HR Heads & CHROs
Liability Check
HR departments are DPDP's blind spot. Employee data — payroll, medical, performance reviews — is personal data requiring formal consent and safeguards.
Why HR Heads & CHROs is at Risk
Most HR departments still operate as if employee data is 'company property'. Under DPDP 2023, it's not. Every employee is a Data Principal. Their salary slips, medical insurance claims, performance appraisals, and even exit interview notes are personal data. You need consent, security safeguards, and a clear retention policy.
Common Violations
- 1.Sharing employee medical data with insurance brokers without specific consent.
- 2.HR managers accessing performance data of employees outside their reporting line.
- 3.Retaining ex-employee data (resumes, ID proofs) indefinitely after separation.
The Immediate Fix
Update **Employee Privacy Notices** and contracts to include DPDP clauses. Implement RBAC in your HRMS — restrict access by role. Set a 2-year retention limit for ex-employee data (unless legally required longer).
Get DPDP Updates for HR Heads & CHROs
We'll send you compliance alerts and deadline reminders specific to your area. No spam — unsubscribe anytime.
Need help checking your business?
- Start with the free self-check to find questions for your team.
- Our paid gap assessment takes four weeks. We check your apps, documents and records, then list what needs fixing.
- Fixing the agreed gaps takes two to three months. A final assessment checks the completed work.
Save your results and discuss the questions with your team.
Next step after the audit
The audit shows the gaps. Sanctum closes them. One programme covers legal position, data map, gap analysis, implementation, tooling, training, a written readiness opinion, and breach cover, under one accountable owner. See the all-in-one programme
What Should You Do Next?