Employee Data Processing Notice

EMPLOYEE DATA PROCESSING NOTICE

Issued by: [Organization Name] ("the Company")
Applicable to: All employees, contractors, and interns
Effective Date: [Effective Date]

1. INTRODUCTION
This notice explains how the Company processes your personal data as your employer. Much of this processing relies on the "employment purposes" legitimate use recognised under Section 7 of the DPDP Act, 2023, rather than on consent, since obtaining consent for routine HR functions is often impractical or would affect service delivery. Where processing falls outside this ground (e.g., optional wellness programs), we will separately seek your consent under Section 6.

2. CATEGORIES OF DATA PROCESSED
   - Identity and contact data: name, date of birth, address, phone, personal email, government IDs (PAN/Aadhaar last 4 digits, as permitted), emergency contacts
   - Employment records: offer letter, contract, role, compensation, performance appraisals, disciplinary records, attendance, leave
   - Statutory data: PF/ESI/gratuity details, tax declarations
   - System data: corporate email logs, access-card swipe logs, device and network usage logs, CCTV footage in office premises
   - Health data: medical certificates for leave, insurance claims [and any biometric attendance data, if applicable]

3. PURPOSES OF PROCESSING
Payroll and statutory compliance; performance management; workplace safety and security; provisioning of IT systems and access control; internal investigations; issuance of experience/relieving letters; and legal compliance including responses to lawful government or regulatory requests (Section 7(b)).

4. BIOMETRIC / CCTV DATA
Where biometric attendance or CCTV monitoring is used, data is limited to the stated security/attendance purpose, is not used for unrelated profiling, and is retained only per the retention schedule in our Data Retention Policy.

5. SHARING OF EMPLOYEE DATA
Your data may be shared with: payroll processor [Name], insurance provider [Name], background-verification agency [Name], and statutory authorities, each under a written contract that binds them to security safeguards and purpose limitation consistent with Section 8.

6. YOUR RIGHTS
Subject to applicable exemptions for employment records under law, you may request access to your HR file (Section 11), correction of inaccurate records (Section 12), and may raise grievances with HR before escalating to the Data Protection Board of India (Section 13). You may also nominate an individual to exercise your rights in the event of death or incapacity (Section 14).

7. RETENTION
Personal data is retained for the duration of employment plus [X years] thereafter to meet statutory limitation periods, after which it is securely erased.

8. SECURITY SAFEGUARDS
Access to HR systems is role-based and logged; data at rest and in transit is encrypted; access logs are retained for at least the period prescribed under the DPDP Rules, 2025.

9. QUERIES
Contact HR Data Protection Point of Contact: [Name], [Email], or the Company's Data Protection Officer at [DPO Email] for any questions about this notice.

Acknowledged by employee: ______________________ Date: ______________