Where the law stands today
| Date | What applies |
|---|---|
| 13 November 2025 | DPDP Rules notified; Data Protection Board provisions in force |
| 13 November 2026 | Consent Manager registration (Rule 4) |
| 13 May 2027 | Employer duties on notice, consent, security, breach reporting and erasure, with penalties. Section 43A of the IT Act and the SPDI Rules fall away |
Until 13 May 2027, the SPDI Rules treat biometric data as sensitive personal data. Employers must obtain written consent before collecting it, which can be given electronically, and follow reasonable security practices. Under Section 43A, an organisation that handles the data negligently is liable to compensate anyone affected.
What the DPDP Act requires from May 2027
The Act does not create a separate category for biometric data. The same rules apply to all digital personal data, including:
- A lawful ground: consent that is free, specific, informed, unconditional and unambiguous (Section 6), or a legitimate use (Section 7). Section 7(i) covers employment purposes, but its application to biometric attendance is untested, so consent remains the conservative route.
- A clear notice before or with the request for consent, available in English or any of the 22 languages in the Eighth Schedule (Section 5).
- Reasonable security safeguards such as encryption or masking, with access logs kept for at least a year (Rule 6).
- Breach reporting to affected employees without delay, and a detailed report to the Board within 72 hours (Rule 7).
- Erasure once the purpose is served or consent is withdrawn (Section 8(7)). Rule 8(3) separately requires personal data and processing logs to be kept for at least a year for the purposes in the Seventh Schedule.
- Verifiable parental consent for anyone under 18 (Section 9), which applies to schools enrolling students.
Fines and penalties
From 13 May 2027, the Data Protection Board can impose penalties for each instance of a breach.
| Breach | Maximum penalty |
|---|---|
| Failing to take reasonable security safeguards to prevent a personal data breach | ₹250 crore |
| Failing to notify the Board or affected individuals of a breach | ₹200 crore |
| Failing to meet the obligations for children’s data | ₹200 crore |
| Other breaches of the Act or Rules | ₹50 crore |
Until then, Section 43A of the IT Act requires an organisation that negligently fails to protect sensitive personal data, including biometrics, to compensate those affected.
Before you enrol the first employee
- Collect written consent now. The SPDI Rules require it for biometric data today, and consent remains the safest ground after May 2027.
- Issue a notice in the languages your workforce uses and name a contact for questions and grievances.
- Obtain verifiable parental consent before enrolling students under 18.
- Document a retention period. Delete templates once the purpose is served, allowing for the one-year minimum under Rule 8(3), and take advice on how the two interact.
- Prepare a breach-response plan that meets CERT-In’s six-hour reporting window now, and the Board’s 72-hour report from May 2027.
Free templates: Download the free consent-form and retention-policy templates →
How NCheck supports it
As the employer, you are the Data Fiduciary, so the decision on which ground to rely on rests with you. NCheck provides controls that help you meet your obligations.
- On-premises deployment on servers in India keeps biometric data in the country.
- Encrypted, non-reversible templates. Event photos can be deleted automatically after a period you set.
- RFID, barcode or manual check-in as an alternative for anyone who declines biometrics.
- Retention limits, deletion tools and an audit trail for erasure requests.
NCheck Cloud is hosted outside India. Under the SPDI Rules, sensitive personal data may be transferred abroad only to a recipient that ensures the same level of protection, and where the transfer is necessary for a lawful contract or the employee has consented. From May 2027, the DPDP Act allows transfers unless the government restricts the destination. Organisations that prefer local storage can run NCheck On-Premises on their own servers in India. More on data residency and biometric data.
Common in these industries
Enterprise · Manufacturing · Education · all industries
Frequently asked questions
Does the DPDP Act apply to employee attendance data?
Yes, it covers all digital personal data, including biometrics, but most of its duties take effect on 13 May 2027. Until then, the SPDI Rules govern biometric data and require written consent before it is collected.
Do we need consent from each employee?
Written consent is required today under the SPDI Rules. From May 2027, Section 7(i) allows some employment-related processing without consent, but whether biometric attendance qualifies is untested, so collecting consent and offering a non-biometric alternative remains the safer course.
Can attendance data be stored outside India?
Yes, with conditions. Today the SPDI Rules require the recipient to provide the same level of protection, and the transfer must be necessary for a lawful contract or consented to. From May 2027, the DPDP Act allows transfers unless the government restricts the destination. NCheck On-Premises keeps data on your own servers in India.
What happens to templates when someone leaves?
They should be erased once the purpose is served, allowing for Rule 8(3)'s one-year minimum retention from May 2027. Set and document a period that meets both. NCheck deletes templates per employee and keeps attendance records for the period you configure.
This page is general guidance, not legal advice. Laws change; confirm current requirements with your counsel.
Deploy it the compliant way
Run NCheck fully on your own server — data never leaves your network — or in NCheck Cloud. Either way, matching uses encrypted templates, and event photos can be deleted automatically after a period you set. About on-premises → · Security & compliance →