Do we need employees’ consent to process their personal data under the DPDP Act?

Not always. Section 7 of the Digital Personal Data Protection Act, 2023 treats processing for the purposes of employment, or to safeguard the employer from loss or liability, as a “legitimate use” that does not need consent. Notice, security, retention and other duties still apply from 13 May 2027.