Publikationen der StiftungNegotiating digitalised workplaces
32 Titel

Inhalt

Imprint

2. Examples of Digital Technologies Used at Workplaces in India

3. What Are Your Rights – And What Are Management’s Obligations?

a. Your employer must implement security practices and procedures designed to protect SPDI from unauthorised access, damage, use, modification, disclosure or impairment. (Rule 8)
b. Your employer may collect SPDI only where collection of information is considered necessary for a lawful purpose in connection with the function or activity of the company of the employer (Rule 5 (2)). Such SPDI can be used only for the purpose for which it was collected by the employer and not for any other use case (Rule 5(5)). For instance, an employer cannot ask information about an employee’s sexual orientation2828 Navtej Singh Johar v. Union of India, AIR 2018 SC 4321. as it has no nexus wit
c. Your employer must not retain the SPDI for longer than necessary for the purpose for which it was collected (Rule 5(4)).
d. Your employer must obtain specific written consent from you before collecting your SPDI. (Rule 5(1)) You must be informed as to why such SPDI is being collected, what SPDI is being collected, who will such SPDI be transferred to and the name and address of the entity collecting and storing the SPDI (Rule 5(3)).
e. Your employer must have a privacy policy which is made available to you, and it should be available on the website of your employer (Rule 4). The privacy policy of your employer must be clear and easily ac
f. Your employer must allow you to access your information to review, amend and correct it (Rule 5(6)).
g. Your employer must provide you with an option to not provide the data or information sought to be collected. You may also have an option to withdraw consent given earlier to your employer (Rule 5(7)).
h. Your employer must designate a ‘Grievance Redressal Officer’ (“GRO”) to address your information concerns. The GRO must redress your grievance within one month of receipt of the grievance (Rule 5(9)).
i. Your employer may transfer information to third parties only after ensuring that such third party maintains the same level of data protection as itself, and as required under the SPDI rules. Such transfer is permitted only through a lawful contract between your employer and a third party or through consent from you for such transfer (Rule 7).
j. Your employer must implement reasonable security practices and procedures to protect your SPDI. The SPDI rules require compliance with the International Standard IS/ISO/ IEC 27001 on ‘Information Technology – Security Techniques – Information Security Management Systems – Requirements’ and any other applicable standards as per prevailing laws or sector specific associations. Your employer must also undertake an audit of your security practices from time to time, by appointing an independent audito
k. Where an employer is negligent in implementing and maintaining reasonable security practices and procedures resulting in wrongful loss or wrongful gain to any person, such employer is required to compensate the employee for wrongful loss that you may accrue due to such non-compliance (Section 43A of IT Act).
Digital Data Protection Act, 2023 (“DPDP Act”)2929 https://www.meity.gov.in/static/uploads/2024/06/2bf1f0e9f04e6fb4f8fef35e82c42aa5.pdf
a. Your employer must take your free, explicit, informed, unconditional and unambiguous consent for processing your personal data. A request for such consent must be accompanied by a notice containing what personal data is going to be processed, for what purpose such data will be processed, the manner in which the employer may exercise rights under the DPDP Act, and the manner in which you may make a complaint to the Data Protection Board, if the DPDP Act is violated. (Section 5 (1))
b. You may manage, review or withdraw consent to prevent your personal data from being processed at any time and your employer must provide you with an easily accessible mechanism to withdraw such consent. Once you withdraw consent, your employer must cease processing your personal data within a reasonable period of time unless it is required to be retained or processed under any law (Section 6(4) and Section 6(6)).
c. The notice provided to you for consent to process your personal data must be in a clear and plain language. You must be provided an option to access such requests in English or any language specified in the Eighth Schedule to the Constitution (Section 6(3)).
d. If your employer is classified as a significant data fiduciary, they are required to provide you with contact details of a Data Protection Officer, or of any other person authorised to respond to communication/s from you for exercising your rights under the DPDP Act (Section 8(9)).
e. Your employer may collect your personal data only where collection of such data is for a lawful purpose. Your personal data can be used only for the purpose for which it was collected by your employer (Section 4).
f. Your employer is required to erase your personal data as soon as it is reasonable to assume that the specified purpose for which it was collected is no longer being served. The employer is also required to ensure that anyone processing your personal data on their behalf also erases your personal data in the aforementioned circumstance. (Section 8(7))
g. Where the personal data processed by your employer is likely to be used to make a decision that affects you; or is going to be disclosed to a third party, your employer is responsible for the completeness, accuracy and consistency of your personal data. (Section 8 (3)).
h. Your employer is required to protect the personal data, which is under their control, and ensure that anyone processing it on their behalf also adopts reasonable security safeguards to prevent data breaches (Section 8(5))
i. If a personal data breach occurs, your employer is required to intimate you and the Data Protection Board regarding such breach (Section 8(6))
j. If your employer is classified as a significant data fiduciary, your employer is required to undertake a data audit by an independent data auditor and a data protection impact assessment. The data protection impact assessment must comprise a description of the rights of Data Principals, the purpose of processing of their personal data and assessment and management of the risk to the rights of the Data Principals (Section 10 (2)(b) and Section 10(2)(c)).
i. Right to access information about your personal data (Section 11): You can request a summary of your personal data being processed, the purposes, and the identities of Data Fiduciaries holding it.
ii. Rights to correction and erasure of your personal data (Section 12): You can ask for inaccurate or incomplete data to be corrected, updated, or completed, and request deletion when it's no longer needed.
iii. Right to have your grievances with respect to compliance with the DPDP Act redressed (Section 13): You have the right to lodge complaints about data processing with the Data Fiduciary or Consent Manager or escalate to the Data Protection Board if unresolved.
iv. Right to nominate someone to exercise rights over your personal data on your behalf in case of your death or incapacity (Section 14).
Sexual Harassment of Women at Workplace (Prevention, Prohibition and Redressal) Act, 2013 (“the POSH Act”)3131 https://doe.gov.in/files/inlinedocuments/DoE_Prevention_sexual_harassment.pdf
Rights of Persons with Disabilities Act, 2016 (“the RPWD Act”)3333 https://cdnbbsr.s3waas.gov.in/s36ee69d3769e832ec77c9584e0b7ba112/uploads/2025/03/202503251422104079.pdf
Labour Codes
1. Classification of workers, whether permanent, temporary, apprentices, probationers, or those on fixed term employment;
2. Manner of intimating to workers periods and hours of work, holidays, paydays and wage rates;
3. Shift working;
4. Attendance and late coming;
5. Conditions of, procedure in applying for, and the authority which may grant leave and holidays;
6. Requirement to enter premises by certain gates, and liability to search;
7. Closing and reporting of sections of the industrial establishment, temporary stoppages of work and the rights and liabilities of the employer and workers arising therefrom;
8. Termination of employment, and the notice thereof to be given by employer and workers;
9. Suspension or dismissal for misconduct, and acts or omissions which constitute misconduct;
10. Means of redress for workers against unfair treatment or wrongful exactions by the employer or his agents or servants;
11. Any other matter which may be specified by the appropriate Government by notification.
Shops and Establishments Laws
Laws governing Platform-based gig work
Constitution of India: Article 21/Judicial Precedents4545 https://cdnbbsr.s3waas.gov.in/s380537a945c7aaa788ccfcdf1b99b5d8f/uploads/2024/07/20240716890312078.pdf
Workers (General)

4. The Checklists of Questions You Have a Right to Ask!

A
B
C
D
E
F
H
I
O
P
R
S
W

About the authors