Fill online: Employee Personal Data under the DPDP Act

Try the first few blanks free and watch the documents fill in on the right. Pay, and the whole document opens here to finish and download in Word and PDF.

0 of 454 blanks filled

Leave a blank empty and it stays highlighted in your document, to fill by hand. Your answers are saved in this browser only.

Try the first 5 blanks free. After payment the whole document opens here: every blank, and clean Word and PDF downloads.

Privacy notice to employees and candidates

Name of the Company

Fills 3 places in the document.

CIN of the Company

Registered office address of the Company

Version number of the notice

Fills 2 places in the document.

Effective date of the notice

Languages in which the notice is available, from the Eighth Schedule to the Constitution

HR e-mail address for privacy matters

Alternative attendance method, e.g. access card and PIN

Link or HR portal path for withdrawal of consent

Seven

Names of the payroll and HR software providers

Names of the cloud and IT service providers

Name of the background verification agency

Name of the group insurer

Name of the TPA

Name of the insurance broker

Name of the salary bank

Names of the group companies receiving employee data

Data Processor / separate Data Fiduciary

Is not / is

Countries where data is stored or accessed, and the recipients

No country / the following countries

Countries notified under s.16, if any

Six (1)

Eight (1)

Eight (2)

Three (1)

Eight (3)

30 days / 90 days / one year

HR portal or form for updating personal details

HR portal path or link for data rights requests

Name or designation of the grievance officer

E-mail address of the grievance officer

Three (2)

Thirty

Name of the grievance officer

Designation of the grievance officer

Postal address of the grievance officer

Telephone number of the grievance officer

Name and contact details of the Data Protection Officer

Web address of the Data Protection Board's complaint portal

E-mail and the HR portal

Fifteen

English / Hindi / Other language

Name of the employee or candidate

Employee code or application reference

Date of acknowledgement

Title of the vacancy or "any vacancy you apply for"

Six (2)

Twelve

I consent / I do not consent

Link to the candidate privacy page

Link to the full privacy notice

Employee consent for specific processing, with withdrawal

Name of the Company

Version number of the consent form

Name of the employee (1)

Employee code (1)

Designation and department of the employee

Version number of the privacy notice

Date the privacy notice was received

English / Hindi / Other language

Link or HR portal path for withdrawal of consent

Name or designation of the grievance officer

E-mail address of the grievance officer

Name of the background verification agency

I authorise / I do not authorise

Designation for which the criminal record check is required

Reason the role needs a criminal record check, e.g. custody of cash or client funds, access to children, privileged systems access

Designation of the persons who see the result

One

I consent / I do not consent

Designation for which the credit check is required

Reason the role needs a credit check, e.g. authority to sign cheques or approve payments

Fingerprint / face

Locations of the biometric attendance devices

The device only / the Company's attendance server / the provider's server

Areas to which biometric access applies

Alternative attendance method, e.g. access card and PIN

Name of the insurance broker

Name of the group insurer

Name of the TPA

Name of the clinic or wellness provider

Designation authorised to approve a content review

Name of the IT acceptable use policy

Name of the mobile device management software

Alternative to a personal device, e.g. a Company device or webmail access only

Name of the field force application

Alternative method of recording visits, e.g. a visit report signed by the client

Name of the productivity analytics tool

Does / does not

Telephone lines or systems on which calls are recorded

The Company's website, social media pages, brochures, recruitment advertisements, client proposals and press releases

Fifteen

Twelve

Language in which the form was explained

Name of the employee (2)

Date of the consent

Name and designation of the HR officer

Date the consent was received

Employee code (2)

Withdrawn / Not withdrawn (1)

Withdrawn / Not withdrawn (2)

Withdrawn / Not withdrawn (3)

Withdrawn / Not withdrawn (4)

Withdrawn / Not withdrawn (5)

Withdrawn / Not withdrawn (6)

Withdrawn / Not withdrawn (7)

Withdrawn / Not withdrawn (8)

Withdrawn / Not withdrawn (9)

Withdrawn / Not withdrawn (10)

Withdrawn / Not withdrawn (11)

Withdrawn / Not withdrawn (12)

Reason, if the employee wishes to give one

Date of the withdrawal

Withdrawal received and acknowledged to the: Done on

Withdrawal received and acknowledged to the: By

Processing stopped in Company systems: Done on

Processing stopped in Company systems: By

Data Processors instructed to stop and to: Done on

Data Processors instructed to stop and to: By

Data erased, or retained only where a law: Done on

Data erased, or retained only where a law: By

Alternative arrangement put in place, where: Done on

Alternative arrangement put in place, where: By

Written confirmation sent to the employee: Done on

Written confirmation sent to the employee: By

Seven

Employee code, row 1

Section, row 1

Given / Refused (1)

Date, row 1

Version of the notice, row 1

Withdrawn on, row 1

Action completed on, row 1

Processors informed on, row 1

Employee code, row 2

Section, row 2

Given / Refused (2)

Date, row 2

Version of the notice, row 2

Withdrawn on, row 2

Action completed on, row 2

Processors informed on, row 2

Employee code, row 3

Section, row 3

Given / Refused (3)

Date, row 3

Version of the notice, row 3

Withdrawn on, row 3

Action completed on, row 3

Processors informed on, row 3

Employee code, row 4

Section, row 4

Given / Refused (4)

Date, row 4

Version of the notice, row 4

Withdrawn on, row 4

Action completed on, row 4

Processors informed on, row 4

Employee code, row 5

Section, row 5

Given / Refused (5)

Date, row 5

Version of the notice, row 5

Withdrawn on, row 5

Action completed on, row 5

Processors informed on, row 5

Employee data rights request: form, response letters and request log

Name of the Company

E-mail address of the grievance officer

HR portal path or link for data rights requests

Name of the requester (1)

Current employee / Former employee / Candidate / Nominee of an employee / Other

Employee code or application reference of the requester

Registered e-mail address of the requester

Mobile number of the requester

Address of the requester for correspondence

Name of the employee for whom the nominee acts

Employee code of the employee for whom the nominee acts

Death of the employee / Incapacity of the employee

Death certificate / Medical certificate of incapacity / Other proof

Date of registration of the nomination

Yes / No (1)

Particular records or period, if any

Yes / No (2)

Data to be corrected, and the correct data

Yes / No (3)

Data to be completed or updated

Yes / No (4)

Data to be erased

Yes / No (5)

Consent to be withdrawn

Yes / No (6)

Name, relationship and contact of the nominee

Yes / No (7)

Describe the grievance

Documents enclosed in support, e.g. copy of the corrected certificate

Date of the request

Date of the acknowledgement

Reference number of the request

Name of the requester (2)

Date of receipt of the request

Types of request received

Date by which identification is to be sent

Date by which the reply is due

Name of the grievance officer

Designation of the grievance officer

Telephone number of the grievance officer

Date of the access reply

Identity and contact: Source

Identity and contact: Purposes

Identity and contact: Shared with

Identity and contact: Kept until

Government identifiers (PAN, UAN, ESIC: Source

Government identifiers (PAN, UAN, ESIC: Purposes

Government identifiers (PAN, UAN, ESIC: Shared with

Government identifiers (PAN, UAN, ESIC: Kept until

Employment and personnel file: Source

Employment and personnel file: Purposes

Employment and personnel file: Shared with

Employment and personnel file: Kept until

Pay, tax and benefits: Source

Pay, tax and benefits: Purposes

Pay, tax and benefits: Shared with

Pay, tax and benefits: Kept until

Attendance and leave: Source

Attendance and leave: Purposes

Attendance and leave: Shared with

Attendance and leave: Kept until

Performance and development: Source

Performance and development: Purposes

Performance and development: Shared with

Performance and development: Kept until

Data processed on your consent: Source

Data processed on your consent: Purposes

Date of the consent form

Data processed on your consent: Shared with

Data processed on your consent: Kept until

Other: Source

Other: Purposes

Other: Basis

Other: Shared with

Other: Kept until

Name of the payroll provider

Description of data shared with the payroll provider

Name of the group insurer

Description of data shared with the insurer

Other recipient

Data Fiduciary / Data Processor

Description of data shared with the other recipient

List of documents enclosed, or none

Information withheld, if any, with the reason, e.g. names of witnesses in an investigation

Date of the correction reply

Data, row 1

As it was, row 1

As it now is, row 1

Systems and records updated, row 1

Processors informed on, row 1

Data, row 2

As it was, row 2

As it now is, row 2

Systems and records updated, row 2

Processors informed on, row 2

Data, row 3

As it was, row 3

As it now is, row 3

Systems and records updated, row 3

Processors informed on, row 3

Data not changed, with the reasons, or none

Persons informed of the correction

Date of the erasure reply

Data erased, with the systems concerned

Backup cycle in days

Yes / No (8)

Date until which the wage registers are kept

Yes / No (9)

Yes / No (10)

Yes / No (11)

Yes / No (12)

Date until which the books are kept

Yes / No (13)

Date until which the tax records are kept

Yes / No (14)

Date until which the social security records are kept

Yes / No (15)

Matter concerned

Yes / No (16)

Date of the reply declining the request

Part of the request declined

Date of the letter seeking identification

Yes / No (17)

We have not been able to identify you: Explanation

Steps taken as a matter of policy

Yes / No (18)

The data is processed for the purposes of: Explanation

Yes / No (19)

Law and period concerned

Yes / No (20)

The data is needed for the specified purpose: Explanation

Yes / No (21)

The data is needed to establish, exercise or: Explanation

Yes / No (22)

The data is processed in the investigation: Explanation

Yes / No (23)

Disclosure would reveal the personal data of: Explanation

Yes / No (24)

The material is legal advice that is: Explanation

Date of the earlier reply

Yes / No (25)

The request repeats a request answered on: Explanation

The rest of your request is answered separately / No part of your request could be met

Designation of the reviewer of declined requests

Ref., row 1

Received on, row 1

Requester and code, row 1

Type (A to G), row 1

Identity verified on, row 1

Reply due (30 days from receipt), row 1

Replied on, row 1

Met / Partly met / Declined (1)

None / Grievance / Board (1)

Handled by, row 1

Ref., row 2

Received on, row 2

Requester and code, row 2

Type (A to G), row 2

Identity verified on, row 2

Reply due (30 days from receipt), row 2

Replied on, row 2

Met / Partly met / Declined (2)

None / Grievance / Board (2)

Handled by, row 2

Ref., row 3

Received on, row 3

Requester and code, row 3

Type (A to G), row 3

Identity verified on, row 3

Reply due (30 days from receipt), row 3

Replied on, row 3

Met / Partly met / Declined (3)

None / Grievance / Board (3)

Handled by, row 3

Ref., row 4

Received on, row 4

Requester and code, row 4

Type (A to G), row 4

Identity verified on, row 4

Reply due (30 days from receipt), row 4

Replied on, row 4

Met / Partly met / Declined (4)

None / Grievance / Board (4)

Handled by, row 4

Ref., row 5

Received on, row 5

Requester and code, row 5

Type (A to G), row 5

Identity verified on, row 5

Reply due (30 days from receipt), row 5

Replied on, row 5

Met / Partly met / Declined (5)

None / Grievance / Board (5)

Handled by, row 5

Ref., row 6

Received on, row 6

Requester and code, row 6

Type (A to G), row 6

Identity verified on, row 6

Reply due (30 days from receipt), row 6

Replied on, row 6

Met / Partly met / Declined (6)

None / Grievance / Board (6)

Handled by, row 6

Three (1)

Seven

Designation to whom overdue requests are escalated

Three (2)

Employee personal data retention and erasure schedule

Name of the Company

Version number of the schedule

Approving authority for the schedule

Date of approval of the schedule

Designation who may issue a legal hold

Six

Twelve (1)

One (1)

Eight (1)

Three (1)

Three (2)

Three (3)

Three (4)

30 (1)

Three (5)

Eight (2)

Eight (3)

Period prescribed for the process

Three (6)

One (2)

Twelve (2)

Three (7)

Eight (4)

Three (8)

Eight (5)

Eight (6)

Eight (7)

30 days / 90 days / one year

90 (1)

One (3)

One (4)

90 (2)

30 / 90

One (5)

Five

Three (9)

Backup cycle in days

30 (2)

Date, row 1

Row of the schedule, row 1

Records or batch, row 1

Employee codes or period covered, row 1

Method, row 1

Done by, row 1

Verified by, row 1

Certificate or log reference, row 1

Date, row 2

Row of the schedule, row 2

Records or batch, row 2

Employee codes or period covered, row 2

Method, row 2

Done by, row 2

Verified by, row 2

Certificate or log reference, row 2

Date, row 3

Row of the schedule, row 3

Records or batch, row 3

Employee codes or period covered, row 3

Method, row 3

Done by, row 3

Verified by, row 3

Certificate or log reference, row 3

Date, row 4

Row of the schedule, row 4

Records or batch, row 4

Employee codes or period covered, row 4

Method, row 4

Done by, row 4

Verified by, row 4

Certificate or log reference, row 4

Month of the annual review

Date by which owners confirm the annual erasure run

Name and designation of the person preparing the schedule

Date of preparation of the schedule

Name and designation of the reviewer of the schedule

Date of review of the schedule

Status of the law on 30.10.2026. The Digital Personal Data Protection Rules 2025 were notified on 13.11.2025 with phased commencement. In force now: the definitions in s.2 and the Data Protection Board provisions (ss.18 to 26) of the Act, and Rules 1, 2 and 17 to 21. From 13.11.2026: s.6(9) and Rule 4 (Consent Managers). From 13.05.2027: the obligations of Data Fiduciaries and the rights of Data Principals (ss.3 to 5, 6(1) to (8) and (10), 7 to 17), the penalty provisions, and Rules 3, 5 to 16, 22 and 23. In January 2026 MeitY consulted on shortening the eighteen-month period; no amendment had been published as at the date stated, but check the Gazette before you issue. Until s.43A of the IT Act 2000 ceases to apply, the SPDI Rules 2011 continue to govern sensitive personal data (bank and payment details, health and medical records, biometric information, passwords): a privacy policy (rule 4), consent in writing before collection (rule 5(1)), a grievance officer who redresses grievances within one month (rule 5(9)), disclosure only with consent or as the law requires (rule 6), transfer only to a recipient ensuring the same level of protection (rule 7), and reasonable security practices (rule 8). This notice is drafted to meet both regimes: issue it now, and re-issue it to existing employees before 13.05.2027, because s.5(2) requires notice to be given for consents taken before commencement as soon as reasonably practicable.

Most employee data is processed under the legitimate use for employment in s.7(i), for which the Act does not require a notice. The notice is still given because the SPDI Rules require a privacy policy now, because Rule 3 prescribes its content wherever consent is sought (paragraph 5 and the consent form), and because a Data Principal cannot exercise rights she does not know of. Keep it standalone and in plain language (Rule 3(a) and (b)). Publish it on the intranet or HR portal and, for candidates, on the careers page with the short notice in Annexure A.

[Name of the Company] · [CIN of the Company] · Registered office: [Registered office address of the Company]

PRIVACY NOTICE TO EMPLOYEES AND CANDIDATES

Version [Version number of the notice] · Effective from [Effective date of the notice]

The rest of this format (40 more paragraphs and tables) opens here after payment, to fill in the same way.

₹649 + GST, for the finished 4 documents, Word and PDF

The short sample is the opening of the document with your details, marked SAMPLE.

A drafted format for your use. It is not legal advice; for a complex matter, consult a professional. About this format