The DPDP Act 2023: What It Means for HR Software in India

Every HR system in India processes exactly the kind of information the Digital Personal Data Protection Act 2023 (DPDP Act) was written to protect: names, salaries, bank details, performance records, sometimes health information for leave claims. If your team is evaluating or already running HR software, the DPDP Act is not background legal reading, it directly shapes what that software is required to do with your employees' data.

Here is what the Act actually changes, in plain terms, and what to check in any HR platform you use or are considering.

The basic framework

• Data Principal is the individual the data is about, an employee or candidate in an HR context.
• Data Fiduciary is the organization deciding how that data is processed, your company, when it runs payroll or tracks attendance.
• Consent has to be specific and informed. Employees and candidates should know what is collected and why, not just agree to a generic blanket policy.
• Data Principal rights include access, correction, and erasure of personal data, along with a right to grievance redressal.

What the Act requires of any Data Fiduciary

• A named Grievance Officer with a dedicated contact channel for data-related complaints, separate from general support.
• Breach notification to affected individuals and, where required, the relevant authority, without undue delay.
• Purpose limitation. Personal data collected for one purpose, like payroll, should not be quietly repurposed for something unrelated.
• Reasonable security safeguards proportionate to the sensitivity of the data being processed.

The DPDP Act does not just ask "is the data secure." It asks whether the organization can show, on request, what it collects, why, and how an individual's rights over that data get exercised.

What to check in HR software specifically

HR platforms sit in an unusual position under the Act: they process sensitive data (salary, performance, sometimes health-related leave records) on behalf of every organization that uses them. Before choosing one, or auditing the one you have, check for:

• A published Grievance Officer contact, not just a general support email.
• Explicit, logged consent at signup and for any sensitive processing, such as AI-driven interview recording, with a timestamp and version, not an implied "by using this you agree."
• Clear disclosure of which third parties process employee data, including AI or analytics vendors, not a vague "trusted partners" line.
• A real process for an employee to request access to or correction of their own data.

How EnrollVerse approaches this

EnrollVerse is built and operated by an India-incorporated company, so DPDP Act compliance is not an afterthought. The Privacy Policy names a Grievance Officer with a dedicated contact and a defined response window, sets out Data Principal rights explicitly, and discloses the categories of service providers data may be shared with. Consent is logged with a timestamp at registration, and AI interview recording captures explicit, IP-logged consent rather than an implied opt-in. For how EnrollVerse treats AI-generated outputs and human oversight more broadly, see how to safely give AI agents autonomy over HR. Want to see the platform? Start your free 7-day trial.

This article explains general concepts of the DPDP Act 2023 for informational purposes and is not legal advice. Consult qualified counsel for guidance specific to your organization.