Yes. Monitoring employees is legal in India when it has a real work purpose, is proportionate and staff are told. Section 7(i) of the DPDP Act 2023 lets employers process staff data for employment purposes without consent, but its core duties apply only from 13 May 2027 (by our count).
DPDP Act 2023 · DPDP Rules 2025 · IT Act 2000 · Last reviewed 29 Oct 2026That date matters. Until then, the main data protection rules for private employers still come from the Information Technology Act, 2000 and the 2011 rules made under it. Below we walk through both, what changes in May 2027, and a short checklist you can use now.
Last reviewed 29 Oct 2026. This is general information, not legal advice; speak to a lawyer before you start, change or expand any monitoring of your team.
Related: How to manage employee attendance, Timesheet software for Indian teams.
India's Digital Personal Data Protection Act, 2023 (No. 22 of 2023) received the President's assent on 11 August 2023. It is coming into force in three phases, set by two notifications published in the Gazette on 13 November 2025: G.S.R. 843(E) for the Act and G.S.R. 846(E) for the Digital Personal Data Protection Rules, 2025.
| Phase | What comes into force | Date |
|---|---|---|
| On publication | Definitions (s.2), the Data Protection Board (ss.18 to 26) and some general sections; Rules 1, 2 and 17 to 21 | 13 November 2025 |
| One year later | Registration of Consent Managers (s.6(9), s.27(1)(d)); Rule 4 | 13 November 2026 |
| Eighteen months later | Almost all duties of employers and other businesses: ss.3 to 5, s.6 (except 6(9)), ss.7 to 17, ss.28 to 34 (inquiries and penalties), and s.44(2), which removes section 43A from the IT Act; Rules 3, 5 to 16, 22 and 23 | 13 May 2027 |
The notifications count periods ("one year", "eighteen months") from publication and give no calendar dates. The dates in the last column are our calculation from the 13 November 2025 Gazette date. A corrigendum issued on 10 December 2025 (G.S.R. 892(E)) reworded Rule 1 but did not change either period. The Ministry of Electronics and Information Technology (MeitY) listed no later change to these periods on its DPDP Rules page when we checked on 29 Oct 2026. Check that page again before you rely on a date.
What this means for an employer today: the DPDP duties on notice, consent, rights and penalties are not yet in force. Your current legal baseline is the IT Act, 2000 and the 2011 SPDI Rules on sensitive personal data or information (covered below), plus your employment contracts, any applicable labor and state laws, and general privacy expectations after the Supreme Court's Puttaswamy judgment. The sensible move is to build your monitoring policy to the DPDP standard now, so you have less to change in 2027.
The Act covers "digital personal data": any data about an identifiable person, in digital form (s.2(n) and s.2(t)). Screenshots, app and website logs, clock-in times, location pings and keystroke counts of a named employee all fit that description. The employer, as the business that decides why and how the data is processed, is the "Data Fiduciary" (s.2(i)). The employee is the "Data Principal" (s.2(j)).
Section 4(1) allows personal data to be processed for a lawful purpose only:
Section 7(i) is the clause employers care about. It allows processing:
"for the purposes of employment or those related to safeguarding the employer from loss or liability, such as prevention of corporate espionage, maintenance of confidentiality of trade secrets, intellectual property, classified information or provision of any service or benefit sought by a Data Principal who is an employee."
In plain English: once the Act is in force, you do not need an employee's consent to process their data for genuine employment purposes, such as attendance, timesheets, salary records, access control, IT security or protecting confidential client work.
Section 7(i) does not define "purposes of employment", and it is not written as a blanket permission to record everything an employee does. Law firm commentary reads it the same way. King Stubb & Kasiva note that section 7(i) "should not be treated as a blanket authorisation for unrestricted employee surveillance". They add that monitoring unrelated to a legitimate employment or security purpose may need a separate legal basis. The further a tool reaches beyond work (personal accounts, private messages, personal phones, off-hours activity), the harder it is to fit inside "purposes of employment".
If you rely on consent instead, section 6(1) sets a high bar. Consent must be "free, specific, informed, unconditional and unambiguous with a clear affirmative action", and limited to the data needed for the stated purpose. Employees can withdraw it at any time, as easily as they gave it (s.6(4)). Consent from someone who depends on you for their salary can be hard to show as "free". That is one reason most commentary expects employers to rely on section 7(i) for core HR data.
Section 5 requires a notice with every consent request, covering what data is collected and why, how to withdraw consent and exercise rights, and how to complain to the Data Protection Board. Rule 3 of the DPDP Rules adds that the notice must stand on its own, use clear and plain language, and give "an itemised description" of the personal data.
Strictly, section 5 is tied to consent requests, so the Act does not spell out a separate notice duty for data processed under section 7(i). Even so, a written monitoring policy that tells people what you track and why is the simplest way to show your monitoring is limited to employment purposes. All the guides we reviewed recommend such a policy.
Until 13 May 2027, two provisions of the Information Technology Act, 2000 and one set of rules do most of the work.
Section 43A (compensation for failure to protect data). A "body corporate" means a company, firm, sole proprietorship or other association doing commercial or professional work. If it handles "sensitive personal data or information" in a computer resource it owns, controls or operates, and is negligent in keeping reasonable security practices, it must pay damages to the person affected. The section sets no upper limit on the compensation.
The SPDI Rules, 2011 (G.S.R. 313(E), 11 April 2011) were made under section 43A. They matter to monitoring in four ways:
Section 72A (disclosure in breach of a lawful contract). This covers anyone, including a service provider, who gets access to personal information under a lawful contract and discloses it without consent or in breach of the contract, intending or knowing it is likely to cause wrongful loss or gain. They can face up to three years in prison, a fine of up to five lakh rupees, or both. This is a reason to choose monitoring vendors carefully and to keep access tight.
How the two regimes connect. Section 44(2) of the DPDP Act omits section 43A from the IT Act. That amendment is in the eighteen-month phase, so section 43A and the SPDI Rules made under it are expected to stop applying from 13 May 2027, when the DPDP duties take over. Where the DPDP Act conflicts with another law, section 38(2) says the DPDP Act prevails.
These DPDP duties apply from 13 May 2027.
Rule 8(3) requires a Data Fiduciary to keep personal data, traffic data and logs of its processing for at least one year from the date of processing, for the purposes listed in the Seventh Schedule (requests from authorized government officers). After that, it must erase them unless another law requires a longer period. Read with section 8(7), this means you keep such data for at least one year, but not indefinitely. Ask your lawyer how this applies to screenshots and activity logs in your setup.
One nuance: the access and correction rights in sections 11 and 12 are written for data the person "previously gave consent" for (including under s.7(a)). Whether they reach data processed under section 7(i) is not settled. The safer course is to answer employee requests about monitoring data anyway.
Penalties are civil and imposed by the Data Protection Board after an inquiry, under section 33 and the Schedule to the Act. The amounts are maximums ("may extend to"):
| Breach | Maximum penalty |
|---|---|
| Failing to take reasonable security safeguards (s.8(5)) | ₹250 crore |
| Failing to notify the Board or affected people of a breach (s.8(6)) | ₹200 crore |
| Breaking the additional rules for children's data (s.9) | ₹200 crore |
| Breaking the additional duties of a Significant Data Fiduciary (s.10) | ₹150 crore |
| Breaking the terms of a voluntary undertaking accepted by the Board (s.32) | Up to the penalty for the original breach |
| Any other breach of the Act or Rules | ₹50 crore |
| A Data Principal breaking their own duties (s.15) | ₹10,000 |
Section 33(2) tells the Board to weigh the nature, gravity and duration of the breach, the type of data, repetition, any gain made or loss avoided, mitigation, proportionality and the likely impact on the business. A small employer is unlikely to face the maximum. Still, the Schedule's highest penalty is for failing to take reasonable security safeguards, so collecting more data than you can protect is a real risk.
The penalty sections (ss.28 to 34) are in the eighteen-month phase, so they apply from 13 May 2027. Until then, the IT Act remedies above apply.
In Justice K.S. Puttaswamy (Retd.) v. Union of India, decided on 24 August 2017 and reported at (2017) 10 SCC 1, a nine-judge bench of the Supreme Court held that "the right to privacy is protected as an intrinsic part of the right to life and personal liberty under Article 21 and as a part of the freedoms guaranteed by Part III of the Constitution."
The case was about the State, so it does not directly bind a private employer. For employers, its lasting value is the test for any intrusion into privacy, set out in the plurality judgment written by Justice D.Y. Chandrachud: (i) legality, (ii) a legitimate aim, and (iii) proportionality, meaning a rational link between the aim and the means used. Ask the same three questions about your own monitoring: is it allowed, what is it for, and is it the lightest way to get there.
Trakkar is time tracking, attendance and invoicing software for Indian agencies and client-service teams, used by 100+ teams. It does not make your monitoring lawful by itself. That depends on why you monitor, how much you track and what you tell your team. Trakkar lets you start light and add tracking only if you need it:
You can run on attendance and timesheets alone by turning screenshots and app tracking off. If you keep them on, do it for a stated reason, only for the people it applies to, and only after you have shared your policy. Read more on employee monitoring software in India and what screenshot monitoring really costs in productivity.
Start a 14-day free trial, no card needed or book a 30-minute demo.
Other high-intent guides for Indian teams.
Yes, when it has a genuine work purpose, is proportionate and employees are told about it. No Indian law bans workplace monitoring. Today the IT Act, 2000 and the SPDI Rules, 2011 apply. From 13 May 2027, section 7(i) of the DPDP Act allows processing for employment purposes, along with duties on security, erasure and grievances.
Screenshots and app tracking run in the desktop app, and admins can turn each off for any person. 14-day free trial, no card needed.
