India's DPDP Act and workplace monitoring: what employers should know

India's Digital Personal Data Protection Act, 2023, usually called the DPDP Act, sets out how organisations may collect and use personal data in digital form. For employers that use attendance systems, activity tracking or screenshots, it raises practical questions: what can we collect, what do we need to tell people, and how long can we keep it?

This article gives a broad, plain-English overview of the themes employers commonly consider, and some practical habits that tend to support responsible handling of employee data, whatever the precise legal requirements turn out to be for your organisation.

Employee data is personal data

Attendance records, working hours, the applications someone uses, websites they visit, screenshots of their screen and their location when they punch in are all information about an identifiable person. That puts them in the territory of data protection law. The fact that the data is generated at work does not, by itself, take it outside that territory.

Themes employers usually consider

A clear and lawful purpose

Data protection frameworks generally expect personal data to be processed for a specific, legitimate purpose. For monitoring, that means being able to explain why each kind of data is collected: accurate attendance, payroll, security, workload planning and so on. Collecting data simply because the software can is hard to justify.

Notice and, where relevant, consent

People are generally entitled to know what data is collected about them and why. The Act includes provisions on notice and consent, and also on certain legitimate uses, including some related to employment. Exactly which basis applies to which kind of monitoring is a question for legal advice, but clear, written notice to employees is good practice in any case.

Collecting only what is necessary

A recurring idea in data protection is minimisation: collect what you need for the stated purpose and no more. In practice this can mean, for example, choosing activity counts rather than recording what is typed, tracking only while someone is punched in, blurring screenshots, or not storing full window titles.

Keeping data only as long as needed

Personal data should not be kept forever by default. Decide how long each type of data is useful, for example a few months for screenshots and longer for attendance records needed for payroll and audits, and delete data once that period has passed.

Security and access

Organisations are expected to protect personal data with reasonable security safeguards. That includes limiting who can see what, protecting credentials and keys, and keeping a record of who accessed or changed data.

People's rights

The Act gives individuals rights in relation to their data, such as access to information about it and correction. Employers should have a process for handling such requests from employees.

Practical habits that help

Regardless of the precise legal position, these habits make monitoring easier to justify and easier to explain:

1. Write down the purpose of each type of data you collect, and review it periodically.
2. Give employees a clear written notice before tracking starts, and keep a record that they have seen it.
3. Switch off any collection you cannot justify. Fewer data points mean less risk.
4. Track only during working hours, while people are punched in.
5. Set retention periods and make sure old data is actually deleted.
6. Restrict access by role: employees see their own data, managers see their team, admins see what they need.
7. Keep an audit log of changes to settings and data.
8. Have a simple process for employees to ask questions or request access to their data.

The best preparation for any data protection rule is the same: know what you collect, why, who sees it and when you delete it.

Questions to take to your legal adviser

Every organisation's situation is different, so it helps to arrive at a legal consultation with specific questions. Useful ones include:

1. Which legal basis applies to each type of employee data we collect: attendance, activity, application usage, screenshots and location?
2. What must our notice to employees contain, and in what form should it be given?
3. Do we need consent for any particular kind of monitoring, and if so, how should it be recorded and withdrawn?
4. What retention periods are appropriate for each type of data, given payroll, tax and audit requirements?
5. How should we respond to employee requests to access or correct their data?
6. What obligations do we have if personal data is exposed in a security incident?
7. What should our contracts with software providers say about how they handle our employees' data?

Bring your data inventory to that conversation. A clear list of what you collect and why makes the advice faster and more specific.

How tools can support this

Software cannot make an organisation compliant on its own, but it can make good habits easier. In BeeWorkforce, for example, you can require employees to accept a monitoring notice before tracking starts, set data retention periods, choose not to store window titles, blur screenshots, and review an audit log of changes. These controls support a responsible approach; whether they are sufficient for your legal obligations is something to confirm with your advisers.

Where to go from here

If you already monitor employees, start with an inventory: list each type of data, why you collect it, who can see it and how long you keep it. Gaps usually become obvious quickly. Then talk to a lawyer about the specific requirements that apply to you, update your employee notice, and adjust your settings. Treat it as an ongoing practice rather than a one-off project, because both the law and the way your organisation works will continue to change.