DPDP for HR Teams in India. Employee data, POSH, and Labour, one console.

Yes. Every HR record — resume, Aadhaar, PAN, bank details, health insurance forms, biometric attendance, performance ratings — is personal data under the DPDP Act 2023. HR is arguably the largest volume of personal data your company processes.

Section 7(a) provides a "legitimate use" exemption for processing that is necessary for the employment relationship, so blanket consent for payroll or PF is not required. But this covers only what is strictly necessary. Voluntary programmes (wellness apps, biometric attendance beyond time-tracking, background checks by third parties, marketing to alumni) still need explicit consent under Section 6.

You must respond within statutory timelines. But you can retain data required by other laws — PF records (5 years), tax records (8 years), gratuity records (3+ years), CCTV footage (varies by state). dcomply's DSR module auto-applies retention exemptions and shows the ex-employee what was kept and why.

POSH complaint files are personal + sensitive data. Complainant identity must be kept confidential (POSH Act Sec. 16), and the DPDP Act adds consent + purpose limitation on top. dcomply's POSH module ships with DPDP-compliant complaint intake, redacted committee reports and encrypted evidence storage.

Biometric data is high-risk under DPDP. Section 8(4) requires reasonable security safeguards and Rule 12 flags biometric processing as high-risk for DPIA. You need: explicit consent (Section 6, not Section 7 exemption), encryption at rest, purpose limitation, and a DPIA. dcomply's DPIA module walks through this in 30-60 minutes.

BGV vendors (AuthBridge, IDfy, BetterPlace) are Data Processors under Section 8(2). You are the Data Fiduciary. Requirements: signed DPA, purpose limitation, consent from the candidate (Section 6), breach flow-through, sub-processor visibility. dcomply's Vendor Register templates the DPA and tracks all of the above.

Yes on retention. PIP and exit-interview notes have no statutory retention period, so under DPDP purpose limitation they should be deleted once the purpose is served (usually 12-24 months post-exit). dcomply's Retention module runs the schedule automatically.

Every Data Fiduciary must have a published grievance mechanism reachable by data principals — including your own employees. dcomply's Grievance module publishes a portal, tracks SLA, escalates to your DPO (or vDPO), and produces the Section 13 audit trail.

Labour Codes are being notified state-by-state. Your PF, ESI, gratuity, minimum wages and Shop & Establishment obligations vary by state and employee headcount. dcomply's Labour Codes module tracks the applicable regime per state per employee.

Yes. dcomply is a compliance workspace, not an HRMS. Employee data stays in your HRMS. Compliance evidence, DPDP consent, POSH complaints, retention schedules, DSR responses and audit trails live in dcomply. Native connectors are on the roadmap; today the integration is via CSV import + API sync.

Failure to secure HR data can trigger Schedule 1 penalties up to ₹250 crore. Failure to notify a breach involving employee data triggers up to ₹200 crore. Given typical HR data volumes (thousands of Aadhaar + payroll records), exposure is real. dcomply's Financial Risk module quantifies your specific exposure.

Most HR-focused deployments are operational within 5-7 working days: policy generation (Day 1), employee-consent re-collection sweep (Days 2-3), POSH IC verification (Day 3), DSR portal published (Day 4), DPO/grievance officer contact published (Day 5). Full audit-defensibility within 30 days.