Employee monitoring law · India
DPDP gives employment a legitimate use, but automated monitoring is argued to sit outside it.
Do not assume employment legitimate use covers automated monitoring. Get notice and consent right.
- Region
- Asia Pacific
- Instruments
- 2 governing
- Employer duties
- 3 listed
- Last reviewed
- August 22, 2026
India · what the law requires
Notice and proportionality
The Digital Personal Data Protection Act 2023 applies to employee data. Section 7(i) provides a legitimate use for employment purposes, which covers ordinary HR processing without consent. The contested area is automated monitoring: the common reading is that activity logging and similar tools go beyond the employment legitimate use and need consent and a clear notice, and that covert monitoring outside disclosed systems is not available at all. Rules under the Act continue to be phased in.
- An itemised noticeDPDP requires notice describing the personal data and the purpose, in clear and plain language, available in scheduled languages.
- Consent where you go beyond employment purposesPayroll, attendance and safety sit inside the legitimate use. Automated activity monitoring is widely read as needing consent on top.
- Nothing covertMonitoring outside the systems you have disclosed is not defensible under the Act.
- Proof Ledger
- Outcomes
- Certificates
- Audit log
- Data access
- Disputes
- Data egress
- Export
- What We See
- Controls
- AKAria K. viewed screenshotsLena M. · 3 capturesScreen capturemacOS · London09:42a91f…4c023d7b…91ee
- JMJon M. exported time reportDesign team · CSVmacOS · Berlin09:313d7b…91ee77c5…0ba4
- SDSara D. opened capture reviewRavi P. · one flagged frameWindows · Manchester09:1877c5…0ba4e208…5f13
- wm_live_7f2… read /v1/deliverablesScoped key · read onlyPublic API · allowlisted IP08:57e208…5f13b64a…2d90
- LMLena M. viewed her own recordWhat We SeemacOS · London08:44b64a…2d901cf9…8e77
- AKAria K. changed capture policyBlur set to alwaysmacOS · London08:261cf9…8e7705d2…ae31
The instruments, and which control answers each duty
- Digital Personal Data Protection Act, 2023: DPDP Act 2023, esp. ss. 5, 7(i), 8. Notice requirements, consent, the employment legitimate use, and the data fiduciary's security and accountability duties.
- Information Technology Act, 2000: IT Act s. 43A and the SPDI Rules. The predecessor regime for sensitive personal data, still relevant while DPDP rules phase in.
No product does this part
What you must still do yourself
Compliance is a property of your deployment. These are the steps in India that no vendor can complete on your behalf, and skipping them is what turns a rollout into a finding.
- 1Draft the DPDP notice, including the scheduled-language requirement.
- 2Decide and document whether you are relying on the employment legitimate use or on consent, and get consent where monitoring goes beyond HR basics.
- 3Track the phased rules; this regime is still settling.
- If you get it wrongPenalties up to INR 250 crore for failure to take reasonable security safeguards, with other breaches scaled below that.
Verify the claim
Every control above, on the page that describes it
- Consent and notice record with the version and date per personGive notice and record what each person agreed to
- Employee self-view of collected data plus an appeal route for a specific captureKeep monitoring visible rather than covert
- Credential-derived tenant isolation enforced by database constraintsMeet the security duty on the data you hold
Sources and review date
Last reviewed August 22, 2026This is a summary of how employee-monitoring rules generally work in this jurisdiction, written to help you scope a rollout and brief your own advisers. It is not legal advice, it is not a substitute for it, and law changes. Verify against the primary sources listed and take local counsel before you deploy.
Nearby jurisdictions
Monitoring law elsewhere in Asia Pacific
- PhilippinesTransparency, legitimate purpose and proportionality: the three-part NPC test.
- JapanSpecify the purpose of use, publish it, and do not exceed it.
- SingaporeEmployment data has a deemed-consent route, but notification is still mandatory.
- AustraliaIn NSW and the ACT: 14 days' written notice, with prescribed content, before you start.
- PolandThe Labour Code lists the permitted purposes, and productivity is not one of them.
- United KingdomThe ICO's 2023 monitoring guidance is the operative document, and it expects a DPIA.
Point it at one team for a week.
Create the account, put the agent on a handful of desks, and leave it alone. On Friday you read the week instead of reconstructing it: hours against their projects, focus and idle per person, and the timesheets already filled in.
Free for two seats. No card, and no sales call to sit through.