In short
Employee onboarding is the process of collecting a new joiner's personal details, documents and consents and getting them ready for day one. Under the Digital Personal Data Protection Act, 2023, employers can process employee data for employment purposes as a 'legitimate use', but must still keep it secure, use it only for that purpose, delete it when no longer needed and report breaches. The DPDP Rules, 2025 make these core duties enforceable from 13 May 2027.
What data do you collect during onboarding?
A typical onboarding pack in India collects:
| Category | Examples |
|---|---|
| Identity | Name, date of birth, photograph, PAN, Aadhaar (masked), passport |
| Contact | Address, personal phone and email, emergency contact |
| Employment | Offer acceptance, previous employment, relieving letters |
| Statutory and payroll | Bank details, UAN for provident fund, ESIC details, tax declarations, nominations |
| Education | Degree certificates and mark sheets |
| Consents and declarations | Background-verification consent, policy acknowledgements |
Almost all of this is personal data, and much of it is sensitive enough to cause real harm if leaked: identity theft, fraud or targeted scams.
What the DPDP Act means for onboarding
The Digital Personal Data Protection Act, 2023 makes your organisation a data fiduciary for the personal data of employees and candidates. The DPDP Rules, 2025 were notified on 13 November 2025, and the core obligations become enforceable on 13 May 2027.
- Legitimate use for employment. Section 7 lets employers process personal data for the purposes of employment without separate consent, but only for those purposes.
- Security safeguards. You must take reasonable security measures to prevent personal data breaches. Failing to do so can attract penalties of up to ₹250 crore.
- Purpose limitation. Data collected to onboard someone shouldn't be reused for unrelated purposes.
- Storage limitation. Delete data once its purpose is served, unless another law requires you to keep it.
- Breach notification. Personal data breaches must be reported to the Data Protection Board and the affected people.
- Rights of the employee to access, correct and, where applicable, erase their data.
Emailing ID documents and bank details is one of the biggest onboarding risks. Attachments are copied to every inbox, laptop and backup they touch, and are almost impossible to delete on schedule.
Employee onboarding checklist
- Before the offer: decide what data you actually need, and why.
- Send a secure link to the joiner instead of asking for documents by email.
- Collect details and documents in one encrypted form, masking Aadhaar numbers.
- Capture consents and acknowledgements, such as background verification and policy sign-offs.
- Review: HR or the manager checks the submission and requests corrections if needed.
- Set up statutory registrations (PF, ESIC) and payroll.
- Restrict access to onboarding records to the people who need them.
- Apply a retention period and delete onboarding records when it ends.
How TrustToSpeak handles onboarding
Joiner data collected securely, not emailed
- HR sends an invite link, valid for 30 days. The new joiner doesn't need an account.
- One encrypted form for personal details, documents and consents, stored in your own isolated database.
- Manager review with a 'request corrections' loop that sends it back to the joiner automatically.
- Branch HR owns joiners at their location, with head office seeing everything.
- Access logs and a retention period, so data is deleted on schedule.
Frequently asked questions
Do employers need consent to process employee data under the DPDP Act?
Not for employment purposes. Section 7 treats processing for the purposes of employment as a legitimate use. Employers must still keep the data secure, use it only for those purposes and delete it when it's no longer needed.
When do the DPDP Act obligations start?
The DPDP Rules, 2025 were notified on 13 November 2025, with a phased rollout. The core obligations, including security safeguards, breach notification and data principal rights, become enforceable on 13 May 2027.
Can we store employees' Aadhaar numbers?
Collect and store only what you need. Where Aadhaar is required, store it masked (showing only the last four digits) and keep the document itself securely with restricted access.
How long should we keep onboarding documents?
Only as long as needed for the employment purpose or as another law requires, for example for tax, PF or labour records. Set a retention period and delete records when it ends.
Is it safe to collect onboarding documents by email?
It's risky. Email attachments end up in many inboxes and backups, are hard to delete, and are a common source of data leaks. A secure, encrypted link is a much safer way to collect documents.
This guide explains the law in general terms and is not legal advice. Laws, rules and state notifications change; check the current text and take advice from a qualified professional for your situation.