The DPDP Act 2023 and DPDP Rules 2025: What Changes for Workplace Investigations

The Digital Personal Data Protection Act 2023 (DPDP Act) and the DPDP Rules 2025 do not stop organisations from investigating misconduct, but they change how investigations must be run. Employers can process employee data without consent for employment purposes and to protect themselves from loss, and processing to investigate offences or enforce legal claims is largely exempt. However, security safeguards, breach reporting and retention rules will apply, and most of those obligations take effect around 13 May 2027, which leaves investigation teams time to adjust their procedures.

This post explains the provisions that matter for internal investigations, the phased timeline, and practical steps to take before the main obligations commence.

What does the DPDP framework cover?

The DPDP Act governs the processing of digital personal data. A Data Fiduciary is anyone who determines the purpose and means of processing; a Data Principal is the individual the data relates to. “Processing” is broad: collection, storage, retrieval, use, sharing and erasure all count.

An internal investigation processes large volumes of personal data: emails, chat messages, access logs, call records, CCTV, expense claims and HR files. The company commissioning the investigation is the Data Fiduciary. External investigators, eDiscovery providers and digital forensics specialists engaged by it will usually act as Data Processors, and under s. 8(1) the Data Fiduciary remains responsible for their processing.

What is the timeline?

The DPDP Rules 2025 were notified on 13 November 2025 (G.S.R. 846(E)) with phased commencement.

The government has floated shortening the eighteen-month period, but no amending notification had been reported at the time of writing. Organisations should plan to the published dates and watch for change.

What applies in the meantime?

Section 44(2) of the DPDP Act omits s. 43A of the Information Technology Act 2000, but that omission also commences around 13 May 2027. Until then, s. 43A and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules 2011 continue to apply. A body corporate handling sensitive personal data that negligently fails to maintain reasonable security practices, causing wrongful loss or gain, remains liable to compensate.

CERT-In's Directions of 28 April 2022 also continue to apply. They require listed cyber incidents, including data breaches and data leaks, to be reported to CERT-In within six hours, and ICT logs to be kept for a rolling 180 days within India.

Can an employer investigate without consent?

Yes, in most cases. Two routes are relevant.

Legitimate use for employment: s. 7(i)

Section 7 lists “legitimate uses” for which consent is not needed. Clause (i) covers processing for the purposes of employment, or to safeguard the employer from loss or liability. The Act's examples include preventing corporate espionage and maintaining confidentiality of trade secrets, intellectual property and classified information.

This covers much routine workplace monitoring and many internal investigations into fraud, insider threat, data theft and policy breaches. It does not remove the need for the processing to be connected to a lawful purpose and limited to what is necessary.

Exemptions under s. 17(1)

Section 17(1) disapplies most of Chapter II (other than s. 8(1) and s. 8(5)), Chapter III and s. 16 where processing is:

• (a) necessary for enforcing any legal right or claim;
• (c) in the interest of prevention, detection, investigation or prosecution of any offence or contravention of any law in India.

For investigations into suspected fraud, bribery or data theft, these exemptions are significant. For processing that falls within them, the notice and consent provisions of Chapter II and the Data Principal's rights under Chapter III, such as access and erasure, do not apply. That matters because tipping off the person under investigation could defeat the purpose of the inquiry.

Two limits matter. First, the exemptions do not remove s. 8(5): reasonable security safeguards must still protect the data. Second, the exemption applies to processing that is genuinely necessary for the stated purpose. A fishing expedition through an entire workforce's mailboxes is harder to justify than a targeted review of named custodians.

How do security safeguards and retention affect investigations?

Rule 6 sets minimum security safeguards once in force: encryption or masking, access controls, logging and monitoring to detect unauthorised access, continuity measures such as backups, safeguard clauses in Data Processor contracts, and retention of logs and personal data for one year unless another law requires otherwise.

Rule 8(3) separately requires personal data, associated traffic data and processing logs to be retained for at least one year from processing for the purposes set out in the Rules' Seventh Schedule.

For investigators, these rules cut both ways:

• Evidence availability. One-year log retention improves the chance that access and activity records exist when misconduct surfaces.
• Handling of collected data. Forensic images, review databases and interview records are personal data. Access to them must be controlled and logged, and they must be secured throughout. A documented chain of custody supports both evidential integrity and security compliance.
• Disposal. Once the investigation and any proceedings are concluded, data no longer needed should be erased in line with s. 8(7), subject to legal holds and other retention laws.

What happens when an investigation finds a data breach?

Many investigations begin with, or reveal, a personal data breach: an employee exfiltrating customer data, a compromised mailbox, or a misdirected file. Once Rule 7 is in force, the Data Fiduciary must:

1. Inform each affected Data Principal without delay, describing the breach, likely consequences, mitigation, protective steps they can take and a contact person.
2. Inform the Data Protection Board without delay with a description of the breach.
3. Within 72 hours of becoming aware, give the Board a detailed report covering facts, causes, mitigation, findings regarding the person who caused the breach, remedial measures and the intimations sent.

That third requirement links breach response directly to investigation. Organisations will need to establish quickly, and defensibly, who did what. Under the Schedule to the DPDP Act, failure to notify can attract a penalty of up to INR 200 crore, and failure to take reasonable security safeguards up to INR 250 crore.

What should investigation teams do before May 2027?

1. Map investigative data flows. Identify what data is collected in investigations, where it is stored, who accesses it and which processors are involved.
2. Update employee notices and policies. Make clear that communications and devices may be monitored and reviewed for employment, security and investigative purposes, relying on s. 7(i).
3. Write the exemptions into protocols. Document, case by case, why processing falls within s. 7(i) or s. 17(1), and record proportionality decisions such as custodian selection and search terms.
4. Tighten processor contracts. Ensure investigators, forensic firms and review platforms have security, confidentiality, deletion and breach-notification clauses.
5. Integrate breach response and investigation. Agree in advance who leads, how evidence is preserved through forensic imaging, and how the 72-hour report will be prepared.
6. Set retention and disposal rules. Define how long investigation files are kept and how they are erased.
7. Protect whistleblowers. Personal data of a whistleblower needs particular care; confidentiality obligations under vigil-mechanism policies continue to apply.

Our guides to preserving digital evidence in internal investigations and how to investigate a whistleblower complaint cover evidence handling and process in more detail. Data protection questions in a live matter should be checked with legal counsel.

How Spectra Forensics can help

Spectra Forensics has conducted 1,250+ investigations over 19+ years. Our digital forensics and eDiscovery service covers targeted, documented collection and review of electronic data with controlled access and chain-of-custody records. Our fraud and whistleblower investigations for corporates cover investigation protocols designed with data protection obligations in mind. To discuss an investigation or your preparation for the DPDP Rules, contact us.