New Staff, Client Data: Employee Data Protection Training Under DPDP

New hires get access on their first day. By the end of the week, a client's PAN scan sits on a personal phone, and the office password is written on a sticky note. That is how staff data protection goes wrong in small firms, and it rarely involves bad intent.

Employee data protection training under DPDP is a routine. You run it when someone joins, changes role or leaves. It answers three questions for each person: what they may see, where they may keep it, and who they call when something goes wrong. If you have not mapped your data yet, start with the 10 practical DPDP steps for small firms.

Does DPDP require staff training?

The DPDP Rules, 2025 bring the main duties into force from about 13 May 2027, unless the government shortens the period. The Act and Rules do not name a training course for an ordinary firm. The firm still answers for personal data its staff handle, whatever device they use (section 8(1)).

Training is the practical way to make the safeguards real for staff. The Act expects reasonable security safeguards for all personal data (section 8(5)), and a rule that staff have never heard is not a safeguard.

Six mistakes, each with a fix

1. Training happens once, on the first day. The new hire hears the rules, signs a form and never hears them again. Fix it with a short refresher each year, and a note whenever a client's data rules change.

2. Everyone shares one office login. When a client asks who opened the file, nobody can answer. Fix it with one login per person, and access only to the clients each person works on.

3. Client files live on personal phones. A file on a staff phone sits outside the firm's control. Fix it by moving the file into the client's folder, then removing the phone copy. The personal phone problem has more detail. Statutory records still need to be kept.

4. Nobody is named for privacy questions. Clients will ask what data the firm holds. Rule 9 of the DPDP Rules requires the contact of a person who can answer those questions to be published. Fix it with one named person and one email address.

5. Leavers keep their access. A person who leaves still has the login, the WhatsApp group and the phone copies. Fix it with an exit checklist for the last day: remove logins, recover files, check personal devices.

6. Nobody has rehearsed a breach. Affected people must be told promptly in plain language. The Data Protection Board must be told without delay, with full details within 72 hours, unless it allows longer. Fix it with a one-page plan that says who decides, who calls and where the logs sit. Then run a short drill once a year.

The routine, in one list

Use this list each time someone joins, changes role or leaves:

• Day one: the firm's data rules, the phone rule and the breach contact.
• First week: one login each, and access only to assigned clients. Pair this with the new-joiner paperwork list.
• Every open: access logs kept for at least one year. Rule 6 of the DPDP Rules, 2025 lists access control and logging among the safeguards.
• Each year: a refresher, and a check of who still has access.
• On exit: logins removed, files recovered, personal devices checked.

Keep staff off personal phones

Training changes habits. A system changes the default. Reposha is DPDP-ready document management for professional firms, and it is a secure client document service. Each Client gets a folder. Only staff with access to that Client can open its files. Every open and download is logged, so the question "who saw this file?" has an answer. Clients upload from a phone or laptop with no account, on pages in English or Hindi. Retention can be set to 6 months, 1 year or 3 years.

Learn how the client folder works at reposha.com.

Questions people ask

General information only, not legal, tax or financial advice. Rules and dates change, so confirm before acting.

Written by Premanshu, Founder, PreceptsAI