Is an identified legal basis required in order to collect or process personal data or sensitive personal data in the employment context?
Last review date: 20 December 2024
Yes
The DPDP Act permits the processing of personal data for certain "legitimate uses" without obtaining the consent of the data principals. The specified legitimate uses include processing for purposes related to employment or for safeguarding the employer from loss or liability such as prevention of corporate espionage, maintenance of confidentiality, intellectual property, classified information, or provision of any service or benefit sought by a data principal who is an employee. Therefore, so long as the processing is "necessary" for purposes of legitimate use, an employer may process personal data without obtaining the employee consent.