HR and payroll software and personal data: how the DPDP Act applies
Reviewed by Confidential Dispatch Editorial Team · Updated 31 Oct 2026 · 10 min read
Your HR software holds more about your staff than any other system: ID copies, bank details, salaries, attendance, leave and appraisals. Under India’s DPDP Act, your business is the Data Fiduciary and the HR vendor is your Data Processor. You can process employee data for employment purposes without consent, but security, deletion and breach reporting still apply in full. Keka, greytHR, Zoho People and Darwinbox can all keep your data in India. The biggest gap is former employees’ data kept long after the law needs it.
Educational resource only. These are our findings from each company’s public documentation as of the “Last updated” date at the end of this page. Vendors change their products and terms, so check the current version before you rely on it. We don’t assess or certify any company’s compliance. This explains how India’s Digital Personal Data Protection Act, 2023 (DPDP Act) applies to your use of these tools; it is not formal legal advice.
The situation
A new hire uploads their PAN card, Aadhaar, bank details and a cancelled cheque on day one. Over the years their file fills with salary revisions, leave records, a medical certificate, appraisal notes and finally their exit papers. They leave, and the file stays. With the DPDP Act’s full obligations applying from 13 May 2027, your HR software is where you hold the most detailed records about every current and past employee, and where those records tend to stay longest.
Is any HR software “DPDP-compliant”?
No HR software makes you compliant: the DPDP Act puts the duties on your business as the employer
You decide why employee data is collected and how it’s used, which makes you the Data Fiduciary. The HR vendor stores and processes that data on your instructions, which makes it your Data Processor. The Act requires a valid contract with any processor you use (Section 8), and you stay answerable for the data either way.
The Act also gives employers a specific allowance: you can process employee data for the purposes of employment without asking for consent (Section 7(i)). That covers running payroll, attendance and appraisals. It doesn’t remove your duties to keep the data secure, delete it on time and report breaches, and it doesn’t clearly cover job applicants who never join.
What personal data flows through HR and payroll software?
Almost everything an employee shares with your business ends up here
A typical HR system holds:
- Identity documents: Aadhaar, PAN, passport or driving licence copies uploaded at joining.
- Bank and salary details: account numbers, salary structures, payslips, reimbursements and tax declarations.
- Statutory numbers: PAN for tax, and provident fund (PF) and Employees’ State Insurance (ESI) details.
- Attendance and leave: daily attendance, which may come from fingerprint or face scans, and leave records that can include medical certificates.
- Family details: spouses, children and parents named as dependants for insurance or as emergency contacts. These are other people’s personal data, given to you by your employee.
- Performance and exit records: appraisals, warnings, resignation letters and full-and-final settlements.
- Applicants: CVs and interview notes from candidates, if you run hiring in the same system.
What DPDP duties does your HR software create?
The employment allowance covers why you process the data; it doesn’t cover how you protect it or how long you keep it
- Collect only what the job needs. Ask for documents that a law or the role actually requires, and don’t collect a second ID proof where one does the job. An employee document checklist helps keep joining forms lean.
- Purpose limits. Data collected for payroll is for payroll. Using staff phone numbers or photos for marketing, or sharing salary details beyond those who need them, goes beyond employment purposes.
- Deletion on time. Tax, labour and company laws require you to keep some employee records for set periods after someone leaves. Keep what those laws require, and delete the rest, starting with ID copies and applicant files, once the purpose is over (Section 8).
- Security. Who in HR and finance can see salaries and ID documents, whether managers can see their whole team’s personal details, and whether access ends when someone changes role are all part of protecting the data.
- Rights requests. Employees and former employees can ask what you hold about them, ask you to correct it, or ask you to delete it. You can refuse to delete what the law requires you to keep, and should say which law.
- Breaches. A payroll file emailed to the wrong person, or a leaked spreadsheet of salaries, is a personal data breach. You must inform the Data Protection Board of India and the affected people.
Where does each one store your data?
Keka, greytHR, Zoho People and Darwinbox can all keep your data in India
The DPDP Act doesn’t require Indian data to stay in India: it allows transfers abroad except to countries the government restricts (Section 16), though some sector regulators set their own rules. You should still know where your staff’s data is, because it decides which country’s servers hold it.
| HR software | India data centre? | How the region is set |
|---|---|---|
| Keka | Yes, among the regions it offers | By the data centre region selected for your account |
| greytHR | Yes (greytHR says data is stored in Indian data centres) | Stated by greytHR |
| Zoho People | Yes (Mumbai, with Chennai as backup) | By your location at sign-up |
| Darwinbox | Yes (its hosting regions include AWS Mumbai and Microsoft Azure Central India) | Set for each customer; ask Darwinbox which region your account uses |
Keka
Keka stores your data in the data centre region selected for your account, and India is one of them
Its privacy policy says Keka stores and processes personal data in the region selected for each customer, from a list that includes India, Europe, the US, Southeast Asia and the UAE, and that no customer data is stored at its headquarters. It runs on Microsoft Azure and Amazon Web Services. The same policy says Keka acts as a Data Processor for the employee data it handles on your behalf, and that employees’ requests about that data should go to you, the employer, first. It refers to the DPDP Act and lists the rights it gives.
On leaving Keka, you get up to 30 days of access to export your data, after which an automated, irreversible deletion begins. Keka keeps backups for at least 90 days, so a deleted record can still exist in a backup for that long. Its security page describes 35 days of point-in-time restoration.
greytHR
greytHR says it stores data in Indian data centres, and offers an encrypted vault for employee personal data
Its comparison page, updated September 2026, states this and describes PIVault, an encrypted vault for employee personal data with role-based access controls and full audit trails. Its security page says the platform runs on Amazon Web Services and Google Cloud, encrypts data at rest with AES-256, uses role-based access and supports single sign-on and multi-factor authentication. It lists SOC 2 and ISO 27001 among the standards it maintains or aligns to, and says it honours data rights including access, correction and deletion. greytHR’s AI features are described as running within its cloud “in the customer’s applicable region”, and its AI page lists the DPDP Act among the frameworks it aligns with.
Zoho People
Zoho stores Indian accounts in India, and lets you set how long deleted employee records can be restored
Zoho assigns each account to a data centre based on your location at sign-up. India’s are in Mumbai (primary) and Chennai (secondary), and an India-region account logs in at a zoho.in address.
When you delete an employee record in Zoho People, the employee’s login is disabled too. Deleted records sit in a recycle bin for a retention period you choose in months, from the organisation policy settings, and can be restored only within that period. Keep it short if your aim is to erase records that no law requires you to keep.
Darwinbox
Darwinbox describes itself as your Data Processor under the DPDP Act, and its hosting regions include India
Its privacy policy says Darwinbox processes employee data only on its customers’ instructions, that it is a Data Processor under the DPDP Act, and that the employer is the Data Fiduciary. Employees who want to exercise their rights are directed to their employer. The policy says the customer defines how long its data is kept, and that personal data of people in India is transferred abroad only as Section 16 of the Act allows, with hosting regions pinned per customer as needed.
Darwinbox’s list of sub-processors names its cloud providers and their regions: Amazon Web Services in Mumbai, Singapore, North Virginia, Frankfurt, Jakarta and the UAE, and Microsoft in Central India, Singapore, Frankfurt, the UAE and East US. Because the region is set per customer, ask Darwinbox to confirm in writing that your account is hosted in India.
How to set up any HR software for the DPDP Act
The steps are the same whichever software you use; only the setting names change
- Find out where your data is storedUse the table above, then confirm for your own account.
- Trim your joining checklistRemove documents and fields that no law or role requires.
- Restrict sensitive fieldsLimit who can see ID documents, bank details, salaries and medical certificates, and review those permissions when people change roles.
- Turn on multi-factor sign-inRequire it for everyone with access to HR or payroll data, and close accounts promptly when staff leave.
- Set a schedule for former employeesList which records the law requires you to keep after someone leaves, and for how long, then delete the rest on schedule. As the DPDP Act’s 13 May 2027 deadline approaches, you can expect most large Indian platforms, and those that operate in India, to launch features in line with the Act. Keep an eye on your HR software’s privacy settings, release notes and announcements to see what has changed.
- Clear out applicantsDelete CVs and interview notes of candidates who didn’t join, unless they’ve agreed to be kept for future openings.
- Know what “deleted” meansCheck your software’s recycle bin and backup periods, so you know when a deleted record is really gone.
FAQ
Is Keka, greytHR, Zoho People or Darwinbox DPDP-compliant?
None of them is “compliant” or “non-compliant” on its own. The DPDP Act’s duties fall on your business as the employer and Data Fiduciary. What the software changes is where your data is stored and how much help it gives you with access controls and deletion.
Do I need my employees’ consent to process their data?
Not for employment purposes. The DPDP Act lets employers process employee data for employment without consent. Using it for anything beyond employment, such as marketing, needs its own basis.
How long can I keep a former employee’s data?
As long as a law requires you to keep it, and no longer. Tax, labour and company laws set periods for different records. Once those periods end and no other purpose applies, delete the data.
Can a former employee ask me to delete their data?
Yes, they can ask. Delete what no law requires you to keep, and tell them what you’re keeping and under which law.
Do I need a contract with my HR software vendor?
Yes. The Act requires a valid contract with any Data Processor that handles personal data for you. Check that your agreement covers processing on your behalf, and keep a copy with your compliance records.
Will my HR software add DPDP features?
As the DPDP Act’s 13 May 2027 deadline approaches, you can expect most large Indian platforms, and those that operate in India, to launch features in line with the Act. Keep an eye on your HR software’s privacy settings, release notes and announcements to see what has changed.
Every article is checked against the current law and the judgments it cites before it is published.
Updated 31 October 2026 · Not legal advice.
