DPDP Act for Employers: A Small Business Checklist Before May 2027

Last Updated on September 16, 2026 by Abhijit Divekar

Your HR files hold some of the most sensitive data in your business: PAN, Aadhaar, bank details, salaries and sometimes health records. India’s data protection law now covers all of it. This guide explains the DPDP Act for employers in plain terms, what it means for a small team, and a simple checklist to finish before the May 2027 deadline.

What is the DPDP Act, and why should employers care?

The Digital Personal Data Protection Act, 2023 sets rules for how organisations collect, use, store and delete digital personal data. The government then notified the DPDP Rules, which put it into practice, on 13 November 2025.

In fact, every business with employees handles personal data. So even a 10-person startup is a “data fiduciary” under the law for its staff records. That is why the DPDP Act for employers matters as much as your PF or ESI setup.

When do the DPDP rules apply?

The rules then come into force in three phases:

So most of what a small employer must do becomes enforceable from 13 May 2027. However, building the habits now is far easier than rushing next spring.

Is there a small business exemption in the DPDP Act for employers?

Not yet. The Act gives the Central Government power to exempt certain businesses, including startups, from some duties. However, as of September 2026, the government had not notified any such exemption.

In practice, that means you should plan as if the law applies to you in full. If an exemption arrives later, you can scale back. By contrast, if you wait and none arrives, you will be scrambling.

Do you need employee consent to process their data?

For most HR work, no. Section 7 of the Act lists “legitimate uses” that do not need consent. One of them covers processing for the purposes of employment, and for protecting the employer from loss or liability.

So running payroll, filing PF and ESI, managing leave and keeping personnel files generally fall under that legitimate use. Still, a few situations deserve extra care:

• Job applicants. Candidates are not yet employees, so tell them clearly how you will use their data.
• Non-work uses. Using staff photos in marketing, for example, is not an employment purpose, so ask first.
• Background checks. Keep checks relevant to the role, and tell the candidate what you will verify.

What does the DPDP Act for employers require in practice?

Even when consent is not needed, several duties still apply once the main phase begins:

• Security safeguards. Protect staff data with sensible controls, such as access limits and secure storage.
• Breach reporting. Tell the Data Protection Board and the affected people without delay, and send the Board a detailed report within 72 hours.
• Purpose limits. Use data only for the purpose you collected it for.
• Deletion. Erase data once you no longer need it, while still keeping the records other laws require.
• Vendor contracts. Your payroll provider, HRMS and verification agencies process data for you, so put clear terms in place with them.
• A contact point. Give employees a way to ask questions about their data.

What penalties does the DPDP Act for employers carry?

Above all, the penalties are large. Failing to take reasonable security safeguards can cost up to ₹250 crore. Meanwhile, failing to report a breach can cost up to ₹200 crore. The Board weighs factors such as the nature of the breach when it decides the amount, but the risk is real for any size of business.

A DPDP checklist for small employers

Here is how to put the DPDP Act for employers into practice, step by step.

1. Map your HR data. List what you collect, where it lives and who can see it.
2. Cut the extras. Stop collecting anything you do not actually need.
3. Lock down access. Move files out of shared drives and email, and limit access by role.
4. Update your notices. Add a clear privacy notice to offer letters, job forms and your employee handbook.
5. Review your vendors. Check contracts with your payroll, HRMS and verification partners.
6. Set a retention rule. Decide how long you keep ex-employee data, based on legal requirements.
7. Plan for a breach. Write down who does what in the first 72 hours.

In addition, our guide to payroll data security covers practical controls. You can also follow official updates on the Ministry of Electronics and Information Technology website.

Frequently asked questions

Does the DPDP Act apply to small businesses in India?

Yes. The DPDP Act applies to every organisation that processes digital personal data in India, regardless of size. The Central Government can exempt certain businesses, including startups, from some duties, but as of September 2026 the government had not notified any such exemption.

Do employers need consent under the DPDP Act?

Generally, no. Section 7 of the DPDP Act treats processing for employment purposes as a legitimate use that does not require consent. Employers should still protect the data, use it only for that purpose, and take care with job applicants and non-work uses such as marketing.

What is the DPDP compliance deadline for employers?

The government notified the DPDP Rules on 13 November 2025, and they apply in phases. The main duties for employers, including notices, security safeguards, breach reporting and data rights, apply from 13 May 2027.

How quickly must an employer report a data breach under the DPDP Rules?

An employer must inform the Data Protection Board and affected individuals without delay after becoming aware of a personal data breach. It must then send the Board a detailed report within 72 hours, unless the Board allows more time.

Keep employee data in one safe place

HRTailor’s HRMS software brings employee records, payroll and documents into one system, instead of scattered spreadsheets and inboxes. That makes the DPDP Act for employers far easier to manage as your team grows.

This guide is general information, not legal advice. Please confirm how the DPDP Act applies to your business with a legal adviser.