The Digital Personal Data Protection Act, 2023 (DPDP Act) is India's general data protection law. It became operational through the DPDP Rules, 2025, which the Ministry of Electronics and Information Technology (MeitY) notified in November 2025 with a phased start. This article covers the timeline; for how notice and consent apply to workplace monitoring specifically, see DPDP and employee monitoring: notice, consent and rollout.
The phases
| When | What applies |
|---|---|
| On notification (November 2025) | Definitions and the constitution and functioning of the Data Protection Board of India |
| After 12 months (about November 2026) | Registration and obligations of consent managers |
| After 18 months (about May 2027) | Most obligations of data fiduciaries: notices, reasonable security safeguards, breach intimation, retention and erasure, data principal rights, and related provisions |
Confirm exact commencement dates in the gazette notification on MeitY's site.
Why HR data is in scope
An employer is a data fiduciary for employee personal data: identity documents, bank details, payroll, performance records and any monitoring data. The Act lists employment among "legitimate uses" for which some processing can occur without consent, but that is not a blanket exemption — security, purpose limitation, retention and breach duties still apply. How far the employment ground covers monitoring is a judgement to make with counsel.
What to prepare before May 2027
- Data map: list every employee data category, where it lives and who can see it.
- Purpose per category: write why you hold it. Data without a purpose is a liability.
- Retention schedule: how long each category is kept and how it is deleted — see building an employee data retention schedule.
- Access design: role-based access to sensitive fields — see role-based access for HR data.
- Breach playbook: who decides, who notifies the Board and affected people — see the workforce data incident playbook.
- Notices: plain-language notices for employees, especially for monitoring.
Where Kyrospect stands
Kyrospect publishes what its product does with workday data on its privacy policy, security page and DPA. Employees can see their own tracked records, access is role-scoped, and captured activity data is stored encrypted. Those are product facts, not a compliance certification — your own obligations as data fiduciary remain yours.
Sources and review date
Facts in this article were checked against the official sources below as of 8 October 2026. Rates, wage ceilings, due dates and forms change by notification, so confirm on the source before acting.
This is a general explainer written by the Kyrospect editorial team, not legal, tax or payroll advice. Applicability depends on your state, headcount, establishment type and contracts — confirm with a qualified professional or the authority concerned.
Where Kyrospect fits: Kyrospect HRMS holds employee records and Tracking records shift hours on the same identity. It does not calculate or file PF, ESI, professional tax, TDS or gratuity today — payroll is planned and gated on statutory compliance work. See the roadmap for current status.