Is employee monitoring legal in India?

The short answer

India has no law that specifically bans or licenses employee monitoring. Businesses commonly monitor company-owned PCs, email and networks for security and productivity. What has changed is that India now has a general data protection law, the Digital Personal Data Protection Act, 2023 (DPDP Act), which sets rules for how any organisation handles personal data, including data about its own employees.

So the real question isn’t “is it allowed?” but “am I doing it in a fair, open and limited way?” Most of the risk comes from secret monitoring, monitoring personal devices or accounts, or collecting far more than you need.

What the DPDP Act means for employers

Under the DPDP Act, an employer that decides what employee data to collect and why is a data fiduciary. A monitoring software company that stores the data for you, like TraqDesk, processes it on your behalf.

A few points matter most for monitoring:

• A lawful basis. Personal data can be processed with consent, or for certain “legitimate uses” listed in the Act. These include purposes of employment and protecting the employer from loss or liability, such as preventing corporate espionage and keeping trade secrets confidential. Lawyers differ on how far this employment ground stretches, so many employers also get written acknowledgement from staff.
• Purpose limitation. Use monitoring data for the reason you collected it, such as security, attendance or productivity, and not for unrelated things.
• Reasonable security. You must protect the data you collect, for example with limited access, strong passwords and two-step sign-in.
• Deleting data you no longer need. Don’t keep screenshots and activity logs forever.
• Employee rights. Employees may have rights to information about, correction of and grievance over their personal data.

The DPDP Rules were notified in November 2025, and the Act is coming into force in stages. Check with your lawyer which obligations already apply to your business.

Privacy as a constitutional right

In 2017 the Supreme Court recognised privacy as a fundamental right (Justice K.S. Puttaswamy v. Union of India). That case was about the government, not private employers, but its ideas of a legitimate aim, necessity and proportionality are a good test for any monitoring: Is there a real reason? Is this the least intrusive way to achieve it? Is it limited to what’s needed?

What’s usually fine, and what to avoid

Generally reasonable on company-owned PCs, with written notice:

• Seeing which apps and websites are used during work hours
• Active and idle time, and attendance from PC activity
• Live screen viewing and screenshots for security or supervision
• Alerts when a pen drive is plugged in
• Blocking sites that aren’t needed for work

Higher risk, or best avoided:

• Secret monitoring that employees haven’t been told about
• Keystroke logging and capturing passwords (TraqDesk doesn’t do this)
• Reading personal email, chats or bank accounts, even if opened on a work PC
• Monitoring personal phones or laptops without clear, written agreement
• Monitoring outside working hours on devices staff also use personally
• Sharing monitoring data with people who don’t need it

What about work-from-home staff on personal PCs?

This is where the risk is highest, because a personal computer also holds family photos, personal banking and private chats. If you can, give remote staff a company laptop and monitor only that. If staff must use their own PC, take legal advice, get clear written agreement first, limit monitoring to working hours, and be ready for them to say no. See our guide to monitoring work-from-home employees.

Compliance checklist for Indian employers

1. Monitor company-owned devices only, unless you have legal advice and written agreement for anything else.
2. Write a monitoring policy that says what is monitored (screens, apps, websites, USB, attendance), why, who can see it and how long it’s kept.
3. Tell every employee in writing and get it acknowledged, in the offer letter, employment agreement or IT policy.
4. Collect only what you need. Turn off features you won’t use.
5. Limit who can see the data. Give each manager access to their own team only.
6. Protect admin accounts with two-step sign-in, and keep an audit log of who looked at what.
7. Set a retention period and delete older data automatically.
8. Name a contact employees can go to with questions or complaints about their data.
9. Review the policy once a year, and whenever the DPDP Rules or your monitoring change.

How TraqDesk supports responsible monitoring

TraqDesk is built for open workplace monitoring, not hidden spying. It doesn’t record keystrokes, and website tracking records only the site name, not page content. You can limit each manager to their own team with roles and permissions, protect every admin with two-step sign-in, see an audit log of admin actions, and choose how long data is kept before it’s deleted automatically. Read more in How it works: monitoring responsibly and our Privacy Policy.

This guide is general information about Indian law as we understand it in October 2026. It isn’t legal advice. Laws and rules change, so speak to a lawyer about your own situation.