---
title: "Can Employers Monitor Employee Devices, Emails and Communications Under India’s DPDP Act?"
date: 2026-09-09
author: "Aniket Ghosh"
url: https://ksandk.com/data-protection-and-data-privacy/can-employers-monitor-employees-dpdp-act/
---

## **Introduction**

The increasing use of remote working, Bring Your Own Device (“BYOD”) arrangements, cloud-based platforms and workplace monitoring software has made employee privacy an important consideration for employers in India. Organisations routinely collect and process employee data through access-control systems, company email accounts, endpoint security tools, attendance systems, CCTV, location services and cybersecurity platforms.

This raises an important question: Can employers legally monitor employee devices and communications in India?

### Are you a Significant Data Fiduciary?

Answer 25 questions to see your DPDPA risk level and whether the DPO obligation applies to you — free, instant, with a branded PDF.

[Check your compliance score →](https://ksandk.com/privacy-review/scorecard)

The answer is not a simple yes or no. The Digital Personal Data Protection Act, 2023 (“DPDP Act”) does not prohibit workplace monitoring. In fact, Section 7(i) of the DPDP Act expressly recognises certain processing undertaken for purposes of employment and for safeguarding an employer from loss or liability as a “certain legitimate use”. However, the manner, scope and purpose of monitoring remain important, particularly where monitoring involves extensive or intrusive collection of an employee’s personal information.

Importantly, the DPDP framework is being implemented in phases. The Government’s commencement notification provides that several institutional provisions of the DPDP Act came into force on 13 November 2025, certain provisions take effect one year later, and the core provisions governing processing of personal data, including Sections 3 to 17, are scheduled to come into force 18 months from 13 November 2025, i.e. on 13 May 2027.

The Digital Personal Data Protection Rules, 2025 (“DPDP Rules”) were notified on 13 November 2025. The Rules themselves also adopt a staggered commencement mechanism, with Rules 1, 2 and 17–21 taking effect upon publication, Rule 4 after one year, and Rules 3, 5–16, 22 and 23 after 18 months.

Accordingly, employers should distinguish between what is legally operative today and what organisations should prepare for before the substantive DPDP regime becomes applicable.

## What Does the DPDP Act Say About Employee Monitoring?

Section 4 of the DPDP Act provides that personal data may be processed for a lawful purpose either on the basis of consent or for certain legitimate uses. Section 7 sets out these legitimate uses. Of particular relevance to employers, Section 7(i) permits processing of personal data:

- for the purposes of employment or safeguarding the employer from loss or liability;
- for preventing corporate espionage, protecting trade secrets, intellectual property and classified information; and
- for providing any service or benefit sought by the Data Principal.

This provision is significant because it means that an employer will not necessarily have to obtain consent for every instance of employee-data processing connected with employment. For example, processing employee data for access control, attendance management, payroll administration, cybersecurity, investigation of suspected data leakage or protection of confidential business information may potentially fall within the employment-related legitimate-use framework, depending on the facts and the nature of the processing.

However, Section 7(i) should not be treated as a blanket authorisation for unrestricted employee surveillance. The statutory purpose for which the data is processed remains important. A monitoring practice that is unrelated to a legitimate employment or security purpose may require a separate legal basis and assessment.

## Is Employee Monitoring Legal in India?

There is no blanket prohibition on employee monitoring in India. Employers may have legitimate reasons to monitor activity on company systems, particularly for cybersecurity, protection of confidential information, regulatory compliance, investigation of misconduct and management of company resources.

At the same time, monitoring can involve the processing of personal data and may engage broader privacy considerations. The Supreme Court’s decision in *Justice K.S. Puttaswamy (Retd.) v. Union of India, (2017) 10 SCC 1*, recognised privacy as a constitutionally protected right and discussed informational privacy and proportionality in the context of restrictions on privacy.

While the DPDP Act does not expressly prescribe a Puttaswamy-style proportionality test for every private-sector employee-monitoring activity, employers should nevertheless consider whether the monitoring is genuinely connected with a legitimate business or security objective and whether the scope of the monitoring is appropriate to that objective. In practice, this means that the fact that an employer owns a device or network does not necessarily provide an unrestricted licence to access every piece of information associated with it.

## Company Devices vs. Personal Devices: What Can Employers Monitor?

The distinction between company-owned systems and personal devices is particularly important.

### Company-owned devices and networks

An employer’s justification for monitoring is generally stronger where the device, network or communication platform is owned or controlled by the employer and is being used for business purposes. Depending on the circumstances, employers may monitor:

- login and access activity;
- use of company systems and applications;
- network traffic;
- transfer of company files;
- use of corporate email accounts;
- security alerts and endpoint activity;
- access to confidential or restricted information; and
- other activity reasonably connected with legitimate business or security purposes.

However, company ownership should not automatically be treated as permission to access unrelated personal information. Monitoring policies should clearly identify the scope and purpose of monitoring and should distinguish business information from personal content wherever practicable.

### Personal devices used for work: BYOD

BYOD arrangements present greater privacy and compliance challenges. An employer deploying monitoring software on an employee’s personal laptop or smartphone may potentially obtain access to information that has no connection with the employment relationship, including personal photographs, private messages, personal browsing activity, location information and personal applications.

Accordingly, organisations using BYOD arrangements should consider adopting technical and organisational safeguards such as:

- separating business and personal applications through containers or dedicated work profiles;
- restricting monitoring to work-related data;
- limiting monitoring to legitimate business purposes;
- avoiding unnecessary access to personal content;
- clearly informing employees about the information that may be collected; and
- implementing appropriate retention and access controls.

A particularly intrusive measure, such as unrestricted access to an employee’s personal device or continuous off-hours tracking, should be subjected to careful legal and business justification.

## Can Employers Read Company Emails and Internal Communications?

Employers may have legitimate reasons to monitor corporate email and internal communication platforms for business continuity, cybersecurity, compliance, investigations and protection of confidential information. However, employers should distinguish between business communications conducted through company systems and purely personal communications.

For example, monitoring a company email account for malware, data leakage or unauthorised disclosure of confidential information is materially different from systematically accessing an employee’s personal email account or private messages. Organisations should therefore establish clear policies governing:

- company email and messaging systems;
- acceptable use of corporate devices;
- monitoring and cybersecurity tools;
- access to employee communications during investigations;
- retention of monitoring records; and
- access to personal information inadvertently captured during monitoring.

Where an investigation requires access to potentially personal material, organisations should consider whether the information is actually relevant to the investigation and limit access accordingly.

## Does an Employer Need Employee Consent to Monitor Devices?

Not necessarily. This is one of the most important points under the DPDP framework. Where processing falls within Section 7(i), consent is not necessarily required because the provision recognises employment-related processing and processing undertaken to safeguard the employer from loss or liability as a legitimate use.

Consent remains one of the processing grounds under the DPDP Act and may be appropriate in circumstances where consent is the relevant legal basis. However, employers should not assume that obtaining a broad consent clause in an employment contract automatically resolves all privacy concerns relating to intrusive monitoring.

Where monitoring is optional, particularly intrusive, or falls outside the ordinary requirements of employment, organisations should separately evaluate the appropriate legal basis and the manner in which employees are informed.

## What Notice Should Employers Give Employees?

The DPDP Act contains specific notice requirements in Section 5. However, an important timing distinction must be kept in mind: Section 5 is among the provisions scheduled to come into force on 13 May 2027 under the Government’s phased commencement notification. Once the substantive provisions become applicable, organisations will need to align their employee-data practices with the statutory notice framework and the requirements prescribed under the applicable DPDP Rules.

From a compliance and risk-management perspective, employers should consider maintaining a clear employee privacy or monitoring policy that explains, as appropriate:

- what categories of employee data may be collected;
- which devices, systems or applications may be monitored;
- the purpose of monitoring;
- whether monitoring occurs continuously or periodically;
- who can access monitoring information;
- how long monitoring data is retained;
- how information is secured; and
- the circumstances in which monitoring records may be reviewed or disclosed.

Transparent policies can also help distinguish legitimate workplace monitoring from covert or unnecessarily intrusive surveillance.

## What About CCTV, GPS and Location Tracking?

CCTV and location monitoring can serve legitimate security and operational purposes, but their use should be connected to a defined objective.

### CCTV

CCTV in workplaces may be used for security, access control and investigation of incidents. However, cameras should not ordinarily be placed in areas where individuals have a particularly strong expectation of privacy, such as washrooms and changing areas. Employers should also consider whether CCTV footage is being retained for longer than necessary and whether access to footage is appropriately restricted.

### GPS and location tracking

Location tracking may be relevant for employees whose roles require field visits, delivery services, fleet management or other location-dependent work. However, continuous tracking outside working hours may collect information unrelated to employment. Employers should therefore consider whether location tracking can be limited to working hours, designated applications or business purposes.

## Common Employee Monitoring Practices: What Should Employers Consider?

| Monitoring practice | Company device/network | Personal/BYOD device | Key considerations |
| --- | --- | --- | --- |
| Attendance and login/logout records | Generally easier to justify where employment-related | Limited to work-related systems | Purpose, transparency and retention |
| Company email monitoring | May be justified for business/security purposes | Personal email should generally be excluded | Avoid unnecessary access to personal content |
| Website/application usage logs | May be justified for security or business purposes | Prefer work-container monitoring | Purpose and scope |
| Screen capture/recording | Requires careful business justification | High privacy risk | Avoid unnecessary continuous recording |
| Keystroke logging | Highly intrusive | Particularly high-risk | Consider whether a less intrusive alternative exists |
| GPS/location tracking | May be justified for location-dependent roles | Prefer dedicated work applications | Consider working hours and purpose |
| CCTV | May be used for legitimate security purposes | Not ordinarily applicable | Avoid private areas; restrict access and retention |

The safest approach is generally to design monitoring around a specific business or security objective rather than adopting broad, continuous surveillance by default.

## Employer Obligations Under the DPDP Framework

Once the substantive DPDP provisions become operative, employers acting as Data Fiduciaries will need to account for obligations relating to the processing and protection of personal data. These include, among other matters:

- implementing appropriate technical and organisational measures to protect personal data;
- complying with applicable obligations relating to data breaches;
- ensuring accuracy in circumstances where the Act specifically requires it;
- retaining personal data only for as long as required for the relevant purpose or as otherwise permitted by law;
- erasing personal data when retention is no longer necessary, subject to applicable legal requirements; and
- addressing applicable rights and grievance mechanisms available to Data Principals.

The DPDP Act also provides additional obligations for Data Fiduciaries that are notified as Significant Data Fiduciaries, including requirements relating to data protection impact assessments and audits. These substantive obligations are scheduled to become operative on 13 May 2027 under the commencement notification.

## What Rights Will Employees Have?

Employees, as Data Principals, will have rights under the DPDP Act once the relevant provisions become operative. These include rights relating to access to information about personal data, correction and erasure, and grievance redressal, subject to the statutory framework and applicable exemptions.

Importantly, the precise scope and availability of these rights depends on the relevant provisions of the Act and the basis on which personal data is processed. Employers should therefore avoid assuming that every employee request for access or deletion will automatically result in unrestricted disclosure or deletion. Legal retention requirements, statutory obligations and other applicable provisions may need to be considered.

## What Are the Penalties Under the DPDP Act?

The DPDP Act provides for significant financial penalties for specified contraventions. The maximum penalty for certain breaches can extend to ₹250 crore. However, the substantive provisions governing the processing obligations and the corresponding penalty framework are subject to the phased commencement notification and are scheduled to take effect from 13 May 2027.

The Data Protection Board of India was established through a notification issued in November 2025. The Board forms part of the institutional architecture of the DPDP framework, while the substantive provisions governing data fiduciaries and data principals are being brought into force in phases.

## What Should Employers Do Now?

Although the substantive DPDP obligations are not all currently operative, organisations should use the transition period to review their employee-monitoring practices. Employers should consider:

1. **Mapping employee data flows**: Identify what employee data is collected through devices, networks, email systems, HR platforms, CCTV, access-control systems and monitoring tools.
2. **Reviewing monitoring tools**: Identify whether existing tools collect information beyond what is required for the stated business purpose.
3. **Separating work and personal data**: Particularly under BYOD arrangements, consider technical measures such as work containers or dedicated business applications.
4. **Updating monitoring policies**: Clearly explain the nature and purpose of monitoring and the systems to which it applies.
5. **Reviewing retention periods**: Establish appropriate retention and deletion mechanisms for monitoring records.
6. **Restricting access**: Ensure that monitoring information is accessible only to authorised personnel with a legitimate business need.
7. **Documenting the business rationale**: For intrusive monitoring tools, record why the tool is required and whether a less intrusive alternative is reasonably available.
8. **Preparing for May 2027**: Align employee-data practices, notices, contracts, privacy policies, security measures and grievance mechanisms with the substantive DPDP requirements before they become operative.

## Conclusion

The DPDP Act does **not** impose a blanket ban on employee monitoring in India. Section 7(i) expressly recognises certain employment-related processing and processing undertaken to safeguard an employer from loss or liability as legitimate uses. However, this should not be interpreted as a general authorisation for unrestricted workplace surveillance.

The key distinction is between legitimate, purpose-driven monitoring connected with employment or security objectives and unnecessarily broad monitoring that extends into an employee’s personal sphere. The distinction becomes particularly important for BYOD arrangements, personal communications, location tracking, screen recording and other intrusive technologies.

With the substantive provisions of the DPDP Act scheduled to come into force on **13 May 2027**, the current transition period provides employers with an opportunity to audit existing practices, identify excessive data collection, strengthen employee-facing policies and build privacy considerations into workplace monitoring systems.

For employers, the objective should therefore not be to eliminate workplace monitoring, but to ensure that monitoring is purpose-driven, appropriately scoped, transparent and supported by appropriate safeguards.

## Frequently Asked Questions

### 1. Does the DPDP Act require employee consent for workplace monitoring?

Not necessarily. Where processing falls under Section 7(i) as a “legitimate use” — such as employment-related purposes or safeguarding the employer from loss or liability — consent is not required. However, employers shouldn’t assume a broad consent clause in an employment contract resolves all concerns around intrusive monitoring.

### 2. Can employers monitor personal devices under BYOD arrangements?

BYOD monitoring is legally riskier than monitoring company-owned devices, since employers may end up accessing personal photos, private messages, browsing activity, and location data unrelated to work. Employers should use safeguards like separating work and personal data through containers, restricting monitoring to work-related data, and clearly informing employees what’s collected.

### 3. Can employers read employees’ company email accounts?

Yes, for legitimate purposes like cybersecurity, malware detection, data leakage prevention, or investigations. However, this is different from accessing an employee’s personal email or private messages, and organizations should limit access to what’s actually relevant to the business purpose or investigation.

### 4. When do the substantive provisions of the DPDP Act come into force?

The core provisions governing personal data processing (Sections 3–17), including notice and consent requirements, are scheduled to take effect on 13 May 2027 — 18 months from the 13 November 2025 commencement date. Employers should use this transition period to audit and align their monitoring practices.

### Explore KSK Data Privacy Hub

Free compliance tools and expert guidance covering 75+ jurisdictions.

[Global Regulation Finder](/privacy-review/map/)[DPDPA Scorecard](/privacy-review/scorecard/)[DPDPA Guide](/privacy-review/guides/dpdpa/)[GDPR Guide](/privacy-review/guides/gdpr/)[Cross-Border Transfers](/privacy-review/guides/cross-border/)

---

## Office Locations                                                                                                                                                     
                                               
  - [New Delhi](https://ksandk.com/locations/top-corporate-law-firm-in-delhi/) (HQ): +91-11-41318190 | info@ksandk.com                                                    
  - [Mumbai](https://ksandk.com/locations/top-corporate-law-firm-in-mumbai/): 3 offices (Nariman Point, Lower Parel, Andheri) | mumbai@ksandk.com
  - [Bangalore](https://ksandk.com/locations/top-corporate-law-firm-in-bangalore/): bangalore@ksandk.com                                                                  
  - [Chennai](https://ksandk.com/locations/chennai/): chennai@ksandk.com                                                                                                  
  - [Hyderabad](https://ksandk.com/locations/hyderabad/): hyderabad@ksandk.com                                                                                            
  - [Pune](https://ksandk.com/locations/pune/): pune@ksandk.com                                                                                                           
  - [Kochi](https://ksandk.com/locations/kochi/): kochi@ksandk.com
                                                                                                                                                                          
  ## Contact                                   
                                                                                                                                                                          
  - [Contact Page](https://ksandk.com/contact-us/)
  - General: info@ksandk.com | +91-11-41318190
  - WhatsApp: +91-7428567444
  - [Privacy Statement](https://ksandk.com/privacy-statement/)                                                                                                            
  - [Terms of Use](https://ksandk.com/terms-of-use/)