India's Digital Personal Data Protection Act, 2023 (DPDP Act) establishes a legal framework for protecting digital personal data, including employee information handled by HR teams. For employers using a biometric attendance system or face recognition attendance system, understanding data collection, consent, retention and security is essential for preparing for compliance.
The DPDP Act recognises consent and specified legitimate uses as grounds for processing personal data, subject to applicable legal conditions. HR managers and business owners should understand their responsibilities, review attendance vendors and establish clear policies for storing, accessing and deleting employee records. This guide explains the DPDP Act for HR, its phased implementation, biometric attendance considerations and a practical compliance checklist for Indian workplaces.
The DPDP Act defines the rules for processing digital personal data in India. For the HR team, the Act would be relevant to the collection, usage, storage, transfer and deletion of employee personal data. Information stored electronically such as attendance records and payroll data may be covered by the Act where it relates to specific, identifiable people.
The Digital Personal Data Protection Act, 2023 got the presidential assent on 11 August 2023. Under Section 2, Data Principal is a person to whom personal data relates and Data Fiduciary is a person who controls and has the main responsibility of processing personal data.
All of these are areas that employers will need to revisit on a daily basis: recruitment, record keeping, timesheets, payroll, leave administration and providing information to providers.
The Act does not directly ban the use of digital attendance tracking. Organisations will need to comply with relevant legal requirements and take appropriate measures where relevant measures are enacted.
HR needs to remember that, even though the collection of information for one purpose might appear harmless, it can be used for something entirely different. For example, attendance monitoring data, to measure hours worked, should not be carelessly used to profile employees.
The commencement of the DPDP Act is sequential and thereby, it is phased. The provisions currently operational and the ones that shall be operational at a later stage are specified by the Government by way of notifications and needs to be checked separately.
The Digital Personal Data Protection Act 2023 (DPDP Act) of India sets out the law on digital personal data protection. To know about the implications for the organizations, the HR teams should refer to the notification of the MeitY DPDP Rules under which the Digital Personal Data Protection Rules, 2025 will be implemented. The commencement notifications – G.S.R. 843(E) and G.S.R. 846(E) – were released on 13 November 2025. Keep a watch on the applicable dates so that your employee data management practices are in line.
The important dates are:
The DPDP Rules, 2025 are also brought in a phased manner as per Rule 1. Rules 1, 2 and 17 to 21 have come into effect on the date of publication, 13 November 2026 is the date for Rules 4, and 13 May 2027 for Rules 3, 5 to 16, 22 and 23.
These are the dates of the notices as originally published. Employers are advised to see if there are any subsequent amendments or corrigenda when considering compliance.
HR teams should start planning the change early – as part of this they can also map the employee data, review vendor contracts, review biometric attendance policies and procedures and document retention policies.
Employees should then consider for each class of employee information – why it is being obtained and which legal basis will apply to its processing. Sections 4 to 7 of the DPDP Act covers lawful processing and consent and some of the circumstances in which it may be legitimate.
HR teams may collect info about employees that contains: names, addresses, phone numbers, employee ID number, time and dates of employees' presence, payroll data, or digital files associated with identifiable people. HR teams need to determine whether each bit of info is covered by the Act and steer clear of collection that isn't needed just because a system makes it easier.
Consent is only one of the recognised grounds on which processing may take place. Section 4 deals with processing in reliance on consent or other specified permitted uses of personal data, while Section 7 deals with various specified situations where personal data can be processed without consent. For example, Section 7(i) deal with specific employment-related uses, such as protecting an employer against loss or liability, and provision of services or benefits requested by an employee.
Still, an employment relationship does not grant an organisation an unconstrained right to gather employee data. There are still remaining legal grounds to be satisfied and only relevant purposes can be concerned.
If consent is a lawful basis for processing, it must be: free, specific, informed, unambiguous and can be withdrawn. Consent must also be freely given – this means without a power imbalance. This is covered in Section 6, which also states that if consent is withdrawn, an alternative lawful basis may apply.
Employee privacy notices should set out the information being collected, the purpose, who it will be shared with and what is retained. The better notification is straightforward than a general privacy term integrated into an appointment letter.
Biometric attendance system records the attendance of an employee via bodily or behavioural traits such as fingerprint and facial features, among others. Since biometric data has been digitized and linked to a recognisable employee profile, it could potentially be categorised as personal data under the DPDP Act.
HR teams looking into what is biometric system technology is should also learn how they recognize people. For example, a fingerprint device checks fingerprint information, while a face recognition attendance system checks the face of an employee. Some people even store biometric templates but not the face of the employee or fingerprint information.
Saving a template instead of an original image may not automatically negate privacy responsibilities. If the template is associated with a real employee, it may still be personal data.
The DPDP Act does not create a distinct sensitive personal data class for biometrics like the GDPR of the European Union. However, there are compelling reasons for biometrics data to be granted special status – a stolen fingerprint or face is not going to be easily changeable like your password
.
Employers should first determine if the use of a biometric attendance system is required in their office. A less intrusive method of recording attendance, for example by using employee ID, Pin or attendance via phones could be considered.
Important questions include:
Employers should document their decisions and explain the system to employees. A privacy notice alone does not justify unnecessary biometric collection.
Organisations operating internationally should separately evaluate GDPR biometric attendance requirements. Under Article 9 of the European Union's General Data Protection Regulation, biometric data processed for uniquely identifying an individual is a special category of personal data, subject to specific conditions and exceptions. Compliance with India's DPDP Act does not automatically establish GDPR compliance.
Employers should determine specific retention policies rather than indefinitely retaining employee records where no lawful purpose exists. Data Fiduciary obligations (including duty of erasure once purpose is fulfilled – subject to applicable laws and other exceptions) is set out in section 8 of the DPDP Act.
Payroll calculation, time tracking, auditing, employee disputes, or statutory recordkeeping may necessitate maintenance of attendance data. Thus, the lifetime of biometric templates, attendance records and payroll data may differ.
HR teams should make a schedule for retention based on the data type, purpose, and duration, along with the owner of that data and the deletion method. It should include data stored in attendance devices, cloud dashboards, exported reports, and backups.
If another law applies that necessitates the retention of records, the organisation should record a justification and limit access to that information to authorised personnel. Delete procedures should also cover third party vendors' data.
Security measures and breach notification under the DPDP Rules, 2025 The DPDP Rules, 2025 have prescribed the minimum standards of security safeguards and breach notification related to personal data under Rules 6 and 7, respectively. They are likely to come into effect on 13 May 2027 (as per the published timeline). The organizations should proactively make their incident response processes and test them as per current official requirements.
A breach response plan must specify who investigates, who isolates the affected system and evaluates the impact and who coordinates any notifications. A leak of a biometric database should be treated differently, since a biometric is not a password you can reset.
Using an external attendance provider will not get the employer off the hook with respect to analyzing the processing of employee information. Section 8(2) deals with the Data Fiduciary's responsibility for processing carried out by it or by it on its behalf, including processing by a Data Processor.
Providers may store records, supply devices, run the cloud dashboard and provide support. HR and procurement should be aware of who the vendor is, who they will share data with, and what measures they will implement to protect employee data.
8(2) is similar for engaging a Data Processor under a contract. Organisations should check contractual commitments rather than rely on vendors' marketing material.
Ask vendors about:
Ask for written proof of security measures and contractual obligations "fully compliant" is not a substitute for controls that can be validated.
When you switch vendors, make sure the first vendor can delete or transfer your data when you move on - including information stored in backup. Keep a record of it, so you don't have employee information sitting around, exposed, after the contract is up.
A practical DPDP Act checklist helps HR convert legal requirements into everyday procedures. Employers should map employee information, document processing purposes, review privacy notices, assess biometric systems, establish retention schedules and evaluate vendor contracts against the applicable legal requirements.
Use this checklist to identify gaps:
This checklist is not evidence of compliance – it is a guideline. Actions you will need to take will vary depending on the organisation's activities, the organisation's data practices and the applicable provisions at the relevant time.
There are also additional areas to take into account: State Shops and Establishments legislation, employment recordkeeping obligations, industry-specific regulations and contractual commitments. If conducting employment across borders there may also be other privacy obligations.
Before selecting an attendance platform, ask the provider how it collects, processes, stores and deletes employee information. HR should seek evidence of security controls, clear contractual responsibilities and documented retention practices rather than relying on general assurances about privacy.
Ask these questions:
1. Does the system store fingerprint templates, facial images or both?
2. Is a non-biometric attendance option available?
3. Where is employee data stored, and who can access it?
4. How is information protected in transit and at rest?
5. Can we configure retention periods and securely delete records?
6. What happens to data and backups after contract termination?
7. How quickly will the vendor report a suspected breach?
8. Which subprocessors are involved?
9. Can the provider support applicable employee data requests?
10. What documentation supports its privacy and security claims?
Require written responses and specify key commitments within contract. A supplier needs to state up-front what it will and won't do, and provide your organisation with the information necessary to judge the risk.
Attendance.ai provides a trust center for details around security, privacy and compliance, all of which HR teams will need in their vendor assessment documentation.
The DPDP Act urges employers to respect employee data. HR teams should know what data they collect, determine the appropriate legal basis, secure the records and erase the data when required.
Whether it's a regular attendance device or a face recognition attendance system, the end goal of every organisation should be to gather minimal data and deploy it responsibly. Know the Digital Personal Data Protection Act, 2023 & the relevant MeitY DPDP Rules notification to know what you need to do as an employer.
Begin with employee mapping, vendor contracts, documenting retention, and review if biometric attendance is needed. A pragmatic, data-driven approach to biometrics minimizes extraneous data collection, enhances data security and builds employee trust.
The Digital Personal Data Protection Act, 2023. It spells out obligations on organisations and rights of individuals, in accordance with the commencement schedule.
The Act does not completely prevent biometric based attendance. Need for necessity, basis of law, providing information and protecting employees' data.
No. The Act identifies consent and prescribed legitimate uses (Section 7) as grounds for processing, which include some employment purposes. The employer needs to decide if they are relevant.
Article 9 of the GDPR refers to biometric data used for the purpose of uniquely identifying a natural person, as a special category. Indian DPDP Act is not structured similarly. Organisations dealing with the international framework should deal with each of them separately.
HR should verify the commencement schedule, security safeguards, breach notification requirements and retention obligations in the official rules and subsequent notifications. Compliance planning should reflect the provisions applicable at the relevant time.