DPDP Act 2023 and employee wellbeing data: what HR must know

The DPDP Act 2023 governs the processing of digital personal data in India. It rests on a few principles that matter directly for wellbeing programmes. The first is consent. Personal data should generally be processed only after the individual, called the data principal, has given free, informed, specific and unambiguous consent, accompanied by a clear notice of what you collect and why. Consent bundled into a forty-page employment contract is exactly the kind of thing the Act is designed to discourage.

The second is purpose limitation. You collect data for a stated purpose and you use it only for that purpose. If an employee shares mood data so a wellbeing app can suggest support, that data cannot quietly become an input to a performance review or a promotion decision. The third is the set of data principal rights: people can ask what you hold about them, ask for corrections, and in defined circumstances ask for erasure. A wellbeing vendor that cannot service a deletion request is a liability you are carrying on your own books.

There is also a real obligation around security and accountability. As the organisation deciding why and how the data is processed, you sit in the role of a data fiduciary, and you remain answerable even when a vendor does the actual processing for you. Picking a careless vendor does not transfer the risk away from you. It just hides it.

Not all personal data carries the same weight. A work email address leaking is an annoyance. The fact that a named employee is in therapy for depression leaking is the kind of event that ends trust, careers and sometimes the programme itself. Mental health information sits at the intersection of stigma, livelihood and law, which is why most serious data regimes treat it with heightened care and why you should too, regardless of the precise letter of any single clause.

Indian workplace realities sharpen the point. Wellbeing data often travels alongside identifiers you are already legally required to keep: PF and ESIC numbers, salary bands, shift rosters, tax records. The temptation to join these tables is enormous and almost always a mistake. The instant a counselling record can be linked to a PF number, you have built a file that can follow someone for their entire working life.

Shift work, contract staff and multi-site operations add more edges. An employee on a night shift at a single-team site is far easier to re-identify from a stress report than someone in a thousand-person head office. Sensitivity is not just about the field you store. It is about how easily that field can be traced back to one human being.

The practical defence against wellbeing reporting becoming surveillance is to make sure HR never sees individual records in the first place. Reporting should be aggregated, and aggregation should respect a minimum cohort size. A common and sensible rule is to suppress any figure that would describe fewer than ten people, often called cohort-of-10 reporting. If only six people in a team answered a stress survey, the team-level number simply is not shown, because at that size an average can effectively unmask individuals.

Anonymisation has to be more than dropping the name column. Combinations of attributes, department, location, tenure, gender, can re-identify a person even with no direct identifier present. Genuine anonymisation tests whether any reasonable combination of fields can single someone out, and collapses categories until it cannot. Ask your vendor to describe, in concrete terms, how they prevent re-identification, not merely that they remove names.

Data residency is the third leg. Know where the data physically lives, which sub-processors touch it, and whether it leaves India. You do not need to become a network engineer, but you do need a clear, written answer, because under the DPDP regime you remain accountable for the chain of processing even when it runs through someone else's cloud.

Start with consent that an actual person can understand. The notice should say, in plain language, what is collected, why, who can see it and how to withdraw. Withdrawal should be as easy as joining, and it should not quietly punish the employee who chooses it. If using the programme feels risky, people protect themselves by staying away, and a wellbeing service nobody uses helps no one.

Insist on a hard wall between aggregate insight and individual record. The legitimate job of analytics is to tell the organisation where to invest: which sites are carrying the heaviest load, where burnout signals are rising, whether a policy change moved the needle. None of that requires a single name. Amy Edmondson's research on psychological safety, and Google's Project Aristotle, both point the same way: teams perform when people feel safe to be honest, and people are only honest when they are sure their disclosures will not be used against them.

Then ask the awkward questions out loud. Can a manager ever see who flagged a concern? Can this data reach a disciplinary process? What happens to it when someone leaves? A serious vendor will have crisp answers and will have designed the system so the dangerous paths are closed by construction, not by policy you have to trust. Aha builds its wellbeing reporting on exactly this principle, but the principle matters more than any one product: insist on it from whoever you choose.