Failure Patterns, Migration and Official Sources
Employee payroll data under the DPDP Act and Rules 2025: what employers and payroll vendors must do
How the DPDP Act 2023 and DPDP Rules 2025 apply to payroll and HR data in India: employment as legitimate use, vendor as processor, safeguards, breach notice and the 2027 timeline.
Payroll and HR systems hold some of the most sensitive personal data a business has: PAN, bank accounts, salary, UAN and ESI numbers, Aadhaar where lawfully collected, health details for leave and insurance, family details for nominations, and often biometrics. Under the Digital Personal Data Protection Act, 2023, the employer is the data fiduciary and the payroll vendor is a data processor. The Act allows processing for the purposes of employment as a legitimate use, so you do not need consent for core payroll, but you remain responsible for security, accuracy, retention and breach handling. Under the DPDP Rules, 2025 (G.S.R. 846(E), 13 November 2025), most operational obligations, including the security safeguards in Rule 6 and the breach reporting in Rule 7, apply from 13 May 2027. Prepare now: payroll contracts signed in 2026 will run past that date.
This guide belongs to the guide on why payroll software projects fail. It is general information, not legal advice.
The timeline
| Date | What applies |
|---|---|
| 13 Nov 2025 | Rules notified; provisions on the Data Protection Board apply |
| 13 Nov 2026 | Rule 4 on consent managers applies |
| 13 May 2027 | Most remaining Rules apply, including notices (Rule 3), security safeguards (Rule 6), breach intimation (Rule 7) and related duties |
A 2026 government consultation discussed shortening the transition; we found no amendment notified as of late October 2026. Check MeitY and the e-Gazette. Until the Act's obligations apply, existing IT Act rules on reasonable security practices remain relevant.
Employment as a legitimate use
Section 7 of the Act lists legitimate uses where consent is not needed. One covers processing for the purposes of employment or related to safeguarding the employer from loss or liability (for example, preventing corporate espionage or maintaining confidentiality) and providing benefits to employees. In payroll terms:
| Processing | Likely basis | Notes |
|---|---|---|
| Salary calculation, statutory deductions, filings | Employment / legal obligation | Core payroll |
| Bank account for salary | Employment | Verify changes |
| Health data for ESI, sick leave, insurance | Employment / benefits | Restrict access |
| Biometrics for attendance | Employment, but proportionality matters | Consider less intrusive options; restrict and delete |
| Marketing offers from partners to employees | Not employment | Needs consent |
| Sharing salary data with a lender at employee's request | Consent of the employee | Record it |
Legitimate use does not remove other duties: accuracy, security, retention limits and responding to employee rights.
What the employer must do
- Know your data. Map what payroll collects, where it is stored and who can access it.
- Contract with the processor. The Act requires a valid contract when a processor handles data on your behalf. Include purposes, security measures, sub-processors, breach notice to you, assistance with rights requests, and return or deletion on termination.
- Security safeguards. Rule 6 (from 13 May 2027) lists minimum measures: encryption, obfuscation or masking, access control, visibility through logs and monitoring, back-ups, and keeping logs for one year, among others.
- Breach response. Rule 7 requires intimation to affected persons and to the Data Protection Board, with a detailed report within 72 hours or a longer period the Board allows.
- Retention. Erase personal data when the purpose is served and retention is not required by law. Payroll records must be kept for periods set by labour, tax and company laws, so set retention schedules per record type.
- Rights. Employees can seek access, correction and grievance redress; have a contact point and a process.
- Penalties. The Act's Schedule allows penalties up to ₹250 crore for failure to take reasonable security safeguards and up to ₹200 crore for failing to notify a breach.
What to ask a payroll vendor
| Area | Question |
|---|---|
| Hosting | Where is data stored and backed up? Which sub-processors? |
| Access | Can vendor staff see salaries? Is access logged and approved? |
| Encryption | At rest and in transit? Payslip delivery protected? |
| Logs | Are access and change logs kept for at least a year and available to you? |
| Breach | How quickly will they tell you? Who is the contact? |
| Roles | Can you restrict managers to their team and hide salaries from HR assistants? |
| Exit | Full data export and certified deletion after termination, with a timeline |
| Biometrics | Are templates stored by the device, the vendor or you? How deleted? |
Put the answers in the contract. See contract, SLA and exit terms.
Practical controls inside the payroll system
- Role-based access: payroll processor, approver, HR viewer, manager (team only), employee (self only).
- Masking of bank account and PAN in screens and reports where full values are not needed.
- Password-protected or portal-only payslips; no salary spreadsheets on email.
- Approval for bank detail changes, with notice to the employee.
- Quarterly access review; remove leavers immediately.
- Separate handling of health data and biometrics.
Common mistakes
- Sending the whole payroll register to the CA or bank by email.
- Keeping ex-employee data indefinitely "just in case", beyond statutory periods.
- Allowing managers to download all payslips.
- No written processor contract with the payroll vendor or bureau.
- Collecting Aadhaar copies without need; collect only what the law and process require.
Frequently asked questions
Do we need employee consent to run payroll?
Generally not for processing for employment purposes, which is a legitimate use under the Act. Consent is needed for purposes outside employment.
When does the 72-hour breach report apply?
Under the Rules it applies from 13 May 2027, unless the timeline is changed by notification. Prepare the process now.
Is the payroll vendor responsible for a breach?
The employer as data fiduciary remains responsible to the Board and employees; the contract decides how the vendor supports and compensates you.
Can we store payroll data outside India?
The Act allows transfers except to countries the government restricts by notification; sector rules may be stricter. Check before choosing a vendor.
Sources
- MeitY — DPDP Act, 2023 and DPDP Rules, 2025
- e-Gazette of India — G.S.R. 846(E) of 13 Nov 2025
- Data Protection Board of India (via MeitY) — Board procedures
- CERT-In — cyber incident reporting
