The DPDP Act 2023 and the DPDP Rules notified on 13 November 2025 make employers "data fiduciaries" for employee personal data. Most obligations, including notice, security safeguards, breach reporting and rights handling, apply from 13 May 2027. Before deploying workplace AI, know what personal data it processes, on what legal basis, where it goes, and how employees can see and correct it.
This is a general overview, not legal advice.
The timeline
| Date | What applies |
|---|---|
| 13 Nov 2025 | Rules notified; Data Protection Board provisions in force |
| 13 Nov 2026 | Consent manager provisions |
| 13 May 2027 | Core obligations for data fiduciaries |
Sources: MeitY, commencement notification.
What it means for workplace AI
Workplace AI tools such as meeting assistants, enterprise search and memory tools process employee personal data: names, messages, voices, work activity. Questions to answer:
- What personal data does the tool process? Be specific.
- On what basis? Employment purposes or consent.
- Where does it go? On the device, your servers, the vendor's cloud, a third-party AI provider?
- Who can see it? Colleagues, managers, admins, the vendor?
- How long is it kept? And how is it deleted?
- Can employees see and correct it?
- Is the vendor a data processor under contract, with security obligations?
Practical steps for HR and IT
- Inventory AI tools that touch employee data
- Update the employee privacy notice in plain language
- Limit tools to work activity; exclude personal use
- Prefer tools that keep raw data on devices or your servers
- Sign processor agreements with vendors
- Set retention periods
- Give employees a way to see what is shared
- Prepare a breach response process
Where Reattend fits
Reattend was designed with this in mind. Raw capture stays on each computer; only derived knowledge is shared, under record-level access rules. Only apps and sites marked as work, by the person or by the organization's capture policy, can be shared. Each person has a ledger of what left their computer and can take items back. Organizations can run their own server; air-gapped installs are scoped with our team. By default, memories are written on each computer by Rabbit, Reattend's own model (still in training). If your organization uses managed AI, a pilot Reattend enables on request, text from work activity is sent through reattend.com to that AI service for processing. Questions and insights on the leaders' dashboard are answered by a managed AI service working on the shared records. Cover both in your notice. See compliance.
Frequently asked questions
When does the DPDP Act apply to employers?
The DPDP Rules were notified on 13 November 2025 with phased timelines. Most obligations for data fiduciaries, including notice, security safeguards, breach reporting and data principal rights, take effect on 13 May 2027.
Do employers need consent to process employee data under the DPDP Act?
The Act allows processing for certain legitimate uses, including some employment purposes, without consent. Processing that goes beyond those purposes generally needs consent. Get legal advice on your specific use.
Does the DPDP Act require data to stay in India?
The Act does not impose a blanket localisation requirement. It allows the government to restrict transfers to specified countries, and sector rules may impose their own requirements.
Is this legal advice?
No. This is a general overview. Consult a qualified lawyer for your organization.