Under the Digital Personal Data Protection Act, 2023:
- Processing for employment purposes is a "legitimate use" (s. 7). It covers attendance, payroll, statutory returns, safety and preventing corporate espionage, and needs no separate consent.
- Collect only what is needed. Give employees a notice of the data held and its purpose.
- Keep the data secure and limit access to those who need it.
- Report personal data breaches to the Data Protection Board and to the affected persons, as the Rules require.
- Location tracking (for example GPS attendance) should be proportionate, limited to marking attendance, and disclosed in the policy.
On Labour Law Guru, each establishment's data is visible only to that establishment's users and the assigned team member.
Last reviewed 17-10-2026. General information, not legal advice for a specific case. Check the latest Act, Rules and notifications of the appropriate government before acting.