Impact Of DPDP Act On Employee Data

As the recently passed Digital Personal Data Protection Act, 2023 ('DPDPA') awaits implementation guidance from the Government, it is slated to have significant impact across all sectors and industries. As a result of the same, entities would have to reimagine data handling practices when processing personal data of customers, employees and other third parties who are individuals.

A common thread tying all types of businesses together (B2B, B2C etc.) would be the impact on processing of employee data. Unlike the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 ('SPDI Rules'), the DPDPA would apply uniformly to all personal data and provide a comprehensive framework for such processing, regardless of whether the information is 'sensitive'¹. It also proposes the constitution of a Data Protection Board ('DPB'), which would adjudge non-compliances and impose penalties².