Employee consent for specific processing, with withdrawal
A single format from the Employee Personal Data under the DPDP Act pack. ss.5, 6, 7(i) and 8(7), DPDP Act 2023 · Rule 3, DPDP Rules 2025 · rule 5, SPDI Rules 2011.
- 7 pages
- 116
- Word and PDF
- 30 October 2026
- 30 October 2026
What it covers
- 1Employee consent for specific processing, with withdrawalss.5, 6, 7(i) and 8(7), DPDP Act 2023 · Rule 3, DPDP Rules 2025 · rule 5, SPDI Rules 2011
Not included
What you will still need outside this format:
- Data processing agreements with payroll, HR and verification vendors (Data processing agreement pack)
- The website and app privacy policy for customers and visitors
- A DPDP readiness assessment of the Company's systems and vendors
- Obligations of a Significant Data Fiduciary (Data Protection Officer, impact assessment, data audit) and Consent Manager registration
- Technical implementation of security safeguards, erasure and breach reporting to the Data Protection Board and CERT-In
- Advice on a particular grievance or a complaint before the Data Protection Board
Read the opening
The first part of the format, as it downloads. Blanks are highlighted.
When to ask for consent. Processing for the purposes of employment, including safeguarding the employer from loss or liability and providing a benefit the employee asks for, is a legitimate use under s.7(i) and needs no consent; do not ask for consent to processing the Company will carry on regardless, because a consent that cannot be refused is not free and its withdrawal would leave the Company with nothing to rely on. This form takes consent only for processing that goes beyond that, or where the person who holds the record (a university, a previous employer) needs the employee's authority to release it. Each consent is separate and optional, with nothing pre-selected (s.6(1): free, specific, informed, unconditional and unambiguous, by a clear affirmative action). Give the employee the privacy notice first, and offer this form in English or a language of the Eighth Schedule (s.6(3)). Until the SPDI Rules 2011 cease to apply, they require consent in writing before collecting biometric, health and financial data (rule 5(1)), which Sections 2 and 3 below provide for biometric and health data, and the acknowledgement to the privacy notice provides for bank details. Keep the signed form, with the version of the notice given, as the record of consent: the burden of proving consent is on the Company (s.6(10), from 13.05.2027).
[Name of the Company] · Employee consent form · Version [Version number of the consent form]
CONSENT FOR SPECIFIC PROCESSING OF PERSONAL DATA