Regulatory framework · Investigations, data and evidence
Personal data in investigations
Can we search an employee’s laptop, email and phone, and what does the DPDP Act change?
Spectra Forensics7 laws and regulators
Short answer
Usually yes, on company systems and with a defined purpose. The DPDP Act 2023 recognises processing for employment purposes, including protecting the employer from loss or liability, and exempts processing for investigating offences or contraventions of law from most of its duties, but not from the duty to keep data secure. Most of the Act and the DPDP Rules 2025 take effect in May 2027; until then the IT Act and its 2011 data rules continue to apply. Personal devices and private accounts need consent or legal process.
The landscape
Laws and regulators in play
- Digital Personal Data Protection Act 2023 (s.7(i))
- Lets an employer process personal data without consent for employment purposes, including safeguarding itself from loss or liability, such as preventing corporate espionage and protecting trade secrets and confidential information.
- Digital Personal Data Protection Act 2023 (s.17(1))
- Exempts processing for enforcing legal rights or claims (s.17(1)(a)) and for preventing, detecting, investigating or prosecuting offences or contraventions of law (s.17(1)(c)) from most obligations, but not from s.8(1) or the security duty in s.8(5).
- Digital Personal Data Protection Act 2023 (s.8 and Schedule)
- Requires reasonable security safeguards and notice of personal data breaches. Penalties run up to ₹250 crore for failing to protect data and ₹200 crore for failing to notify a breach.
- DPDP Rules 2025 (G.S.R. 846(E), 13 November 2025)
- Set out security measures, including logs and monitoring kept for one year (rule 6), breach notice to the Board within 72 hours (rule 7), and a one-year minimum retention of personal data, traffic data and logs (rule 8(3)). Most rules commence 18 months after publication.
- Information Technology Act 2000 (ss.43, 43A, 66, 72A)
- Penalises unauthorised access to computer systems and disclosure of information in breach of a lawful contract, and, until the DPDP Act’s s.44(2) commences, requires reasonable security practices for sensitive personal data (s.43A).
- Bharatiya Sakshya Adhiniyam 2023 (s.63)
- Governs how electronic records collected in the investigation are later proved in court.
- EU GDPR (Arts 6(1)(f), 88, 44–49)
- Applies where the investigation touches staff or systems in Europe: legitimate interests, employment-context rules and limits on transfers out of the EU.
Step by step
Decision framework
- 01
Write down the purpose before collecting anything
Name the allegation, the people and the period. A defined purpose is what links the processing to employment purposes or to investigating a contravention, and it limits what you collect.
- 02
Separate company systems from personal ones
Company email, laptops, servers and company-issued phones can be preserved under policy. A personal phone or private account needs the employee’s consent, a court order or law enforcement process. Unauthorised access can itself be an offence under the IT Act.
- 03
Check what the policies already say
Acceptable-use, monitoring and BYOD policies, employment contracts and the privacy notice for employees. Gaps here are the most common reason evidence is challenged.
- 04
Collect forensically and minimally
Image devices, record hash values and keep a chain of custody so the evidence survives under s.63 of the Bharatiya Sakshya Adhiniyam. Then filter by date range, custodian and keyword so reviewers see only what the purpose needs.
- 05
Secure, restrict and log access
The security duty survives every exemption. Restrict review to the investigation team, keep access logs and protect copies held by advisers.
- 06
Decide retention and onward sharing
Keep what is needed for the matter, any litigation and the minimum period in the rules; delete the rest. Sharing with police, regulators or overseas affiliates needs a legal basis and, for transfers abroad, a check against any restricted-country notification.
- 07
Treat a breach of investigation data as a breach
Investigation files are dense with personal data. If they leak, the notification duties apply as they would to any other breach.
Duties and deadlines
Who must do what, and by when
| Who | Must do what | By when |
|---|---|---|
| Employer as Data Fiduciary | Take reasonable security safeguards to prevent a personal data breach, including over investigation data.DPDP Act s.8(5); DPDP Rules rule 6; IT Act s.43A | Always; the DPDP duty commences around May 2027, and IT Act s.43A applies until then |
| Employer as Data Fiduciary | Notify each affected Data Principal and the Data Protection Board of a personal data breach.DPDP Act s.8(6); DPDP Rules rule 7 | Without delay; a detailed report to the Board within 72 hours of becoming aware |
| Employer as Data Fiduciary | Retain personal data, associated traffic data and processing logs for at least one year for the purposes in the Seventh Schedule.DPDP Rules rule 8(3) | From commencement of the rule, about 18 months after 13 November 2025 |
| Employer as Data Fiduciary | Erase personal data when the purpose is no longer served, unless the law requires retention.DPDP Act s.8(7) | At the end of the matter and any related proceedings |
| Investigation team and advisers | Access only what the purpose needs, record what was collected and how, and keep hash values and chain of custody.DPDP Act s.8; BSA s.63 | Throughout the investigation |
Employer as Data Fiduciary
Take reasonable security safeguards to prevent a personal data breach, including over investigation data.
By whenAlways; the DPDP duty commences around May 2027, and IT Act s.43A applies until then
DPDP Act s.8(5); DPDP Rules rule 6; IT Act s.43A
Employer as Data Fiduciary
Notify each affected Data Principal and the Data Protection Board of a personal data breach.
By whenWithout delay; a detailed report to the Board within 72 hours of becoming aware
DPDP Act s.8(6); DPDP Rules rule 7
Employer as Data Fiduciary
Retain personal data, associated traffic data and processing logs for at least one year for the purposes in the Seventh Schedule.
By whenFrom commencement of the rule, about 18 months after 13 November 2025
DPDP Rules rule 8(3)
Employer as Data Fiduciary
Erase personal data when the purpose is no longer served, unless the law requires retention.
By whenAt the end of the matter and any related proceedings
DPDP Act s.8(7)
Investigation team and advisers
Access only what the purpose needs, record what was collected and how, and keep hash values and chain of custody.
By whenThroughout the investigation
DPDP Act s.8; BSA s.63
Analysis
How the regimes interact
Why this question matters
Almost every internal investigation now turns on email, chat, documents and device data, and nearly all of it is personal data about someone. The DPDP Act does not prohibit investigations, but it changes what a defensible one looks like: a stated purpose, collection limited to that purpose, real security, and a decision about when the data is deleted. Companies that build those habits now will find the Act's main commencement in 2027 uneventful.
How the regimes interact
Two routes to lawful processing, with different limits. Section 7(i) lets an employer process data for employment purposes, including protecting itself from loss or liability. Section 17(1)(c) goes further for investigations of offences or contraventions of law and lifts most of the Act's duties, such as notice and the data principal's rights. Neither route removes the security duty. Many internal investigations begin as a policy breach and become a suspected offence, so record which route you rely on and update it as the facts change.
The timetable creates a two-stage regime. Until around May 2027, the IT Act's section 43A and the 2011 rules on sensitive personal data govern security, alongside the criminal provisions on unauthorised access and wrongful disclosure. When the DPDP Act's main provisions commence, section 43A is omitted and the DPDP security, breach and retention duties take over. Investigations that run across the switch-over should meet both standards.
Privacy and evidence pull in the same direction. The disciplines that the DPDP Act rewards, such as a defined scope, forensic collection, access logs and minimal copying, are the same ones that make electronic evidence admissible under section 63 of the Bharatiya Sakshya Adhiniyam. An over-broad grab of data is both a privacy risk and a weaker evidential record.
Cross-border reviews add a third layer. The DPDP Act takes a negative-list approach to transfers out of India: they are allowed unless the government restricts a destination by notification, and stricter sectoral rules still apply. If staff or systems are in the EU, the GDPR's employment and transfer rules apply too. See our guide on cross-border investigations.
How Spectra Forensics can help
Our digital forensics and eDiscovery team collects and reviews data with documented scope, hashing and chain of custody, inside fraud and whistleblower investigations. Speak to us in confidence.
Warning signs
Red flags
- An investigator asks for an employee’s personal phone password without consent or a court order.
- Whole mailboxes copied to an external reviewer with no date or custodian filter.
- No written purpose or scope at the start of the investigation.
- Monitoring or BYOD policies that do not mention investigations.
- Investigation data stored in personal drives or shared by messaging apps.
- Copies held by former advisers that nobody has asked to be returned or deleted.
Checklist
What good looks like
- A written scope that names the allegation, custodians, systems and date range.
- Policies that tell employees company systems may be reviewed for investigations.
- Forensic images with hash values and a chain-of-custody record for every device.
- A review platform with role-based access and access logs.
- A retention decision at closure, recorded, with deletion confirmed by advisers.
- A breach plan that covers investigation data, with the 72-hour report built in.
- Separate legal advice before any transfer of investigation data out of India.
Myths and corrections
Common misreadings
Misreading
The DPDP Act stops employers investigating employees.
Better reading
The Act recognises processing for employment purposes and exempts processing for investigating offences or contraventions of law from most obligations. It regulates how the investigation handles data, not whether it can happen.
Misreading
The investigation exemption switches off the whole Act.
Better reading
The s.17(1) exemptions expressly leave s.8(1) and the security duty in s.8(5) in place. A careless leak of investigation data is still a breach.
Misreading
The DPDP Act is fully in force, with penalties of up to ₹250 crore.
Better reading
Only the definitions and the Data Protection Board provisions took effect on 13 November 2025. Most obligations and the penalty schedule commence 18 months later, around May 2027. Until then the IT Act and its 2011 rules continue to apply.
Misreading
Anything on a company network is fair game.
Better reading
Ownership of the system helps, but purpose, proportion and policy still matter, and accessing a personal account or device without authority can be an offence under the IT Act.
For the board pack
Takeaways
- 01Investigations remain lawful; what changes is the discipline around purpose, minimisation, security and retention.
- 02The security duty survives the investigation exemption, so protect investigation files like any sensitive dataset.
- 03Most DPDP obligations commence around May 2027; use the time to fix policies and breach plans.
- 04Personal devices and accounts need consent or legal process; company systems need a clear policy.
Questions we are asked
When do the DPDP Act’s main obligations take effect?
The Rules were published on 13 November 2025. Definitions and the Data Protection Board provisions took effect then; consent-manager provisions follow after one year; most other obligations, including notice, consent, legitimate uses, security, breach notification and penalties, commence 18 months after publication, around May 2027.
Do we need employee consent to review their work email?
Not usually. Section 7(i) allows processing for employment purposes, including protecting the employer from loss or liability, and section 17(1)(c) exempts processing for investigating contraventions of law from most obligations. A clear policy that company email may be reviewed makes the position much stronger.
What happens to section 43A of the IT Act?
Section 44(2) of the DPDP Act omits section 43A and the rule-making power under which the 2011 sensitive personal data rules were made. That sub-section is in the 18-month tranche, so section 43A continues to apply until then.
Sources
This guide is general information on the law as stated above, not legal advice. Facts change outcomes; take advice on your own matter.
Go deeper
Further reading
Regulation8 Oct 2026
The DPDP Act 2023 and DPDP Rules 2025: What Changes for Workplace Investigations
How the DPDP Act and Rules 2025 affect internal investigations: legitimate use for employment, the s. 17 exemptions, breach reporting and preparing for 2027.
Digital forensics20 Sept 2026
Preserving Digital Evidence in Internal Investigations: Imaging, Hashing and Chain of Custody
A practical guide to preserving laptops, phones, email and cloud data in an internal investigation so the evidence stays reliable, lawful and usable in court.
Whistleblowing3 Aug 2026
How to Investigate a Whistleblower Complaint: A Step-by-Step Guide for Indian Companies
A practical, step-by-step guide to investigating whistleblower complaints in India: triage, independence, evidence, interviews, DPDP and reporting.
Confidential consultation
Facing this question on a live matter? Talk to us.
Tell us what has happened. A senior member of our team will help you work out who must do what, and in what order, in strict confidence.