You are a Data Fiduciary for your own staff and candidates, and usually a Data Processor for the client data your teams work on. Data of people outside India, handled under a contract with a foreign client, is mostly outside the Act, but security and responsibility for sub-contractors still apply.
The first four things to sort out
Limit payroll access.
Retention for tax records.
Payroll vendor terms.
Secure file transfer.
A worked example: Reimbursement claims with medical bills
Day 1Finance notices medical bills in a shared folder.
Week 1Access is limited.
Week 2Retention set.
AfterClaims move to the expense tool.
Evidence kept: Access change.
Medical bills are sensitive data.
What others in the sector usually do. Payroll files move through portals, not email.
Short answer: For the legal or business period, then erase
Keep data for as long as its purpose needs, or as long as a law requires, and then erase it. Every organisation must keep personal data and logs for at least one year under Rule 8(3). Write a retention schedule by record type, with the law or reason against each period.
From your seat: Finance department. Tax and audit rules require keeping some records for years. List them so they are kept, and the rest is deleted.
In IT and ITeS
Candidates, employees, alumni, and client data at project end.
What the law says
Section 8(7) asks for erasure when the purpose is over, unless a law requires retention. Rule 8(3) sets a one-year minimum for personal data, traffic data and logs. Section 8(7) · Rule 8 · Section 8(5) · Rule 6
Steps
List the record types you hold.
Write the period for each, with the law, regulator rule or business reason.
Set a trigger for the period to start: end of relationship, date of transaction, exit date.
Automate deletion where you can; for paper, schedule shredding.
Keep a deletion log.
Evidence to keep
Retention schedule approved by Legal
Deletion log
Shredding or disposal certificates
Common mistakes
'Keep everything forever' because storage is cheap
Short answer: Yes, every vendor that touches personal data
You stay responsible for what your vendors do with personal data. The contract should say what data they get, for what purpose, the security they must keep, how fast they must tell you about an incident, that sub-contractors need your approval, and how data is returned or deleted at the end.
From your seat: Finance department. Payroll, payment and collection vendors hold sensitive data. Check their contracts.
In IT and ITeS
Sub-contractors working on client data need the same terms you signed with the client.
Short answer: Only those who need it, reviewed every quarter
Only people who need it for their job, and only the part they need. Use named accounts, give access by role, review it every quarter and remove it on the day someone leaves. Watch privileged accounts closely.
From your seat: Finance department. Limit who can see bank details and salary data, and log access.
In IT and ITeS
Your own HRMS and payroll, as well as client systems.
What the law says
Rule 6 names access control as a minimum safeguard, along with logs and monitoring that can detect misuse. Section 8(5) · Rule 6
Steps
Write a role matrix for each key system.
Replace shared logins with named accounts.
Use multi-factor sign-in for admin and remote access.
Short answer: Not for employment purposes; yes for anything extra
Usually not for normal employment purposes. Section 7(i) lets you process employee data for employment, such as payroll, attendance, safety and preventing corporate espionage. Anything beyond that, such as wellness apps, photos for marketing or sharing with a bank for offers, needs consent.
From your seat: Finance department. Salary and bank details are employment data; sharing them beyond employment needs care.
In IT and ITeS
Large hiring volumes mean large records. Set retention by record type.
Short answer: Six hours for CERT-In; without delay for people and the Board; 72 hours for the detailed report
Contain it, then tell people. A reportable cyber incident goes to CERT-In within six hours of being noticed. Under DPDP, each affected person and the Data Protection Board must be told without delay, and the Board needs a detailed report within 72 hours. Sector regulators may have their own clock too.
From your seat: Finance department. A misdirected salary file or payment list is a breach. Report it to the DPO at once.
In IT and ITeS
If client data is involved, the client contract sets your first deadline, often a few hours.
What the law says
Section 8(6) and Rule 7 set the DPDP steps. The CERT-In Directions of 28 April 2022 set the six-hour report. A breach includes accidental disclosure and loss of access, not only hacking. Section 8(6) · Rule 7 · Section 8(5) · Rule 6
Steps
Name one incident lead and a back-up, with phone numbers that work at night.
Write the first-hour steps: isolate, preserve logs, tell the DPO and the incident lead.
Keep ready-made drafts for CERT-In, the regulator, the Board and affected people.
Decide in advance who signs off each message.
Rehearse once a year with the people who would actually be called.
Evidence to keep
Incident plan with clocks
Rehearsal record
Incident log with times of each step
Common mistakes
Waiting to finish the investigation before telling anyone
Treating a wrong email or a lost laptop as 'not a breach'
Short answer: Yes, unless a sector rule says otherwise
Under DPDP, yes, unless the government restricts a country, and none had been restricted when this page was last reviewed. A sector rule can be stricter, for example RBI's rule that payment system data must be stored only in India. Remote support access from abroad also counts as data going outside India.
From your seat: Finance department. Check where finance and payroll SaaS is hosted.
In IT and ITeS
Global HR and collaboration tools are often hosted abroad. Clients may restrict where their data goes.
What the law says
Section 16 allows transfers unless restricted, and keeps stricter sector laws in force. Rule 15 adds conditions on making data available to foreign states. Section 16 · Rule 15 · Section 8(1)–(2)
Steps
List where each system is hosted and where support teams log in from.
Check sector rules for localisation.
Put location and access terms in cloud and vendor contracts.
Keep the list current; new SaaS tools change it quietly.
Section 8(1)–(2): Responsibility for vendors. You are usually the processor for client data and a fiduciary for your own staff. Your sub-contractors are your processors.
Section 8(5) · Rule 6: Security safeguards. Remote access to client systems, laptops and ticketing tools need control, monitoring and one-year logs.
Other rules that sit alongside DPDP
Rule
What it says
What it means alongside DPDP
Source
CERT-In Directions, 28 April 2022
Report specified cyber incidents within six hours. Keep ICT logs for 180 days within India. Sync clocks to NIC or NPL time servers. Data centres, VPS, cloud and VPN providers keep specified subscriber information for five years.
Breach handling must meet the six-hour CERT-In clock and the DPDP report to the Board. Subscriber records need DPDP-level protection.
