Privacy notice to employees and candidates
A single format from the Employee Personal Data under the DPDP Act pack. ss.5 to 9, 11 to 16, DPDP Act 2023 · Rules 3, 6 to 9, 14 and 15, DPDP Rules 2025 · rules 4 to 8, SPDI Rules 2011.
- 11 pages
- 54
- Word and PDF
- 30 October 2026
- 30 October 2026
What it covers
- 1Privacy notice to employees and candidatesss.5 to 9, 11 to 16, DPDP Act 2023 · Rules 3, 6 to 9, 14 and 15, DPDP Rules 2025 · rules 4 to 8, SPDI Rules 2011
Not included
What you will still need outside this format:
- Data processing agreements with payroll, HR and verification vendors (Data processing agreement pack)
- The website and app privacy policy for customers and visitors
- A DPDP readiness assessment of the Company's systems and vendors
- Obligations of a Significant Data Fiduciary (Data Protection Officer, impact assessment, data audit) and Consent Manager registration
- Technical implementation of security safeguards, erasure and breach reporting to the Data Protection Board and CERT-In
- Advice on a particular grievance or a complaint before the Data Protection Board
Read the opening
The first part of the format, as it downloads. Blanks are highlighted.
Status of the law on 30.10.2026. The Digital Personal Data Protection Rules 2025 were notified on 13.11.2025 with phased commencement. In force now: the definitions in s.2 and the Data Protection Board provisions (ss.18 to 26) of the Act, and Rules 1, 2 and 17 to 21. From 13.11.2026: s.6(9) and Rule 4 (Consent Managers). From 13.05.2027: the obligations of Data Fiduciaries and the rights of Data Principals (ss.3 to 5, 6(1) to (8) and (10), 7 to 17), the penalty provisions, and Rules 3, 5 to 16, 22 and 23. In January 2026 MeitY consulted on shortening the eighteen-month period; no amendment had been published as at the date stated, but check the Gazette before you issue. Until s.43A of the IT Act 2000 ceases to apply, the SPDI Rules 2011 continue to govern sensitive personal data (bank and payment details, health and medical records, biometric information, passwords): a privacy policy (rule 4), consent in writing before collection (rule 5(1)), a grievance officer who redresses grievances within one month (rule 5(9)), disclosure only with consent or as the law requires (rule 6), transfer only to a recipient ensuring the same level of protection (rule 7), and reasonable security practices (rule 8). This notice is drafted to meet both regimes: issue it now, and re-issue it to existing employees before 13.05.2027, because s.5(2) requires notice to be given for consents taken before commencement as soon as reasonably practicable.
Most employee data is processed under the legitimate use for employment in s.7(i), for which the Act does not require a notice. The notice is still given because the SPDI Rules require a privacy policy now, because Rule 3 prescribes its content wherever consent is sought (paragraph 5 and the consent form), and because a Data Principal cannot exercise rights she does not know of. Keep it standalone and in plain language (Rule 3(a) and (b)). Publish it on the intranet or HR portal and, for candidates, on the careers page with the short notice in Annexure A.