DPDP's November milestone: what it means for your employee data

If you have received a vendor email in the last month warning that "the DPDP deadline is in November", you are not alone. The Digital Personal Data Protection Rules, 2025 were notified on 14 November 2025 with a phased timeline, and their first anniversary is now weeks away. For HR teams, which hold more sensitive personal data than almost any other function in a small company, it is worth being precise about what the November date does and does not mean.

The short version: November is a real milestone, but it is not the date by which your HR data practices must be fully compliant. That date is in May 2027. The months in between are the time to do the work calmly.

The three phases

The Rules introduce an eighteen-month period for phased compliance. Shardul Amarchand Mangaldas, in its briefing on the notification, sets out three dates:

• On notification (November 2025): the commencement provisions and the establishment of the Data Protection Board of India.
• One year later (November 2026): the provisions on Consent Managers, the registered platforms through which individuals can give, review and withdraw consent across organisations. The firm's briefing also places the Board's penalty-related powers in this phase.
• Eighteen months later (May 2027): the substantive obligations for data fiduciaries, including notices, consent, security safeguards, breach reporting, children's data and the rights of individuals.

For an employer, almost everything that matters day to day sits in the third phase. Consent Managers matter most to consumer-facing businesses that rely on consent; most employers process employee data on a different basis, as explained below.

One more thing to know: in January 2026, Business Standard reported that the IT Ministry had proposed shortening the timeline for certain provisions applying to significant data fiduciaries, the largest data handlers, from eighteen months to twelve. A typical small or mid-size employer is unlikely to be designated a significant data fiduciary, and we have not seen a notified amendment as of writing. If one appears, check whether it reaches beyond that category.

Why employee data is different

The Act lets data fiduciaries process personal data either with consent or for certain "legitimate uses". One of those legitimate uses covers the purposes of employment, and matters related to safeguarding the employer from loss or liability, such as preventing corporate espionage, keeping trade secrets and confidential information confidential, or providing a service or benefit an employee has asked for.

This matters because running payroll, keeping attendance and maintaining personnel files do not, in general, depend on employee consent under the Act. But it is not a blank cheque. The legitimate use is tied to the purpose of employment. Collecting more than you need, keeping it forever, sharing it loosely or repurposing it for something unrelated to employment is where risk accumulates.

What the Rules will ask of you by May 2027

From the Ministry's own summary of the Rules and the briefings below, the obligations most relevant to an employer are:

• Reasonable security safeguards for the personal data you hold. Failure to maintain them carries the Act's highest penalty, up to ₹250 crore.
• Breach notification. When a personal data breach occurs, affected individuals must be informed without delay in plain language, and the Board must be notified, with a detailed report generally due within 72 hours. Failing to notify can attract penalties of up to ₹200 crore.
• A published contact for data-related queries, either a designated officer or a Data Protection Officer.
• Responding to rights requests for access, correction and erasure within ninety days.
• Retaining logs. The Rules require personal data, associated traffic data and processing logs to be retained for at least a year for specified purposes, unless other law requires longer.
• Using processors responsibly. If a payroll bureau, HR software provider or background-verification agency processes employee data for you, you remain answerable for it.

The headline penalty numbers are maximums, and the Board will weigh the circumstances. But the reasonable reading for a small employer is that security and breach handling are the two areas to get right first.

A checklist for the next seven months

1. Map your employee data. List what you collect (identity documents, bank details, PAN, Aadhaar, medical records, family details, background checks), where it lives (HR system, payroll, email, shared drives, WhatsApp) and who can see it. The spreadsheet on someone's laptop is usually the biggest risk.
2. Cut what you do not need. If you collect something "just in case", stop. Purpose limitation is easier to show when your forms only ask for what you use.
3. Set retention periods. Decide how long you keep ex-employee records, with reference to tax, labour and other laws that require retention, and then actually delete when the period ends.
4. Tighten access. Payroll data should be visible to payroll, not to every manager. Bank and identity numbers should be masked wherever full values are not needed.
5. Write a breach runbook. Who decides that something is a breach, who informs employees, who reports to the Board, and how. Rehearse it once.
6. Name a contact. Pick the person who answers employee data questions and publish their details internally.
7. Prepare for rights requests. Know how you would respond if an employee asks what data you hold about them, or asks you to correct it.
8. Review your vendors. Ask your HR, payroll and background-check vendors how they secure data, where it is stored, and how they will notify you of a breach. Put the answers in the contract.
9. Write an employee privacy notice explaining what you collect and why, even where you rely on legitimate use. It costs little and answers most questions before they are asked.

Where ZekoHR fits

A single HR system is easier to secure than data scattered across spreadsheets and inboxes, which is the main reason we argue for one employee record. In ZekoHR, access is role-based, so a manager sees their team and not the payroll register; payslips mask bank account, PAN and UAN; and sensitive changes are written to an audit log. Our security page lists what is live, what is planned and where we have gaps, including how an erasure request is handled and our breach-notification procedure, so you can answer your own vendor-review questions about us honestly.

Sources

• DPDP Rules, 2025 notified (PIB backgrounder, 17 November 2025)
• Enforcement of the DPDP Act and notification of the DPDP Rules (Shardul Amarchand Mangaldas)
• Meity may cut compliance timeline for key DPDP rules to 12 months (Business Standard, 22 January 2026)
• The Digital Personal Data Protection Act, 2023 (MeitY)

This article is general information, not legal advice. The DPDP timeline and its application to your organisation can depend on facts and on further notifications; confirm your obligations with a qualified professional.