fiduciary must stop processing based on that consent and cause its Data Processors to stop, unless continued processing is otherwise authorised or required by law. This requirement creates a practical technology challenge. If a customer withdraws consent through a website, the preference should not remain active in a separate marketing database. Where relevant, the withdrawal should also reach connected processors and downstream systems. A withdrawal mechanism which changes only one database field may therefore be insufficient from an operational perspective. Consent Management Must Be Purpose Based Consent should be connected to a defined processing purpose. For example, a business may process customer information to provide a service, send promotional communications, personalise content or conduct analytics. These activities may involve different purposes and should not automatically be treated as one permission. Purpose based consent also improves internal accountability. When a processing activity is reviewed, the organisation can identify the consent supporting it rather than searching through a general customer preference record. This approach becomes particularly important for businesses using customer information for profiling, targeted advertising, artificial intelligence or data analytics. How Should Businesses Record Consent? A business should maintain sufficient evidence of consent. The record should ideally establish the identity or relevant identifier of the Data Principal, the date and time of the decision, the purpose involved, the personal data covered, the notice presented and the consent decision. Version control is also important. If a business changes its notice or consent language, it should be possible to identify which version an individual saw when consent was obtained. This creates a defensible audit trail and helps the organisation understand how its privacy practices changed over time. The DPDP Act places the burden of proving valid consent on the Data Fiduciary where consent is relied upon. Consent Management Across Business Systems Modern businesses rarely process customer information in a single system. A customer may provide information through a website, while the information is stored in a CRM, processed by a cloud provider, analysed by a data platform and used by a marketing system. Consent must therefore be connected to the wider data ecosystem. Suppose a customer withdraws consent for promotional communications. The withdrawal should be reflected not only in the main customer database but also in relevant email marketing, SMS, customer engagement and advertising systems. The objective is not simply to preserve evidence of the customer's decision. The organisation must also operationalise it. Consent Management for Websites and Applications Websites and applications are often the first point at which consent is requested. Consent interfaces should use clear language and should not obscure important information. Where multiple purposes are involved, users should be able to understand the choices being presented. Applications require additional consideration because they may process device identifiers, location information, photographs, contacts or other information depending on their functionality. The consent experience should correspond with the actual data practices of the application. A business should also review its cookies, tracking technologies, analytics tools and advertising integrations. A consent mechanism is ineffective if third party scripts continue processing information despite a user's choice. What Is a Consent Management Platform? A Consent Management Platform, commonly called a CMP, is a technology solution used by organisations to manage consent processes. A CMP can help display consent notices, record decisions, manage preferences and communicate choices to connected systems. However, using a CMP is not itself a statutory requirement under the DPDP Act. This distinction is important because the term “Consent Manager” has a specific meaning under Indian law. Consent Manager Under the DPDP Act The DPDP Act defines a Consent Manager as a person registered with the Data Protection Board who acts as a single point of contact enabling a Data Principal to give, manage, review and withdraw consent through an accessible, transparent and interoperable platform. This is different from an ordinary consent management platform used by a company for its own website or applications. A statutory Consent Manager is an independent regulated intermediary. It is designed to allow an individual to manage consent across multiple Data Fiduciaries. The 2025 Rules establish registration conditions and operational duties for such Consent Managers. The official MeitY explanatory note states the Consent Manager must meet requirements concerning financial and operational capacity, an interoperable platform, security, records, transparency and conflicts of interest. When Will Consent Managers Become Operational? The implementation timeline is particularly important. The commencement notification issued in November 2025 provides different dates for different provisions. Section 6(9), which concerns accountability of Consent Managers, is subject to the one year commencement period. Most of Section 6 is subject to the eighteen month period. Based on the notification dated 13 November 2025, the one year milestone is 13 November 2026 and the eighteen month milestone is 13 May 2027. Rule 4 of the DPDP Rules, which deals with registration and obligations of Consent Managers, follows the one year commencement period. Therefore, businesses should distinguish between the concept and regulatory framework for Consent Managers and the later commencement of the provisions allowing Data Principals to use such services. Is a Business Required to Use a Consent Manager? No. An ordinary Data Fiduciary does not become a statutory Consent Manager merely because it collects consent. The DPDP framework gives Data Principals the option to use a registered Consent Manager. A business can continue to collect and manage consent through its own compliant processes. The important requirement is to ensure the consent process itself satisfies the applicable legal standards.This distinction prevents a common misconception. Buying a consent management tool does not automatically make an organisation compliant, and operating an internal consent database does not make the organisation a statutory Consent Manager. Consent Management and Children’s Data Children's data requires additional safeguards. The DPDP Act defines a child as an individual who has not completed eighteen years of age. Section 9 requires verifiable parental or guardian consent before processing a child's personal data, subject to the statutory framework. It also restricts processing likely to cause a detrimental effect on a child's well being and addresses tracking, behavioural monitoring and targeted advertising directed at children, subject to specified exemptions. The Rules provide further requirements concerning verification of parental or guardian consent. Businesses serving children should therefore consider age assurance, guardian verification and consent records as part of their product architecture rather than adding them after launch. Consent Management and Data Processors Consent decisions must follow the data. If a Data Fiduciary appoints a Data Processor, the processor may handle personal data on behalf of the fiduciary. The Data Fiduciary must therefore ensure its contractual and technical arrangements allow consent related decisions to be implemented where required. For example, if a customer withdraws consent and the relevant processing must stop, the business should have a mechanism for communicating the change to the processor. Vendor contracts should address privacy responsibilities, security, incident reporting, deletion, subcontracting and assistance with Data Principal requests. This is especially important where the business uses numerous SaaS platforms. Consent and Marketing Communications Marketing consent should be handled carefully. Businesses often combine service communications with promotional communications. These activities may have different purposes and may be governed by different legal requirements. A customer may need transactional messages to receive a service while separately choosing whether to receive promotional email or SMS communications. Businesses should therefore avoid assuming one general customer acceptance covers every communication channel. The organisation should also consider applicable telecom and sector specific requirements governing commercial communications. Consent and Artificial Intelligence The growing use of artificial intelligence creates new consent questions. A business may collect customer conversations for support purposes and later want to use those records to train or improve an AI system. The organisation should assess whether the proposed use falls within the original purpose, whether another lawful basis applies and whether the customer was adequately informed. The same principle applies to profiling, behavioural analytics and personalisation. A consent record should not be treated as a permanent licence to use personal data for every future purpose. Consent Management and International Privacy Laws Indian businesses may also be subject to foreign privacy requirements. An organisation offering services to individuals in the European Economic Area, for example, may need to consider the GDPR. Other jurisdictions have their own rules governing consent, marketing, cookies and individual rights. A single consent architecture can support multiple legal regimes, but the underlying legal analysis must remain jurisdiction specific. Businesses should identify where customers are located, which data is processed, which systems receive it and which laws apply. Consent Management and Information Security Consent records themselves contain valuable information. A business should protect consent databases against unauthorised alteration, deletion and access. If an attacker can modify consent records, the organisation may lose the ability to demonstrate a customer's actual decision. Access controls, authentication, logging, backups and appropriate security measures should therefore apply to consent systems. The DPDP Act requires Data Fiduciaries to implement reasonable security safeguards to prevent personal data breaches. Businesses should also consider CERT In requirements. Its Cyber Security Directions require specified cyber incidents, including data breaches and data leaks, to be reported within six hours of noticing them. Building a Practical Consent Management Framework An effective programme should begin with a data and processing inventory. The organisation should identify each processing purpose for which consent may be required. It should then map the relevant notice, consent interface, data systems, processors and downstream recipients. The next step is to establish how consent is captured and recorded. The organisation should preserve sufficient evidence to demonstrate the decision. Withdrawal should then be tested across the technology environment. A business should verify whether the change reaches CRM systems, marketing platforms, analytics tools and relevant processors. Regular testing is important. A consent mechanism can become ineffective when a new vendor, tracking tool or product feature is introduced. Organisations requiring assistance with designing and implementing these processes may consider data protection compliance services as part of their broader privacy governance framework. Common Consent Management Mistakes One common mistake is treating consent as a single checkbox. Another is using vague purposes. A user should be able to understand what the consent actually permits. Businesses also sometimes make withdrawal difficult. A customer may be able to accept a permission in one click but need to contact customer support to withdraw it. This conflicts with the statutory principle requiring withdrawal to be as easy as giving consent. Other risks include missing consent records, outdated privacy notices, inconsistent records across systems and failure to communicate withdrawals to processors. A technically sophisticated platform cannot solve these issues if the underlying governance is weak. Why Consent Management Matters for Business Governance? Consent management sits at the intersection of privacy, technology, marketing, cybersecurity and corporate governance. A well designed system can help a business demonstrate accountability, respond to individual requests and maintain consistent data practices. It can also reduce operational confusion. Employees should not have to determine manually whether a customer has consented each time personal data is used. As organisations grow, business compliance legal services can help integrate privacy processes with contracts, vendor management, regulatory obligations and wider corporate governance. Conclusion Consent management under India's data protection framework is becoming an important operational discipline for businesses. It is no longer sufficient to collect an affirmative response and store a simple “yes” in a database. Businesses need to understand the purpose for which consent is sought, provide meaningful information, capture valid consent, preserve evidence, make withdrawal easy and ensure changes are reflected across relevant systems and processors. The DPDP Act also introduces a distinct statutory concept of the Consent Manager. This should not be confused with ordinary consent management software. The 2025 Rules establish the framework for registration and operation of Consent Managers, with the relevant provisions coming into force in phases. Organisations should therefore use the transition period to review their consent journeys, privacy notices, customer databases, vendor contracts and technical controls. The objective should be a consent process which is legally defensible, technically enforceable and understandable to the individual. Frequently Asked Questions (FAQs) Q1. What is consent management under the DPDP Act? Consent management refers to the processes used to obtain, record, manage and honour an individual's consent for processing personal data. It includes consent capture, evidence, withdrawal and implementation across relevant systems. Q2. What are the requirements for valid consent in India? Under Section 6 of the DPDP Act, consent must be free, specific, informed, unconditional and unambiguous, involve clear affirmative action and be limited to personal data necessary for the specified purpose. Q3. Can consent be withdrawn under the DPDP Act? Yes. A Data Principal may withdraw consent at any time. The withdrawal process must be as easy as the process used to give consent. Q4. Is a Consent Management Platform mandatory in India? No. The DPDP Act does not require every Data Fiduciary to use a particular consent management platform. Businesses must instead establish processes capable of meeting their applicable legal obligations. Q5. Is a Consent Manager the same as a Consent Management Platform? No. A statutory Consent Manager is a person registered with the Data Protection Board and provides an interoperable service through which Data Principals can manage consent. A Consent Management Platform is generally software used by an organisation to manage its own consent processes. Q6. When will Consent Managers be registered in India? The registration framework under Section 6(9) and Rule 4 is subject to the one year commencement period from 13 November 2025. The relevant milestone is 13 November 2026. Q7. Does every business need to use a registered Consent Manager? No. Businesses can manage consent directly. The statutory Consent Manager is an optional mechanism available to Data Principals under the DPDP framework. Q8. Does consent apply to every type of personal data processing? No. The DPDP Act recognises consent as one ground for processing and separately provides for certain legitimate uses. Businesses should identify the appropriate legal basis for each processing activity. Q9. How should businesses prove consent? Businesses should maintain reliable records showing the relevant consent decision, purpose, timing, notice version and other appropriate contextual information. The DPDP Act places the burden of proving valid consent on the Data Fiduciary where consent is relied upon. Q10. What happens after a user withdraws consent? Where consent is the applicable basis, the Data Fiduciary must stop processing based on the withdrawn consent and cause its Data Processors to stop, unless continued processing is otherwise authorised or required by law. Q11. Do consent requirements apply to children's data? Yes, with additional safeguards. The DPDP Act requires verifiable parental or guardian consent for processing a child's personal data, subject to the applicable statutory provisions and exemptions.