Free policy template · Word

Data Privacy Policy

A data privacy policy explains how the company collects, uses, stores, shares and deletes personal data of employees, candidates and other individuals, in line with the Digital Personal Data Protection Act, 2023. It sets purposes, consent or legitimate uses, security, retention, rights requests and breach handling.

Editable Word (.docx)
Made for India
10 fill-in fields highlighted
Free, no sign-up

Download Word (.docx) — free

Preview of the policy

[Highlighted] = fill in

[Company Logo][Company Name]

DATA PRIVACY POLICY

Policy No.:: [Reference Number]
Version:: [Version Number]
Effective Date:: [Date]
Policy Owner:: [Privacy Officer / HR Head]

1. Purpose

[Company Name] respects the privacy of its employees, candidates and others whose personal data it handles. This policy explains how such data is processed lawfully, fairly and securely, in line with the Digital Personal Data Protection Act, 2023 and other applicable laws.

2. Scope

It applies to personal data of current and former employees, candidates, interns, contractors, nominees and dependants, processed by the company or by vendors on its behalf.

3. Definitions

Personal data: any data about an individual who is identifiable by or in relation to it.
Data principal: the individual to whom the data relates.
Data processor: a vendor that processes personal data on the company's behalf.
Personal data breach: unauthorised processing, loss or disclosure of personal data.

4. Policy

Personal data is collected only for specified purposes: recruitment, employment administration, payroll and benefits, statutory compliance (PF, ESI, tax), safety, and performance management.
Individuals receive a clear notice at the time of collection describing the data, purpose and how to contact us.
Only necessary data is collected. Aadhaar is collected as a masked copy (last 4 digits) unless a law requires the full number.
Health and other sensitive information is accessed only by authorised HR staff.
Data is shared with processors only under written agreements requiring security and confidentiality.
Data is kept as per the retention table below and then deleted or anonymised.
Individuals may request access, correction or erasure, or raise a grievance, by writing to [Privacy Email]; requests are answered within [Number] days.
Personal data breaches are handled under the Information Security Policy and notified to the Data Protection Board and affected individuals as required.

Data Category	Purpose	Retention
Candidate CVs (not hired)	Recruitment	[Number] months
Employee master and payroll records	Employment, statutory compliance	[Number] years after exit
Medical certificates	Leave, insurance	[Number] years
CCTV footage	Security	[Number] days

5. Procedure

HR maintains a register of HR data processing activities.
New tools or vendors handling personal data are reviewed by the Privacy Officer before use.
Retention reviews are carried out every [Number] months.

6. Responsibilities

Privacy Officer: oversee compliance and requests.
HR and managers: handle personal data only for stated purposes.
IT: security controls.
Employees: keep their data updated and protect others' data.

7. Non-compliance

Unauthorised access to or disclosure of personal data is serious misconduct and will be dealt with under the Disciplinary Policy.

8. Review & Approval

This policy will be reviewed annually and whenever rules under the DPDP Act are notified or amended.

Approved by
[Authorised Signatory]
[Designation]
Date: [Date]

Acknowledged by
[Employee Name]
Date: [Date]

Download Word (.docx) — free

What this template includes

Categories of personal data — identity, contact, payroll, health, performance
Purposes of processing — employment, payroll, statutory compliance, safety
Notice and consent — what individuals are told and when
Data minimisation — masked Aadhaar, only needed fields
Retention schedule — how long each record is kept
Individual rights and grievance contact — access, correction, erasure

When to use it

Preparing HR processes for the Digital Personal Data Protection Act, 2023
Collecting Aadhaar, health or bank details from employees
Sharing employee data with payroll vendors, insurers or BGV agencies
Employees ask what data the company holds about them

How to customise this template

1Fill the data categories and retention table for your HR records
2Name the person responsible for privacy and the grievance contact
3List your data processors (payroll, HRMS, insurer, BGV)
4Align breach steps with your Information Security Policy
5Check the latest DPDP rules and timelines with legal counsel

HR tips

Collect only masked Aadhaar unless the full number is legally required
Sign data processing terms with every HR vendor
Restrict access to medical and salary records
Delete old candidate CVs on schedule

Obligations under the Digital Personal Data Protection Act, 2023 depend on the rules notified under it and their commencement. This template is a starting point; review it with a privacy or legal adviser before adoption.

For HR & hiring managers

Experienced and fresher candidates across India — blue, grey and white collar. Post a job in 5 minutes and start receiving applications.

Post a job free See plans

Post in 5 minutesDescribe the role in one line — we write the job description.
Verified applicantsEvery applicant has a verified mobile number.
Resume databaseSearch experienced candidates by skill, city and experience.

Frequently asked questions

Does the DPDP Act apply to employee data?+

Yes, the Act applies to digital personal data, including data of employees and candidates. It recognises certain legitimate uses for employment purposes, but notice, security and other duties still apply.

Should we collect a full Aadhaar copy from employees?+

Collect only what is necessary. For most HR purposes a masked Aadhaar showing the last four digits is enough; collect the full number only where a law specifically requires it.

How long should HR keep employee records?+

As long as needed for the purpose and as required by labour, tax and social security laws. Set a retention schedule and delete or anonymise records after it expires.

All 50 hr policies →

[Company Logo][Company Name]
HR POLICY MANUAL
Company:
[Company Name]
Document No.:
[Reference Number]
Version:
[Version Number]
Effective Date:
[Date]
Policy Owner:
[HR Name], Human Resources
Approved By:
[Authorised Signatory]
Chapter 1: Introduction
1.1 Purpose: This manual sets out the human resource policies, procedures and practices of [Company Name] so that employees are treated fairly and consistently and the company complies with applicable labour laws.
1.2 Scope: It applies to all employees on the company's rolls at all offices, plants and sites, including [Work Location]. Consultants, trainees and contract workers are covered where expressly stated.
1.3 Precedence: Where this manual conflicts with any law, certified standing order or individual appointment letter, the law and then the more favourable term for the employee will apply.
Chapter 2: Definitions
- Company: [Company Name] and its branches.
- Employee: any person employed on the company's rolls on a permanent, probationary or fixed-term basis.
- Reporting Manager: the person to whom an employee reports as per the organisation chart.
- HR: the Human Resources department or the person designated to perform the HR function.
- Wages / Basic Salary: as defined in the employee's appointment letter and applicable law.
Chapter 3: Employment
Policy · Word
HR Policy Manual
Download .docx
[Company Logo][Company Name]
LEAVE POLICY
Company:
[Company Name]
Policy No.:
[Reference Number]
Effective Date:
[Date]
Version:
[Version]
1. Purpose
This policy sets out the types of leave available to employees of [Company Name], how leave is earned, applied for and approved, and how unused leave is treated, so that employees can rest and attend to personal needs while business continuity is maintained.
2. Scope
This policy applies to all employees on the rolls of the company at all locations, including probationers, unless their appointment letter states otherwise. Where state laws, standing orders or settlements provide more favourable terms, those terms will prevail.
3. Definitions
Policy · Word
Leave Policy
Download .docx
[Company Logo][Company Name]
ATTENDANCE POLICY
Company:
[Company Name]
Policy No.:
[Reference Number]
Effective Date:
[Date]
Version:
[1.0]
Owner:
Human Resources
1. Purpose
This policy sets out how attendance is recorded at [Company Name], what is expected of employees regarding punctuality and absence, and how attendance issues will be handled fairly and consistently.
2. Scope
It applies to all employees on the company's rolls at all locations, including probationers and fixed-term employees. Contract workers follow this policy as applied by their contractor and site rules.
3. Definitions
Policy · Word
Attendance Policy
Download .docx
Policy · Word
Working Hours Policy
Download .docx
[Company Logo][Company Name]
OVERTIME POLICY
Policy No.:
[Reference Number]
Version:
[Version Number]
Effective Date:
[Date]
Policy Owner:
Human Resources
1. Purpose
This policy sets the rules for approving, recording and paying overtime (OT) at [Company Name] so that extra work is planned, fairly compensated and kept within legal and safe limits.
2. Scope
It applies to all employees and workers at [Work Location] whose role and wage level make them eligible for overtime under applicable law. Employees in managerial, supervisory or administrative grades [Grade List] are not paid OT but may receive compensatory off as set out in clause 4.6.
3. Definitions
Policy · Word
Overtime Policy
Download .docx
[Company Logo][Company Name]
WORK-FROM-HOME POLICY
Policy No.:
[Reference Number]
Version:
[Version Number]
Effective Date:
[Date]
Policy Owner:
Human Resources
1. Purpose
[Company Name] is an office-first organisation. This policy allows employees to work from their residence on an occasional basis while ensuring business continuity, availability and protection of company information.
2. Scope
It applies to confirmed employees at [Work Location] whose work can be done remotely. Roles requiring physical presence, such as reception, facilities, plant and field service, are excluded. This policy does not cover permanent remote or hybrid arrangements, which are governed by separate policies.
3. Definitions
Policy · Word
Work-from-Home Policy
Download .docx
[Company Logo][Company Name]
REMOTE WORK POLICY
Policy No.:
[Reference Number]
Version:
[Version Number]
Effective Date:
[Date]
Policy Owner:
Human Resources
1. Purpose
This policy sets out the terms on which [Company Name] engages employees who work permanently from a location other than a company office, so that remote employees are productive, connected, secure and treated equally with office-based colleagues.
2. Scope
It applies to employees whose appointment letter or a written amendment designates them as 'Remote', with a specified Remote Work Location in India. Occasional work from home and hybrid arrangements are covered by separate policies.
3. Definitions
Policy · Word
Remote Work Policy
Download .docx
[Company Logo][Company Name]
HYBRID WORK POLICY
Policy No.:
[Reference Number]
Version:
[Version Number]
Effective Date:
[Date]
Policy Owner:
Human Resources
1. Purpose
[Company Name] follows a hybrid model that combines in-person collaboration with focused remote work. This policy sets a clear, common rhythm so teams get the benefit of both.
2. Scope
It applies to all employees in hybrid-eligible roles at [Work Location]. Roles marked 'on-site' (facilities, reception, labs, plant) and roles designated 'remote' are excluded.
3. Definitions
Policy · Word
Hybrid Work Policy
Download .docx