INTRODUCTION
Employers collect and use significant amount of information about their employees on a regular basis. Names, phone numbers, addresses, salary details, bank account information, performance records and even medical information may all form part of an employee’s digital record. But how much of this information can an employer use or share without asking the employee each time?
The Digital Personal Data Protection Act, 2023 (‘DPDP Act’) seeks to address this. In simple terms, the DPDP Act regulates how personal data in digital form is collected, stored, used, shared and deleted. It also applies where information is first collected on paper and later converted into digital form.
As a general rule, personal data can be processed only for a lawful purpose and either with the consent of the individual whose data is being used or where the processing falls within one of the specific ‘legitimate uses’ recognised by the DPDP Act.
One such legitimate use is processing personal data for employment purposes. An employer needs to use an employee’s personal data to pay salaries, administer benefits and manage the employment relationship. But where does the line end? Can an employer rely on the abovementioned employment exception when sharing employee data with a group company, a potential buyer or an adviser? Can it use the same exception for purposes that are only indirectly connected with employment?
These questions also arise when a company is undergoing a M&A transaction. Before the deal is completed, the buyer may want to review employee contracts, salary structures, benefits, performance information and other workforce related data as part of its due diligence. During such transaction process, such information may also need to be shared with lawyers, consultants, lenders or other advisers. The question then arises: when can employee data be shared in connection with a M&A transaction, and what legal basis permits such sharing?
The DPDP Act also contains a specific exemption for processing personal data that is necessary for certain corporate restructuring transactions, where the restructuring is approved by a court, tribunal or other competent authority. This raises another important question: is sharing of personal data of employees during the course of transactions that do not require such approval, prohibited?
DATA PROCESSING FOR THE PURPOSE OF EMPLOYMENT
Section 7 of the DPDP Act recognises certain ‘legitimate uses’ that allow personal data to be processed for a lawful purpose without separately obtaining the consent of the individual whose data is being used. One such use arises when an individual voluntarily gives personal information for a specified purpose and has not indicated that they do not agree to its use for that purpose.[1] For example, when an applicant voluntarily submits a resume for a job opening, the employer may use that information to assess the application without separately obtaining consent. However, submitting a resume for recruitment does not authorise its use for unrelated purposes.
Section 7(i) specifically permits processing data for the ‘purposes of employment’ to safeguard the employer from loss or liability. This allows employers to handle employees’ personal information for activities such as payroll, performance reviews and employee benefits without seeking consent for each activity separately.
However, the DPDP Act does not define ‘purposes of employment’, leaving uncertainty about how far this expression extends. A broad reading could extend it beyond routine administration, and this flexibility also creates a scope for misuse. An employer could, for instance, rely on productivity or security concerns to justify continuously tracking employees’ access logs, reviewing their emails or monitoring their online activity. Although some monitoring may serve a valid employment purpose, the undefined expression creates uncertainty about when it becomes excessive or intrudes into an employee’s privacy.
The DPDP Act uses ‘necessary’ as a safeguard requiring companies to justify why data or processing is needed for the stated purpose. Section 6(1) limits consent to data necessary for the specified purpose, while Section 17(1)(e) requires processing to be necessary for an approved restructuring scheme. Section 7(i) contains no such requirement. It means employers could argue that a connection to employment is sufficient, even where the processing is not essential to a specific purpose.
Even where an employer seeks consent, simply including a broad clause in an employment agreement or NDA does not necessarily make that consent valid under the DPDP Act. Consent must be freely given, specific and informed. This becomes particularly important in an employment relationship, where there is an inherent imbalance of power between the employer and the employee. If refusing to agree to a clause could mean losing a job or missing out on an employment opportunity, it is worth considering whether the employee had a genuine choice in giving that consent.
However, Section 7(i) permits employers to process personal data for employment purposes without obtaining the employee’s consent. This removes the consent requirement, but employers must still comply with the other applicable obligations under the DPDP Act.
For example, employers remain responsible for protecting the personal data they hold, taking appropriate steps if a data breach occurs and deleting personal data when it is no longer required for the purpose for which it was collected, unless its retention is required by law. In other words, the employment exception is not a free pass to collect and retain employee data indefinitely.
CORPORATE RESTRUCTURING: AN IMPORTANT BUT NARROW EXEMPTION
Section 17(1)(e) provides for an exemption where personal data is processed because it is ‘necessary’ for corporate restructuring approved by a court, tribunal or other authority competent under law.
Two conditions must be satisfied. First, the transaction must fall within one of the categories listed in Section 17(1)(e) which includes a scheme of compromise or arrangement, merger or amalgamation, of two or more companies, reconstruction of a company by demerger or otherwise, transfer of an undertaking from one or more companies to another, or division of one or more companies. Second, it must be approved by a court, tribunal or other competent authority. NCLT-sanctioned mergers, demergers and arrangements under Sections 230 to 232 of the Companies Act, 2013 are the clearest examples. A fast-track merger under Section 233 would also qualify once approved by the competent authority.[2]
However, share acquisitions and joint ventures ordinarily fall outside the exemption. An asset sale, business transfer and slump sale may involve a transfer of undertaking, but ordinarily lack the required court, tribunal or statutory approval.
THE DUE DILIGENCE GAP
Employee data reviewed during due diligence may include employment contracts, salary and benefit details, workplace complaints, investigation reports and litigation files.
The difficulty is that most due diligence takes place before the transaction has been approved. Section 17(1)(e) refers to a restructuring that has been ‘approved’ by the competent body. It does not expressly cover a proposed restructuring. One interpretation is that due diligence and preparation of the scheme are necessary steps towards completing the approved restructuring. The conservative interpretation is that the exemption becomes available only after the required approval has been obtained. The latter interpretation is more consistent with the express use of the word ‘approved’ and avoids giving the approval retrospective effect.
The gap is wider for transactions that fall outside Section 17(1)(e), such as share acquisitions and contractual business transfers. Employee data disclosed during due diligence must then be supported by consent or another legitimate use specified under Section 7. Section 7(i) may support limited disclosure closely connected to the continuation or transfer of employment but is less likely to justify unrestricted access to employee records by a prospective buyer.
Therefore, any other non-court-approved transactions would have to conform with the DPDP Act, including the consent and notice requirements prior to sharing personal data with a third party. Obtaining consent from a large number of employees, may be impractical and may reveal details of a confidential transaction and delay or restrict due diligence.
Hence, the parties should limit identifiable personal data at each stage of the transaction. Initial discussions can rely on anonymised information. Access may expand as the transaction becomes more certain. Virtual data rooms should use access controls, download restrictions and activity logs. Transaction documents should specify the purpose of disclosure, permitted recipients, security requirements and deletion obligations.
Written by: Nidhi Arora (Partner) and Devyani Makhija (Associate)
[1] DPDP Act, Section 7(a).
Note - The provisions of DPDP Act are scheduled to come into force on 13 May 2027.
[2] Companies Act 2013, ss 230–233.