Consent is not compliance: What the DPDP Act means for HR and employee data

India’s evolving data protection framework is putting employee information under greater scrutiny, as organisations expand their use of workforce analytics, digital HR platforms and artificial intelligence.

At a recent People Matters Big Questions India discussion, Anurag Malik, Partner and Leader – People Consulting at EY India, and Roma Bindroo, People Director India at Opella India, examined how HR can balance compliance, employee trust and business agility.

The discussion, titled DPDP Act: Can HR Stay Agile While Compliance Requirements Keep Growing?, explored the practical questions facing organisations, from legacy employee records and external vendors to AI-assisted decisions and workplace monitoring.

The central challenge is no longer limited to collecting consent. HR leaders must understand the purpose behind each data point and how its use could affect employees across their working lives.

HR is moving beyond the role of data custodian

Employee data has traditionally supported routine processes such as attendance, compensation, benefits and performance management. Its scope has expanded as organisations collect information on wellbeing, skills, engagement, collaboration and interactions with AI tools.

Malik said HR’s role is evolving from data custodian to data steward, reflecting the broader implications of workforce information. Data can influence hiring, selection, career progression and succession planning, making its use a question of organisational accountability.

He urged HR leaders to examine three basic questions:

• What employee data is being collected?

• How will the organisation use it?

• Can the organisation publicly explain why it collected the information and how it will use it?

These questions place data governance within HR’s operating responsibilities rather than leaving it solely to legal or technology teams. They also require organisations to consider the implications of data use beyond the initial collection stage.

Consent is only one part of the equation

A recurring theme was the assumption that obtaining employee consent automatically establishes compliance. Malik cautioned against this interpretation, emphasising the need to clarify purpose, use and retention.

“Consent is not equivalent to compliance,” he said.

Organisations must also determine how long they need employee information and when it should be removed from their systems. These questions become more complicated when records have accumulated over several years or move between internal teams and external providers.

Bindroo noted that organisations are at different stages of their data privacy journeys.

Some have established security controls but need to examine how information is used, while others must revisit consent practices, legacy records and retention policies.

She also highlighted the questions arising when payroll and other compliance-related activities are outsourced. Employers need clarity on how vendors handle employee information and how accountability operates across these arrangements.

Stronger governance could support innovation

Stricter data requirements can initially require organisations to review processes and establish clearer controls. However, Malik said better data practices can strengthen the foundations for workforce analytics and AI adoption.

He compared data governance with quality controls in manufacturing and financial controls in banking. In his view, stronger foundations can improve confidence in information and support more credible decisions over time.

Bindroo also emphasised the value of defining purpose before collecting information. She pointed to the volume of data generated across organisational systems, including platforms that may not communicate effectively with one another.

For HR, the practical question is whether each data point serves a clear purpose. Collecting more information does not automatically produce better workforce insight, particularly when systems remain disconnected or the organisation cannot explain how information supports employee or business outcomes.

Vendor risk requires ongoing oversight

External providers can handle sensitive information through payroll, benefits administration and other HR services. The discussion highlighted the need to assess these relationships before sharing employee records and throughout the vendor engagement.

Malik outlined several areas for HR and its internal partners to examine:

• Due diligence: Review vendor security controls, governance frameworks and relevant certifications, including ISO and SOC credentials.

• Contractual accountability: Establish clear obligations for vendors handling sensitive employee information.

• Data lifecycle management: Examine how information is collected, stored, analysed, retrieved, archived and disposed of.

• Ongoing audits: Check whether vendors continue to follow the required data handling practices.

Bindroo also described privacy audits as a useful starting point for understanding existing practices and identifying areas for improvement. Such reviews can help organisations determine which information they genuinely need and how long they should retain it.

She highlighted the importance of reviewing internal systems as well, particularly where AI tools can access organisational information. HR teams need clarity on which systems these tools can reach and what information they can use.

Employee awareness must extend to people managers

Employees do not always ask how organisations collect or use their information, Bindroo observed. She saw an opportunity for employers to explain their practices more clearly and strengthen trust through greater transparency.

Malik placed particular emphasis on training people managers, who may have access to sensitive information without fully understanding the responsibilities involved. He recalled a consulting example in which managers shared performance feedback, ratings and bonus percentages through WhatsApp after performance reviews.

The example illustrated how everyday communication practices can create risks around employee information. Access to team data does not give managers unrestricted permission to download, transmit or share it.

Malik also called for greater awareness of AI explainability when HR teams use these tools for shortlisting, hiring, career decisions and learning. Training needs to cover appropriate use as well as the limitations of AI-generated recommendations.

The line between workforce insight and surveillance

Workplace tracking technologies can help organisations understand operational patterns, but employees may interpret the same practices as surveillance. Malik described a plant where workers received tracking badges to help the employer analyse how time was spent across different areas.

The organisation intended to study workforce deployment and identify patterns associated with productivity. However, the initiative became a union issue because workers interpreted the tracking as surveillance.

The example highlighted how the purpose of data collection can differ from employees’ perceptions of its use. Malik stressed the importance of clarifying why information is collected and how organisations intend to use it.

For HR leaders, the distinction requires more than a technology assessment. They must consider whether the data serves a defined purpose and whether employees understand the rationale behind the practice.

HR cannot manage data governance alone

The discussion also highlighted the need for HR, IT and legal teams to work together. Each function brings a different perspective, while its individual responsibilities may leave gaps in the overall approach.

Technology teams understand infrastructure and security controls, HR understands employee experience and workforce implications, and legal teams bring expertise in compliance and governance. Malik suggested bringing these perspectives together through a governance council or committee.

He said such a body could include representatives from HR, IT, legal, risk, compliance and relevant technology or AI teams. Their combined input can help organisations assess data practices across systems and workforce processes.

This cross-functional approach becomes particularly important as AI applications expand. Decisions about employee information can involve technical controls, regulatory considerations and consequences for people’s careers, requiring more than one function’s expertise.

Employees may expect more value from their data

Looking ahead, Malik suggested employee expectations could change within the next two to three years. He expects workers to place greater importance on whether organisations use their information credibly to support career mobility, training and professional development.

The shift could create a different relationship between data governance and employee experience. Information would need to be protected, but its use would also need to deliver meaningful value without undermining trust.

For HR, the challenge is to establish clear purposes, responsible access and accountability while enabling useful workforce insights. The discussion underscored that privacy and agility need not be competing priorities when organisations build appropriate governance into their processes.

Ultimately, the question is whether employers can explain what they collect, why they need it and how they use it. Employee trust will depend not only on consent, but also on the decisions organisations make with the information entrusted to them.