A recruiter uploads a candidate resume, the HRMS syncs it with an assessment platform, payroll needs PAN and bank details, and the background-verification vendor asks for address proof. In that quiet data trail, three questions decide whether the company is acting responsibly: did the person know and agree, how long will the data stay, and who else can access it?
People data means identifiable data about candidates, employees, contractors, gig workers, interns and alumni.
Consent is not a blanket HR form. It must be specific, informed and linked to a clear purpose.
Retention means keeping data only as long as business, legal or compliance needs justify it.
Transfer means sharing or giving access to people data across vendors, group companies, countries or systems.
The practical framework is: notice - purpose - minimisation - retention - transfer control - deletion.
Under India's DPDP Act, 2023, the individual is the Data Principal and the organisation deciding purpose is the Data Fiduciary.
The biggest interview trap is treating consent as enough, while ignoring retention schedules and vendor contracts.
Big Picture: People Data Has a Lifecycle, Not a Filing Cabinet
Most weak answers discuss privacy as a policy document. Strong answers treat people data as a lifecycle: it is collected for a purpose, used under controls, retained for a justified period, transferred only with safeguards, and deleted or anonymised when the purpose ends.
People data governance narrows broad collection into controlled use, justified storage and safe disposal.]
<h2>Core Explanation: The Three Decisions HR Must Get Right</h2>
<p><strong>People data</strong> includes resumes, interview notes, salary, attendance, biometrics, medical declarations, performance ratings, grievances, background checks, learning records and exit documents. The sensitivity varies, but the logic is the same: if a person can be identified, the organisation must handle the data deliberately.</p>
<p>The three most interview-relevant decisions are:</p>
<ol>
<li><strong>Consent:</strong> Can we collect and use this data for this purpose?</li>
<li><strong>Retention:</strong> How long should we keep it after the purpose is served?</li>
<li><strong>Transfer:</strong> Can we share it with another system, vendor, group company or country?</li>
</ol>
[[FIGURE: {"layout":"hub","centre":{"label":"Lawful People Data"},"items":[{"label":"Consent","note":"Clear permission"},{"label":"Retention","note":"Keep only needed"},{"label":"Transfer","note":"Control access"},{"label":"Rights","note":"Enable requests"}]} | caption: Lawful people-data handling is the balance of permission, time limit, transfer control and individual rights.]
<h2>Consent: Permission Must Be Specific, Not Cosmetic</h2>
<p>Consent is the person's informed agreement to a defined use of their data. In HR, consent often appears during candidate application, onboarding, background verification, benefits enrolment, medical insurance and employee engagement tools.</p>
<p>A good consent mechanism answers four questions in plain language:</p>
<check-list
data-items='[
"What data is being collected, such as resume, ID proof, bank details or health declaration?",
"Why it is being collected, such as hiring, payroll, compliance, benefits or security?",
"Who will access it, such as HR, payroll vendor, BGV partner or group company?",
"How long it will be kept and how the person can exercise their rights?"
]'>
</check-list>
<p>In India, the Digital Personal Data Protection Act, 2023 makes this especially important because the individual is not just an employee in HR language; they are a <strong>Data Principal</strong> with rights over their personal data. The organisation deciding why and how data is processed is the <strong>Data Fiduciary</strong>.</p>
<tip-box data-type="info" data-title="Example - Naukri and Candidate Consent" data-icon="📌">
<p>Naukri, operated by Info Edge, is a clear Indian example because candidates voluntarily upload resumes and make choices about visibility to recruiters. The privacy issue is not merely collection; it is whether the candidate understands profile visibility, recruiter access and communication preferences. The strategic so what: recruitment platforms win trust when candidate control supports the marketplace, not when data is treated as an unlimited asset.</p>
</tip-box>
<h2>Retention: If You Cannot Justify Keeping It, Plan to Delete It</h2>
<p>Retention is the time period for which personal data is stored before deletion, anonymisation or archival. HR data cannot be deleted randomly because employment laws, tax rules, payroll records, dispute handling and audit requirements may require storage. But it also cannot be kept forever simply because storage is cheap.</p>
<p>A practical retention schedule classifies people data by purpose:</p>
<data-table
data-headers='["People Data Type", "Typical Purpose", "Retention Logic"]'
data-rows='[
["Unsuccessful candidate resume", "Hiring evaluation and future role consideration", "Keep only for a stated period or talent-pool purpose, then delete or refresh consent."],
["Employee payroll records", "Salary processing, tax and statutory compliance", "Retain as required by applicable labour, tax and accounting obligations."],
["Performance records", "Promotion, appraisal, capability building and dispute defence", "Retain while employment relevance or legal risk exists, then archive or delete."],
["Medical or insurance data", "Benefits administration and workplace accommodation", "Apply stricter access controls and shorter purpose-linked retention."],
["Exit and settlement documents", "Full and final settlement, references and claims handling", "Retain for statutory and dispute limitation needs, then purge."],
["Access logs and monitoring records", "Security, fraud prevention and investigation", "Keep proportionate to risk and documented investigation need."]
]'>
</data-table>
<p>The managerial test is simple: <strong>Can HR explain why this data is still needed today?</strong> If not, the retention period is probably too long.</p>
<h2>Transfer: Sharing Data Creates a New Risk Surface</h2>
<p>A transfer happens when people data moves to, or becomes accessible by, another party. This includes payroll vendors, background-verification firms, assessment platforms, HRMS providers, insurers, group companies, cloud providers and cross-border support teams.</p>
<p>Good transfer governance asks: who receives the data, why, under what contract, with what security controls, in which geography, and with what deletion obligation?</p>
[[FIGURE: {"layout":"flow","items":[{"label":"Need","note":"Why transfer?"},{"label":"Recipient","note":"Who gets access?"},{"label":"Contract","note":"DPA and limits"},{"label":"Security","note":"Access and audit"},{"label":"Exit","note":"Return or delete"}]} | caption: A safe data transfer is a controlled decision chain, not an email attachment with employee files.]
<p>For cross-border transfers, the answer depends on the applicable law. Under India's DPDP Act, personal data may be transferred outside India unless the government restricts transfers to certain countries by notification. Under GDPR, international transfers need recognised safeguards such as adequacy decisions, Standard Contractual Clauses or similar mechanisms.</p>
<h2>Definitions You Should Say Cleanly</h2>
<tip-box data-type="info" data-title="Precise Definitions" data-icon="📘">
<ul>
<li><strong>DPDP Act, 2023 - Personal data:</strong> “Any data about an individual who is identifiable by or in relation to such data.”</li>
<li><strong>DPDP Act, 2023 - Data Principal:</strong> The individual to whom the personal data relates.</li>
<li><strong>DPDP Act, 2023 - Data Fiduciary:</strong> The person who determines the purpose and means of processing personal data.</li>
<li><strong>GDPR Article 5(1)(e) - Storage limitation:</strong> Personal data is kept “no longer than is necessary” for its processing purposes.</li>
<li><strong>Data transfer:</strong> Giving another party or geography access to personal data under defined purpose, contract and security controls.</li>
</ul>
</tip-box>
<h2>Governance Metrics: How HR Knows the System Is Working</h2>
<p>Privacy governance must be measurable. In interviews, this is where you sound managerial instead of theoretical.</p>
<data-table
data-headers='["Metric", "Formula or Definition", "What Good Looks Like"]'
data-rows='[
["Consent coverage", "Records with valid consent or lawful basis divided by total records processed.", "Close to 100 percent for consent-based processing; gaps should trigger remediation."],
["Retention breach rate", "Records kept beyond approved retention period divided by total eligible records.", "Very low and trending down; any breach in sensitive data needs urgent review."],
["Data subject request SLA", "Requests closed within legal or internal timeline divided by total requests.", "High compliance, ideally near 100 percent within the committed timeline."],
["Vendor DPA coverage", "Active people-data vendors with signed data processing terms divided by total people-data vendors.", "100 percent for vendors handling identifiable people data."],
["Access review completion", "Systems reviewed for role-based access divided by total in-scope systems.", "Quarterly or defined-cycle completion should be close to 100 percent."],
["Deletion completion rate", "Records deleted or anonymised on schedule divided by records due for deletion.", "High completion with exceptions documented and approved."]
]'>
</data-table>
<h2>Case Study: Zoho People and Privacy-by-Design in HR SaaS</h2>
<tip-box data-type="info" data-title="Case Study - Zoho People" data-icon="🏆">
<p>Zoho People shows how a cloud HRMS must make consent, retention and transfer operational, because it handles employee data for organisations across roles, systems and geographies.</p>
</tip-box>
[[GOLD-IMAGE: A modern HR operations desk with a laptop showing a generic people-management dashboard in deep blue and green tones, employee ID cards blurred in the foreground, no logos or readable text | caption: People-data privacy becomes real when everyday HR workflows move into cloud systems.
Situation: Zoho People is part of Zoho's broader suite and is used by organisations to manage HR workflows such as employee records, attendance, leave, performance and HR operations. In such a product, the privacy challenge is not one dramatic breach scenario; it is the daily movement of identifiable employee data through many modules, admins and integrations.
The move: The product and company privacy architecture must support enterprise controls: customer-admin permissions, role-based access, data processing terms, auditability, data export or deletion support, and compliance documentation for customers operating under regimes such as GDPR and India's DPDP environment. The primary driver is privacy-by-design in the HR workflow. Supporting drivers include enterprise trust, contractual controls, cloud security practices, user access governance and the ability for customer organisations to configure HR processes without exposing unnecessary data.
Outcome or lesson: The lesson is that modern HR privacy is not solved by asking employees to tick one consent box. A SaaS HR platform must embed purpose limitation, access control, retention options and transfer safeguards into the product experience itself.
Takeaway: Zoho People is memorable because it proves the core principle: people-data governance must be built into the system where HR work actually happens.
How AI Changes Consent, Retention & Transfer of People Data
AI makes people-data governance harder because it increases both the volume of data used and the number of invisible inferences created from that data.
AI screening needs sharper consent and explainability: Resume-ranking tools may process education, experience, skills, gaps and inferred fit. HR must explain the purpose, avoid irrelevant features and monitor bias.
Employee monitoring creates inferred data: AI tools can infer productivity, risk or sentiment from logs, chats, tickets or activity patterns. The privacy issue is not only raw data collection; it is what the model concludes about a person.
Data retention must include model inputs and outputs: If candidate scores, embeddings, interview transcripts or chatbot logs are retained, they need retention rules too. Deleting the resume while keeping the AI score may not solve the privacy issue.
Load a company privacy notice, its careers page and this lesson into NotebookLM. Ask: “List the people data collected during hiring, identify likely vendors, and generate five interview questions on consent, retention and transfer risks.”
Interview Relevance
“Your company is implementing a new HRMS and AI-based recruitment tool. What privacy controls would you put around employee and candidate data?”
Use the phrase “purpose-linked lifecycle”. It signals that you understand privacy as an operating model, not a legal disclaimer.
Common Mistake
The costly mistake is saying, “We will take consent,” and stopping there. Consent does not automatically justify indefinite storage, unnecessary sharing or weak vendor control. Fix: always add retention schedule, transfer safeguards and deletion or anonymisation to your answer.
What to Revise Next
Revise the adjacent privacy topics as a journey: first understand what happens before hiring, then understand how workplace technology can cross the privacy line.
Mark Lesson Complete (Consent, Retention & Transfer of People Data - Interview-Ready HR Privacy Framework)
