Do we need consent for employee data?

Short answer: Not for employment purposes; yes for anything extra

Usually not for normal employment purposes. Section 7(i) lets you process employee data for employment, such as payroll, attendance, safety and preventing corporate espionage. Anything beyond that, such as wellness apps, photos for marketing or sharing with a bank for offers, needs consent.

What the law says

Section 7(i) covers employment purposes and safeguarding the employer from loss or liability. Notice, security, retention and rights still apply to employees.

Section 7: Some uses need no consent: data a person gave voluntarily for a specified purpose, duties under law, medical emergencies involving a threat to life, health services during an epidemic, safety during a disaster, and purposes of employment.
Section 5 · Rule 3: When you ask for consent, give a clear notice that stands on its own: what data, for what purpose, how to withdraw consent, how to use the rights and how to complain to the Data Protection Board. For data collected before the Act, a notice is due as soon as reasonably practicable.
Section 8(7) · Rule 8: Erase personal data when its purpose is over or consent is withdrawn, unless a law requires you to keep it, and have your processors erase it too. Rule 8(3) asks every Data Fiduciary to keep personal data, traffic data and logs for at least one year for purposes listed in the Rules.
Sections 11–14 · Rule 14: People can ask for a summary of their data and who it was shared with, ask for correction, completion, updating or erasure, complain, and nominate someone to act for them. You must publish how to do this.

Steps

List what you collect from staff and why.
Mark which items are employment purposes and which are extra.
Take consent for the extras, separately.
Give staff a short employee privacy notice.
Set retention for ex-employee records.

Evidence to keep

Employee data list with basis
Employee privacy notice
Consent for extras

Common mistakes

A blanket consent clause in the offer letter
Keeping candidate data forever
Sharing staff data with vendors without terms

How it plays out by sector

Banking, financial services and insurance: Background and credit checks on staff are employment purposes; explain them in the staff notice.
IT, ITeS, BPO and GCC: Large hiring volumes mean large records. Set retention by record type.
Central government: ministries and departments: Service records and APARs are employment data; access should be tight.
Public sector undertakings and utilities: Pension, medical and family records need tight access.
Healthcare and hospitals: Staff health and vaccination records are sensitive; keep them apart from HR files.
Manufacturing: Medical checks and health records for hazardous work are employment data with tight access needs.

From each seat

HR head: Write a one-page employee privacy notice and give it at joining. Keep consent separate for extras like wellness apps or photos.
HR department: Prepare the employee privacy notice and give it to every joiner.
Finance department: Salary and bank details are employment data; sharing them beyond employment needs care.

What a good answer from management sounds like

“Staff data is used for employment purposes only. Extras run on consent, and ex-employee records follow the retention schedule.” Effort and time: Light · 4 to 6 weeks.