Guide · Employee monitoring · DPDP Act
Is Employee Monitoring Legal in India? A Plain-English Guide to the DPDP Act
DPDP Act 2023 · DPDP Rules 2025 · IT Act 2000 · Last reviewed 29 Oct 2026
- 14-day free trial
- No credit card
- ₹120/user/month + GST
Read the overview
Yes. Monitoring employees is legal in India when it has a real work purpose, is proportionate and staff are told. Section 7(i) of the DPDP Act 2023 lets employers process staff data for employment purposes without consent, but its core duties apply only from 13 May 2027 (by our count).
That date matters. Until then, the main data protection rules for private employers still come from the Information Technology Act, 2000 and the 2011 rules made under it. Below we walk through both, what changes in May 2027, and a short checklist you can use now.
Last reviewed 29 Oct 2026. This is general information, not legal advice; speak to a lawyer before you start, change or expand any monitoring of your team.
Related: Employee monitoring software for India, How to manage employee attendance, Timesheet software for Indian teams.
Where the law stands on 29 Oct 2026
India's Digital Personal Data Protection Act, 2023 (No. 22 of 2023) received the President's assent on 11 August 2023. It is coming into force in three phases, set by two notifications published in the Gazette on 13 November 2025: G.S.R. 843(E) for the Act and G.S.R. 846(E) for the Digital Personal Data Protection Rules, 2025.
| Phase | What comes into force | Date |
|---|---|---|
| On publication | Definitions (s.2), the Data Protection Board (ss.18 to 26) and some general sections; Rules 1, 2 and 17 to 21 | 13 November 2025 |
| One year later | Registration of Consent Managers (s.6(9), s.27(1)(d)); Rule 4 | 13 November 2026 |
| Eighteen months later | Almost all duties of employers and other businesses: ss.3 to 5, s.6 (except 6(9)), ss.7 to 17, ss.28 to 34 (inquiries and penalties), and s.44(2), which removes section 43A from the IT Act; Rules 3, 5 to 16, 22 and 23 | 13 May 2027 |
The notifications count periods ("one year", "eighteen months") from publication and give no calendar dates. The dates in the last column are our calculation from the 13 November 2025 Gazette date. A corrigendum issued on 10 December 2025 (G.S.R. 892(E)) reworded Rule 1 but did not change either period. The Ministry of Electronics and Information Technology (MeitY) listed no later change to these periods on its DPDP Rules page when we checked on 29 Oct 2026. Check that page again before you rely on a date.
What this means for an employer today: the DPDP duties on notice, consent, rights and penalties are not yet in force. Your current legal baseline is the IT Act, 2000 and the 2011 SPDI Rules on sensitive personal data or information (covered below), plus your employment contracts, any applicable labor and state laws, and general privacy expectations after the Supreme Court's Puttaswamy judgment. The sensible move is to build your monitoring policy to the DPDP standard now, so you have less to change in 2027.
What the DPDP Act says about monitoring employees
The Act covers "digital personal data": any data about an identifiable person, in digital form (s.2(n) and s.2(t)). Screenshots, app and website logs, clock-in times, location pings and keystroke counts of a named employee all fit that description. The employer, as the business that decides why and how the data is processed, is the "Data Fiduciary" (s.2(i)). The employee is the "Data Principal" (s.2(j)).
Two lawful grounds: consent or a "legitimate use"
Section 4(1) allows personal data to be processed for a lawful purpose only:
- with the person's consent, or
- for "certain legitimate uses" listed in section 7.
Section 7(i): the employment ground
Section 7(i) is the clause employers care about. It allows processing:
"for the purposes of employment or those related to safeguarding the employer from loss or liability, such as prevention of corporate espionage, maintenance of confidentiality of trade secrets, intellectual property, classified information or provision of any service or benefit sought by a Data Principal who is an employee."
In plain English: once the Act is in force, you do not need an employee's consent to process their data for genuine employment purposes, such as attendance, timesheets, salary records, access control, IT security or protecting confidential client work.
Section 7(i) does not define "purposes of employment", and it is not written as a blanket permission to record everything an employee does. Law firm commentary reads it the same way. King Stubb & Kasiva note that section 7(i) "should not be treated as a blanket authorisation for unrestricted employee surveillance". They add that monitoring unrelated to a legitimate employment or security purpose may need a separate legal basis. The further a tool reaches beyond work (personal accounts, private messages, personal phones, off-hours activity), the harder it is to fit inside "purposes of employment".
Consent and notice
If you rely on consent instead, section 6(1) sets a high bar. Consent must be "free, specific, informed, unconditional and unambiguous with a clear affirmative action", and limited to the data needed for the stated purpose. Employees can withdraw it at any time, as easily as they gave it (s.6(4)). Consent from someone who depends on you for their salary can be hard to show as "free". That is one reason most commentary expects employers to rely on section 7(i) for core HR data.
Section 5 requires a notice with every consent request, covering what data is collected and why, how to withdraw consent and exercise rights, and how to complain to the Data Protection Board. Rule 3 of the DPDP Rules adds that the notice must stand on its own, use clear and plain language, and give "an itemised description" of the personal data.
Strictly, section 5 is tied to consent requests, so the Act does not spell out a separate notice duty for data processed under section 7(i). Even so, a written monitoring policy that tells people what you track and why is the simplest way to show your monitoring is limited to employment purposes. All the guides we reviewed recommend such a policy.
The IT Act, 2000 and the SPDI Rules, 2011: the rules that apply now
Until 13 May 2027, two provisions of the Information Technology Act, 2000 and one set of rules do most of the work.
Section 43A (compensation for failure to protect data). A "body corporate" means a company, firm, sole proprietorship or other association doing commercial or professional work. If it handles "sensitive personal data or information" in a computer resource it owns, controls or operates, and is negligent in keeping reasonable security practices, it must pay damages to the person affected. The section sets no upper limit on the compensation.
The SPDI Rules, 2011 (G.S.R. 313(E), 11 April 2011) were made under section 43A. They matter to monitoring in four ways:
- What counts as sensitive (Rule 3):.passwords; financial information such as bank account or card details; physical, physiological and mental health; sexual orientation; medical records; and biometric information. A fingerprint or face-scan attendance system collects biometric data. A screenshot can capture a password or bank details if one happens to be on screen.
- Privacy policy (Rule 4):.a body corporate that collects or handles personal information must publish a privacy policy on its website covering the types of data it collects, why, when it discloses data, and its security practices.
- Written consent for sensitive data (Rule 5(1)):.you must get "consent in writing through letter or Fax or email" before collecting sensitive personal data, and collect it only for a lawful purpose connected with your business, where it is necessary for that purpose (Rule 5(2)).
- Notice and retention (Rules 5(3) and 5(4)):.tell the person that data is being collected, why, who will receive it and who will hold it, and do not keep sensitive data longer than needed.
All time tracking details
Here is what you get:
- What counts as sensitive (Rule 3): passwords; financial information such as bank account or card details; physical, physiological and mental health; sexual orientation; medical records; and biometric information. A fingerprint or face-scan attendance system collects biometric data. A screenshot can capture a password or bank details if one happens to be on screen.
- Privacy policy (Rule 4): a body corporate that collects or handles personal information must publish a privacy policy on its website covering the types of data it collects, why, when it discloses data, and its security practices.
- Written consent for sensitive data (Rule 5(1)): you must get "consent in writing through letter or Fax or email" before collecting sensitive personal data, and collect it only for a lawful purpose connected with your business, where it is necessary for that purpose (Rule 5(2)).
- Notice and retention (Rules 5(3) and 5(4)): tell the person that data is being collected, why, who will receive it and who will hold it, and do not keep sensitive data longer than needed.
Section 72A (disclosure in breach of a lawful contract). This covers anyone, including a service provider, who gets access to personal information under a lawful contract and discloses it without consent or in breach of the contract, intending or knowing it is likely to cause wrongful loss or gain. They can face up to three years in prison, a fine of up to five lakh rupees, or both. This is a reason to choose monitoring vendors carefully and to keep access tight.
How the two regimes connect. Section 44(2) of the DPDP Act omits section 43A from the IT Act. That amendment is in the eighteen-month phase, so section 43A and the SPDI Rules made under it are expected to stop applying from 13 May 2027, when the DPDP duties take over. Where the DPDP Act conflicts with another law, section 38(2) says the DPDP Act prevails.
Employee rights, employer duties and how long to keep data
These DPDP duties apply from 13 May 2027.
Employer (Data Fiduciary) duties under section 8
- Accuracy (s.8(3)):.if you use the data to make a decision about the employee, such as pay, appraisal or discipline, it must be complete, accurate and consistent. That is a good reason to let employees see and correct their timesheets.
- Security (s.8(5) and Rule 6):.take reasonable security safeguards. Rule 6 lists the minimum: measures such as encryption or masking, access control, logs and monitoring of who accesses the data, backups, contracts with your vendors (Data Processors), and keeping those access logs for one year.
- Breach notice (s.8(6) and Rule 7):.tell each affected person without delay, and tell the Data Protection Board without delay, with a detailed report within 72 hours of becoming aware of the breach.
- Erasure (s.8(7)):.erase personal data once the purpose is no longer served, unless a law requires you to keep it, and make your vendors erase it too.
- A contact person (s.8(9) and Rule 9):.publish the business contact details of someone who can answer questions about how you process personal data.
- Grievances (s.8(10) and Rule 14(3)):.run a working grievance process. Rule 14(3) sets the response window at no more than ninety days.
- Vendors (s.8(1) and 8(2)):.you stay responsible for any processing your vendors do for you, and you need a valid contract with them.
A minimum retention period, too
Rule 8(3) requires a Data Fiduciary to keep personal data, traffic data and logs of its processing for at least one year from the date of processing, for the purposes listed in the Seventh Schedule (requests from authorized government officers). After that, it must erase them unless another law requires a longer period. Read with section 8(7), this means you keep such data for at least one year, but not indefinitely. Ask your lawyer how this applies to screenshots and activity logs in your setup.
Employee (Data Principal) rights
- Access (s.11):.a summary of the data processed and who it was shared with.
- Correction and erasure (s.12).
- Grievance redressal (s.13):.employees must use your grievance process before going to the Board.
- Nomination (s.14):.naming someone to exercise these rights after death or incapacity.
One nuance: the access and correction rights in sections 11 and 12 are written for data the person "previously gave consent" for (including under s.7(a)). Whether they reach data processed under section 7(i) is not settled. The safer course is to answer employee requests about monitoring data anyway.
Penalties under the DPDP Act
Penalties are civil and imposed by the Data Protection Board after an inquiry, under section 33 and the Schedule to the Act. The amounts are maximums ("may extend to"):
| Breach | Maximum penalty |
|---|---|
| Failing to take reasonable security safeguards (s.8(5)) | ₹250 crore |
| Failing to notify the Board or affected people of a breach (s.8(6)) | ₹200 crore |
| Breaking the additional rules for children's data (s.9) | ₹200 crore |
| Breaking the additional duties of a Significant Data Fiduciary (s.10) | ₹150 crore |
| Breaking the terms of a voluntary undertaking accepted by the Board (s.32) | Up to the penalty for the original breach |
| Any other breach of the Act or Rules | ₹50 crore |
| A Data Principal breaking their own duties (s.15) | ₹10,000 |
Section 33(2) tells the Board to weigh the nature, gravity and duration of the breach, the type of data, repetition, any gain made or loss avoided, mitigation, proportionality and the likely impact on the business. A small employer is unlikely to face the maximum. Still, the Schedule's highest penalty is for failing to take reasonable security safeguards, so collecting more data than you can protect is a real risk.
The penalty sections (ss.28 to 34) are in the eighteen-month phase, so they apply from 13 May 2027. Until then, the IT Act remedies above apply.
What Puttaswamy adds
In Justice K.S. Puttaswamy (Retd.) v. Union of India, decided on 24 August 2017 and reported at (2017) 10 SCC 1, a nine-judge bench of the Supreme Court held that "the right to privacy is protected as an intrinsic part of the right to life and personal liberty under Article 21 and as a part of the freedoms guaranteed by Part III of the Constitution."
The case was about the State, so it does not directly bind a private employer. For employers, its lasting value is the test for any intrusion into privacy, set out in the plurality judgment written by Justice D.Y. Chandrachud: (i) legality, (ii) a legitimate aim, and (iii) proportionality, meaning a rational link between the aim and the means used. Ask the same three questions about your own monitoring: is it allowed, what is it for, and is it the lightest way to get there.
Do's and don'ts for employers
Do
- Write down why you monitor (for example accurate timesheets, client billing, attendance, security) and collect only what serves that purpose.
- Give every employee a written monitoring policy before tracking starts, and when you change it.
- Choose the lightest tool that works. Attendance and timesheets answer most "who worked when" questions without screenshots.
- Limit monitoring to work devices, work accounts and working hours.
- Restrict who can see screenshots and activity data, and log that access.
- Set a retention period and delete on schedule.
- Get written consent before collecting biometric or other sensitive data under the SPDI Rules.
- Let employees see their own records and raise concerns.
Don't
- Don't record covertly or turn on webcams or microphones without a specific, documented reason and legal advice.
- Don't read personal email, personal chats or personal social media accounts.
- Don't track personal phones or laptops beyond work apps without clear, specific agreement.
- Don't keep screenshots "just in case" with no end date.
- Don't make pay or disciplinary decisions from activity data alone, without letting the employee respond.
Employer checklist
- List every type of employee data you collect, and the reason for each
- Map each reason to section 7(i) "purposes of employment", or decide you need consent
- Write and share a monitoring policy in clear language (English, plus another language if your team needs it)
- Get written consent for biometric attendance and other sensitive data (SPDI Rules, Rule 5)
- Turn off any tracking you cannot justify
- Limit admin access and keep access logs
- Set retention periods and a deletion routine
- Sign data processing terms with your monitoring and HR software vendors
- Name a contact person for data questions and set up a grievance route
- Write a breach response plan (Board report within 72 hours from 13 May 2027)
- Review the plan with a lawyer before 13 May 2027
All details: Employer checklist
- List every type of employee data you collect, and the reason for each
- Map each reason to section 7(i) "purposes of employment", or decide you need consent
- Write and share a monitoring policy in clear language (English, plus another language if your team needs it)
- Get written consent for biometric attendance and other sensitive data (SPDI Rules, Rule 5)
- Turn off any tracking you cannot justify
- Limit admin access and keep access logs
- Set retention periods and a deletion routine
- Sign data processing terms with your monitoring and HR software vendors
- Name a contact person for data questions and set up a grievance route
- Write a breach response plan (Board report within 72 hours from 13 May 2027)
- Review the plan with a lawyer before 13 May 2027
Lighter tracking with Trakkar
Trakkar is time tracking, attendance and invoicing software for Indian agencies and client-service teams, used by 100+ teams. It does not make your monitoring lawful by itself. That depends on why you monitor, how much you track and what you tell your team. Screenshots and app tracking are on by default in the desktop app, and admins can turn them off for any person. Here's what Trakkar covers:
- Attendance with clock-in from the web app and the Android and iPhone apps, shifts with grace periods, and breaks logged by type
- Time tracking in the Windows and macOS desktop apps, with idle time flagged
- Screenshots, on by default in the desktop app: taken every 10 minutes by default, with a different interval per person if needed, and admins can turn them off for anyone
- App and URL tracking, also on by default in the desktop app, and admins can turn it off for each person
- Each person sees their own day view, idle time and screenshots
All details: Lighter tracking with Trakkar
- Attendance with clock-in from the web app and the Android and iPhone apps, shifts with grace periods, and breaks logged by type
- Time tracking in the Windows and macOS desktop apps, with idle time flagged
- Screenshots, on by default in the desktop app: taken every 10 minutes by default, with a different interval per person if needed, and admins can turn them off for anyone
- App and URL tracking, also on by default in the desktop app, and admins can turn it off for each person
- Each person sees their own day view, idle time and screenshots
You can run on attendance and timesheets alone by turning screenshots and app tracking off. If you keep them on, do it for a stated reason, only for the people it applies to, and only after you have shared your policy. Read more on employee monitoring software in India and what screenshot monitoring really costs in productivity.
Start a 14-day free trial, no card needed or book a 30-minute demo.
Related reading
Sources
- Digital Personal Data Protection Act, 2023 (No. 22 of 2023), Gazette of India, 11 August 2023 (MeitY copy)
- MeitY notification G.S.R. 843(E), 13 November 2025 (commencement of the Act)
- MeitY notification G.S.R. 846(E), 13 November 2025 (Digital Personal Data Protection Rules, 2025), and corrigendum G.S.R. 892(E), 10 December 2025
- Information Technology Act, 2000, sections 43A and 72A (India Code)
- Information Technology (Reasonable security practices and procedures and sensitive personal data or information) Rules, 2011, G.S.R. 313(E)
- Justice K.S. Puttaswamy (Retd.) v. Union of India, (2017) 10 SCC 1, judgment of 24 August 2017
- King Stubb & Kasiva, "Can Employers Monitor Employee Devices, Emails and Communications Under India's DPDP Act?" (commentary)
All details: Sources
- Digital Personal Data Protection Act, 2023 (No. 22 of 2023), Gazette of India, 11 August 2023 (MeitY copy)
- MeitY notification G.S.R. 843(E), 13 November 2025 (commencement of the Act)
- MeitY notification G.S.R. 846(E), 13 November 2025 (Digital Personal Data Protection Rules, 2025), and corrigendum G.S.R. 892(E), 10 December 2025
- Information Technology Act, 2000, sections 43A and 72A (India Code)
- Information Technology (Reasonable security practices and procedures and sensitive personal data or information) Rules, 2011, G.S.R. 313(E)
- Justice K.S. Puttaswamy (Retd.) v. Union of India, (2017) 10 SCC 1, judgment of 24 August 2017
- King Stubb & Kasiva, "Can Employers Monitor Employee Devices, Emails and Communications Under India's DPDP Act?" (commentary)
Trusted by 100+ teams across India
Related pages
Other high-intent guides for Indian teams.
Frequently asked questions
Is employee monitoring legal in India?
Yes, when it has a genuine work purpose, is proportionate and employees are told about it. No Indian law bans workplace monitoring. Today the IT Act, 2000 and the SPDI Rules, 2011 apply. From 13 May 2027, section 7(i) of the DPDP Act allows processing for employment purposes, along with duties on security, erasure and grievances.
Do employers need employee consent to monitor under the DPDP Act?
Not for genuine employment purposes. Section 7(i) lists "the purposes of employment" as a legitimate use, so consent is not the only ground. Monitoring that goes beyond work, such as personal accounts or personal devices, may need consent or another basis. Under the current SPDI Rules, biometric and other sensitive data need written consent.
Is screen monitoring or screenshot tracking legal in India?
No law bans it, but it is the kind of tracking that most needs a clear reason. Screenshots can capture personal and sensitive data, such as passwords or bank details, so limit them to work devices and hours, tell employees in writing, restrict access and delete them on a schedule. Lighter options like timesheets often meet the same goal.
When does the DPDP Act apply to employers?
Most employer duties, including notice, consent, rights, security, breach reporting and penalties, start eighteen months after the 13 November 2025 Gazette notification, which works out to 13 May 2027. Consent Manager registration starts one year after publication, on 13 November 2026. Check MeitY's DPDP page for any change before relying on these dates.
What are the penalties for breaking the DPDP Act?
The Data Protection Board can impose penalties of up to ₹250 crore for failing to take reasonable security safeguards, up to ₹200 crore for failing to report a breach, and up to ₹50 crore for most other breaches. The Board weighs gravity, duration, repetition and mitigation. These penalties apply from 13 May 2027.
Can my employer monitor my personal phone or laptop?
The DPDP Act does not deal with personal devices directly. Monitoring a personal device is much harder to justify as a "purpose of employment" than monitoring a company laptop. Keep it to work apps or a separate work profile, explain it in writing, and take legal advice before tracking anything else.
Is this guide legal advice?
No. This is general information, not legal advice; speak to a lawyer about your own situation. Laws and dates can change; we last reviewed this guide on 29 Oct 2026.
Try Trakkar
₹120/user/month + GST ($5/user/month outside India). 14-day free trial for any number of users, no credit card. Every module is included.