Can GDPR’s Contractual-Necessity Standard Help Determine How Far Employers May Process Employee Personal Data?
Prepared by: Shubhank Suman, AI, Privacy, and IP Counsel
I. The Question- Can GDPR Necessity Define The Limits Of “Employment Purpose”
The GDPR allows an employer to rely on the employment contract only where the processing is objectively necessary for its performance. Processing that is merely convenient or commercially useful must find another lawful basis. On the other hand, Section 7(i) of India’s DPDP Act, 2023 takes a broader approach. It permits employee data to be processed without consent for “the purposes of employment,” for safeguarding the employer from loss or liability, and for providing a service or benefit sought by an employee. However, the Act does not define what constitutes a “purpose of employment” or expressly state how closely the processing must be connected with the employment relationship. Read too widely, the provision could therefore be treated as covering almost any processing involving an employee or occurring in the workplace. Purpose specification and data-minimization principles can help guard against such an expansive reading, but they do not remove the need to define the proper limits of “purposes of employment” itself.
This note asks whether the GDPR’s necessity-based reasoning can help define the limits of Section 7(i), whether “purposes of employment” extends to every workplace-connected use of employee data, and whether the distinction sometimes drawn between the GDPR as a privacy law and the DPDP Act as merely a data-protection law is sustainable. The following illustrations show how these questions
arise in practice
Scenario | Position under the GDPR | Position under the DPDP Act |
|---|---|---|
Salary payment: Bank details are collected to pay salary. | Generally covered by contractual necessity. The details are required to perform the employer’s payment obligation. Statutory deductions may instead rely on legal obligation. | Clearly covered by Section 7(i). Paying salary is a core employment purpose. |
Facial recognition for attendance: Biometrics are used even though access cards would work. | Not automatically necessary. The employer must justify using biometric data instead of a less intrusive method and satisfy the additional rules for special-category data. | Attendance is an employment purpose, but facial recognition is not automatically justified. Section 7(i) may cover the purpose without necessarily approving the chosen technology. |
Continuous monitoring: Screens and internet activity are monitored to protect confidential information. | Contractual necessity is unlikely. Legitimate interests may support targeted and proportionate monitoring, but not necessarily continuous surveillance of every employee. | Targeted monitoring may be covered. Section 7(i) expressly recognizes protection against loss and breaches of confidentiality or intellectual property. Blanket surveillance is harder to justify. |
Employee profile on a public website: A law firm publishes a partner’s profile, or a company uses a finance employee’s photograph in an advertising campaign. | Focuses on the employee’s contractualrole. A partner’s profile may be necessary for client-facing work because it helps clients identify and engage the lawyer. Publishing a finance employee’s photograph is unlikely to be necessary for performing the finance role, whether it appears on the company website or social media. Article 6(1)(b) would therefore not apply merely because the employer considers the publication useful. Another lawful basis must be identified. | The focus is on the nature and purpose of the use. Publishing a law-firm partner’s photograph and professional profile may fall within Section 7(i) where it identifies the partner to clients and supports the firm’s delivery of legal services. Similarly, including a finance employee on the company’s “Our Team” page may qualify where the page simply presents the organization and its workforce. However, reusing the finance employee’s photograph in a Facebook campaign to promote the company or another brand serves a separate marketing purpose. That use would require its own lawful basis, ordinarily consent under Section 6, or Section 7(a) |
II. How Should “Purposes Of Employment” Be Understood?
Section 7(i) does not require an employer to show that processing is strictly necessary to perform the employment contract. Its language is wider. It covers processing for:
1. the purposes of employment; 2. safeguarding the employer from loss or liability; and 3. providing a service or benefit sought by an employee.
The provision gives employers enough flexibility to carry out ordinary employment functions without repeatedly seeking consent. Salary payment, attendance, performance management, workplace access, employee benefits and disciplinary processes would ordinarily fall within it. Targeted processing to protect confidential information, trade secrets or intellectual property is also expressly recognized. The difficulty is that the Act does not define “purposes of employment.” If the expression is read too widely, an employer could treat almost any use of employee data as employment-related simply because the individual works for the organization.
That cannot be the correct approach. The words “for the purposes of employment” must impose a real limit. The employer should be able to identify the particular employment purpose and explain how the processing supports that purpose. A vague label such as “HR purposes,” “business requirements” or “workplace operations” should not be enough. The relevant question is:
Is the data being processed because of a genuine employment need, or is the employer merely using data that it happens to possess because the individual is an employee?
The distinction is clear in some cases. Bank details are used because the employer must pay salary. Attendance records are kept because the employer must administer working hours. These are genuine employment purposes. By contrast, using an employee’s photograph to promote an unrelated product or sharing salary details with a bank for unsolicited marketing does not administer or protect the employment relationship. In those cases, employment merely gives the employer access to the data.
III. Section 7(i) Should Not Become A Route Around Section 6
Section 6(1) requires consent to be given for a specified purpose and limits that consent to personal data necessary for that purpose. Its statutory illustration makes the point clearly: consent to use a telemedicine service does not justify access to the individual’s contact list when that information is unnecessary for providing the service.
This requirement applies directly to processing based on consent. Section 7(i), by contrast, does not expressly say that an employer may process only the data necessary for an employment purpose. Even so, the two provisions should be read coherently. Section 7(i) should not allow an employer to avoid the restrictions in Section 6 simply by describing the processing as employment-related.
Otherwise, the Act would produce an unusual result: an employer relying on consent would be limited to the data necessary for a specified purpose, while an employer processing without consent under Section 7(i) could collect and use employee data without any comparable limit.
The better reading is that Section 7(i) removes the need to obtain consent for a genuine employment purpose. It does not remove the need to:
- identify that purpose clearly;
- process data relevant to that purpose;
- avoid unnecessarily intrusive methods; and
- reassess the lawful basis if the data is later used for another purpose.
In other words:
Section 7(i) changes the ground of processing, not the need for discipline in how employee data is used.
This does not mean that Section 6 technically applies to Section 7(i). It means that the Act should not be interpreted so that processing without consent is less controlled than processing undertaken with consent.
IV. A Valid Employment Purpose Does Not Justify Every Method
The employer must distinguish between the purpose of processing and the method used to achieve it.
Attendance is a purpose of employment. But it does not follow that the employer may use any attendance technology it chooses. An access card, fingerprint scanner, facial-recognition system and continuous location-tracking application all record attendance, but they differ greatly in the amount and sensitivity of data processed.
Section 7(i) may support the purpose of recording attendance. The employer should still explain why the particular data and technology are reasonably required for that purpose. If an access card works effectively, the employer should not assume that facial recognition is justified merely because both systems serve an employment function.
Monitoring raises the same issue. Section 7(i) expressly covers processing to safeguard the employer from loss or liability and to protect confidential information, trade secrets and intellectual property. This may justify examining access logs after an unusual download or reviewing work communications during a specific investigation.
It does not necessarily justify recording every employee’s screen and internet activity throughout the working day. A targeted investigation responds to an identified risk. Continuous monitoring of the entire workforce is much broader and requires substantially stronger justification.
A practical assessment should therefore ask:
1. What specific employment or protective purpose is being pursued? 2. What personal data is actually relevant to that purpose? 3. Is the processing targeted, or does it apply indiscriminately to all employees? 4. Could the purpose reasonably be achieved through a less intrusive method? 5. Will the data be used only for that purpose, or reused for another activity?
These questions do not import the GDPR’s contractual-necessity test into Section 7(i). They simply prevent a valid employment purpose from becoming an unlimited justification for any form of processing.
V. The Purpose Must Be Reassessed When The Use Changes
An employment purpose does not permanently attach to the data. The same information may fall within Section 7(i) for one use but require another lawful basis for a later use.
An employee photograph illustrates this distinction.
Publishing a law-firm partner’s photograph and professional profile may fall within Section 7(i) because it allows clients to identify the partner, understand the partner’s experience and engage the firm’s legal services. Including a finance employee on a genuine “Our Team” page may also arguably serve the employment-related purpose of presenting the organization and its workforce.
The position changes if the finance employee’s photograph is later used in a Facebook campaign to promote the company or another brand. The photograph remains the same, but the purpose has changed. The use is no longer about identifying the organization’s workforce. It is advertising.
The employer must therefore identify a separate lawful basis for the promotional use. This would ordinarily be consent under Section 6. Section 7(a) may apply only where the employee voluntarily provided the photograph for that specific promotional purpose and did not indicate that the employee did not consent to its use. A photograph supplied for an identity card, staff directory or “Our Team” page has not automatically been provided for a social-media advertisement.
The same reasoning applies to salary information. The employer may process salary details for payroll under Section 7(i). If an employee applies for a loan and asks the employer to verify salary, that disclosure may fall within the provision concerning a benefit sought by the employee. But transferring salary and contact details to a bank so that it can market loans to the entire workforce serves a different purpose.
The rule is simple:
A lawful employment use does not automatically authorize every later use of the same data. A material change in purpose requires a fresh assessment of the lawful basis.
VI. What Role Should GDPR Necessity Play?
The GDPR’s necessity test should not be imported into Section 7(i) as an unwritten legal requirement. Parliament did not say that employee-data processing must be “necessary for the performance of the employment contract.”
The GDPR is nevertheless useful as a standard of restraint. It requires the employer to distinguish between processing that genuinely supports the employment relationship and processing that is merely useful for another business objective.
Applied to Section 7(i), necessity helps uncover three problems:
- An unrelated purpose: An employee photograph collected for a staff page is reused for advertising.
- An excessive method: Facial recognition is used for attendance when a less intrusive system would work.
- A false employment justification: Employee data is shared for third-party marketing and described as an employee benefit.
The GDPR’s necessity reasoning therefore informs the analysis without controlling it. Under the GDPR, necessity determines whether the employer may rely on the contract as the lawful basis. Under Section 7(i), the primary question is whether the activity genuinely serves an employment purpose. Necessity then helps assess how far the employer should be allowed to go in pursuing that purpose.
Section 7(i) is broader than contractual necessity, but its breadth concerns the range of legitimate employment activities. It should not be treated as permitting unlimited data collection, intrusive methods or unrelated reuse.
VIII. Conclusion
Section 7(i) gives employers a broad but limited ground for processing employee data without consent. It covers genuine employment functions, protection of the employer and services or benefits sought by employees. It does not cover every activity involving employee data. The employer should be required to establish three things:
1. A specific and genuine employment purpose: The purpose must arise from, support or protect the employment relationship. 2. A reasonable connection between the data and the purpose: The data and method used should not go beyond what the identified purpose reasonably requires. 3. A fresh basis for a new purpose: Advertising, third-party marketing or any materially different reuse must be assessed separately.