DPDP duties when a processor handles HR and finance data

Who is who

The Digital Personal Data Protection Act, 2023 (the DPDP Act) uses three roles that map neatly onto an outsourced HR or finance process.

A vendor can be a fiduciary for some data (its own staff, for example) and a processor for client data at the same time. The role is decided per purpose, not per company.

Consent is not the only basis

Section 7(i) allows an employer to process personal data without consent for the purposes of employment, and for related purposes such as protecting the employer from loss or liability and providing benefits the employee has sought. Most payroll, attendance and HR-administration processing sits here. Candidate data before an offer, and uses beyond employment, may need consent and a notice.

What stays with the fiduciary

• Responsibility. Section 8(1): the fiduciary is responsible for complying with the Act for any processing undertaken by it or on its behalf by a processor.
• Contract. Section 8(2): a processor may be engaged only under a valid contract.
• Security. Section 8(5): the fiduciary must protect personal data in its possession or under its control, including processing by a processor, by taking reasonable security safeguards to prevent a breach.
• Breach intimation. Section 8(6): in the event of a breach, the fiduciary must intimate the Board and each affected Data Principal.
• Erasure. Section 8(7): once the purpose is served (or consent is withdrawn, where consent is the basis), the fiduciary must erase the data and cause its processor to erase it, unless the law requires retention.
• Grievances. Section 8(10): the fiduciary must have an effective way to handle grievances.

What the DPDP Rules, 2025 add

The Rules were published in the Gazette in November 2025. Rule 1 phases them in: the Board and procedural rules came into force on publication; the consent-manager rule (Rule 4) after one year; and most operational rules, including Rules 3, 5 to 16, 22 and 23, eighteen months after publication. That puts the main obligations in May 2027. A proposal reported in early 2026 to shorten this window had not been notified as at the date of this note.

• Rule 6, security safeguards. Reasonable safeguards include, at a minimum: securing data through encryption, obfuscation, masking or virtual tokens; controlling access to the computer resources used; keeping logs and monitoring so unauthorised access can be detected and investigated; backups and measures to continue processing if data is compromised; retaining logs and personal data for one year to detect and investigate breaches (unless the law requires otherwise); and an appropriate contract with the processor requiring it to take the same safeguards.
• Rule 7, breach intimation. Affected Data Principals must be told without delay, in plain language, what happened, the likely consequences, what is being done and what they can do. The Board must be told without delay, and within seventy-two hours of the fiduciary becoming aware (or a longer period the Board allows on written request), with a detailed report on the facts, the cause, the steps taken and the notices sent.
• Rule 8, retention. Personal data, related traffic data and processing logs must be kept for at least one year from the processing for the purposes set out in the Rules, after which they are erased unless another law requires them.

What the processor contract should cover

1. The purpose and categories of data, and a rule that the processor acts only on documented instructions.
2. The Rule 6 safeguards in concrete terms: encryption, access control, logging, backups, and who reviews the logs.
3. Breach notice from processor to fiduciary fast enough for the fiduciary to meet the seventy-two hour report, with the facts it will need.
4. Sub-processors: a list, a notice before changes, and the same terms flowing down.
5. Retention and erasure: periods per data category and a written confirmation of deletion at the end.
6. Location: where data is stored and processed. Section 16 allows transfer outside India except to countries the Government restricts by notification; sector rules may be stricter.
7. Help with Data Principal requests and grievances within the fiduciary's timelines.
8. The right to ask for evidence: access lists, log extracts and incident records.

Evidence a processor should be able to show

• Who has access to your data today, by name, and when that was last reviewed.
• A sample of access and run logs, and how long they are kept.
• The incident runbook and the contact who will call you.
• The sub-processor list.
• How deletion is done and confirmed at the end of an engagement.

What is at stake

Section 33 and the Schedule set penalties by breach type. The highest, up to ₹250 crore, is for failing to take reasonable security safeguards to prevent a personal data breach. Failing to notify the Board or affected people of a breach can attract up to ₹200 crore. The penalty falls on the fiduciary, which is why the contract with the processor matters.

What to do before May 2027

List every vendor that touches employee or finance data. For each, note the data, the purpose and the contract. Close the gaps in the contract first, then ask for the evidence. That order turns a legal duty into a short, practical project.