92. Digital Personal Data Protection Act (DPDP) – Legitimate Use, Employment Purpose & Consent

#HRhelpdesk #IndiaHRGuide #MandeepSingh, Once we understand what personal data is, the next critical question is simple: when is an organisation actually allowed to use it? Does every use of employee or candidate data qualify automatically or does the law draw a clear line? In this episode, Mandeep Singh explains the core context of the Digital Personal Data Protection Act by focusing on one central idea: personal data can only be collected, processed, or retained for legitimate use or with explicit consent. He clarifies that employment purpose is a subset of legitimate use, but not everything HR does automatically falls under it. The discussion walks through what employment purpose really means: entering into an employment relationship, sustaining it through the employee lifecycle, meeting statutory and contractual obligations, and managing employment‑related risk. Using practical HR examples, Mandeep explains why data such as date of birth is legitimately collected to verify age or statutory thresholds, but how using the same data for activities like birthday greetings does not qualify as employment purpose and therefore requires consent. He highlights how small, routine HR actions often cross this boundary without being noticed. A key illustration in this episode is recruitment. Mandeep explains how resumes flow across multiple email IDs inside organisations, often far beyond employment decision‑makers, creating situations where personal data cannot be fully controlled, deleted, or safeguarded. The episode shows how DPDP principles directly impact everyday HR practices, especially how organisations collect, share, retain, and protect personal data.