Almost every organisation monitors its computers in some way: antivirus scans, blocked websites, USB controls, sometimes screenshots. Until recently, few people asked whether this was allowed. India’s Digital Personal Data Protection Act changes that. Monitoring data such as logs, screenshots and activity records tied to a person is personal data, and the Act sets rules for how you collect and handle it.
The good news is that the DPDP Act does not ban employee monitoring. It asks you to do it for a clear reason, tell people about it, and look after the data properly. This article explains what that means in practice.
The short answer
Yes, you can monitor company devices for legitimate purposes such as security and preventing data leaks. The Act expects you to do it for a clear purpose, tell people about it, collect only what you need, protect what you collect, and keep it only as long as necessary.
Where the DPDP Act stands today
Parliament passed the Digital Personal Data Protection Act in 2023. The DPDP Rules were notified in November 2025, and most obligations come into force in phases over the following 18 months. The time to get ready is now, before enforcement begins.
In the Act’s language, your organisation is the Data Fiduciary: it decides why and how personal data is processed. Each employee is a Data Principal: the person the data is about.
Do you need employee consent?
Not always. Section 7 of the Act lists “certain legitimate uses” where personal data can be processed without consent. Section 7(i) covers processing for the purposes of employment, or to safeguard the employer from loss or liability. Its examples include preventing corporate espionage and keeping trade secrets, intellectual property and classified information confidential.
Security monitoring of company devices usually fits here. But “no consent needed” does not mean “no rules”. The purpose must be genuine, the monitoring must be proportionate to it, and your other duties under the Act still apply.
Where monitoring goes beyond that purpose, consent is the safer basis. Examples are optional productivity tracking, personal devices (BYOD) and personal accounts. Under the Act, consent must be free, specific, informed, unconditional and unambiguous, and employees must be able to withdraw it as easily as they gave it.
What the law expects from you
- A clear purpose. Write down why you monitor (security, leak prevention, compliance) and monitor for that, not “everything, just in case”.
- Transparency. Tell employees what is monitored, why, and who can see it. A written monitoring notice is the simplest way.
- Data minimisation. Collect what the purpose needs. Capturing a screenshot only when a policy is triggered is easier to justify than recording every screen all day.
- Reasonable security safeguards. Protect monitoring data with access control and encryption. Failing to take reasonable safeguards against a breach can attract penalties of up to ₹250 crore.
- Retention limits. Delete data once its purpose is served, and set a retention period for each type of data.
- Employee rights. Employees can ask what you hold about them, and ask for correction and erasure. They can also raise a grievance. You need a way to answer for one person, not just “we delete everything after 90 days”.
- Breach notification. If monitoring data leaks, you must inform the Data Protection Board and the affected people.
The question most monitoring tools can’t answer
“Who has looked at my screen recordings?” Monitoring data is itself personal data. If any administrator can browse screenshots and activity logs without leaving a trace, you cannot show the data was used only for its purpose. Restrict who can see monitoring evidence, and record every time someone views it.
A practical checklist
- List everything you monitor today, device type by device type.
- Map each item to a purpose. Stop collecting anything that has none.
- Choose the basis for each: legitimate use under Section 7(i) for security monitoring, consent for anything optional.
- Publish a monitoring notice, and keep a record that each employee received it.
- Limit access to monitoring data to the people who need it, and log every view.
- Set retention periods and automate deletion.
- Set up a process for employee requests (access, correction, erasure), with legal holds for open investigations.
- Keep monitoring data inside your own infrastructure where you can, so fewer parties ever process it.
- Write a breach response plan, and test it.
How GarudView helps
We built GarudView for organisations whose data has to stay in-house. No tool can make you compliant on its own; your policies and people do that. But the right tool makes the checklist above practical:
- Monitoring notices and consent records, modelled on the DPDP lawful bases.
- Per-person data export and erasure, with legal holds that block erasure during an investigation.
- Every view of monitoring evidence recorded: who looked at whose screen, and when.
- A tamper-evident audit trail.
- Screenshots captured when a policy is triggered, not all day.
- Runs entirely on-premise, so monitoring data never passes through our servers.
Want to see how this works on your own fleet?