Compliance & labour law · Updated October 2026
Employee data governance is the set of decisions about who owns each piece of employee data, who may see or change it, how its quality is checked, how long it is kept and on what lawful basis it is used, applied across the HRMS, payroll, attendance and every other system that holds it. It is the management layer above the employee master data itself.
| Area | The question | Typical answer in a 500-person company |
|---|---|---|
| Ownership | Who is accountable for this field being right? | HR ops owns job and personal data; payroll owns bank, PF and tax fields; the plant admin owns shift and device data |
| Access | Who can see and edit it? | Defined by role through role-based access control, reviewed every quarter, with exports logged |
| Quality | How do we know it is correct? | Monthly checks: missing UAN, duplicate PAN, exited staff still active in the biometric device |
| Retention | When is it deleted? | Per the written retention schedule |
| Lawful basis | Why are we allowed to hold it? | Recorded per purpose: payroll and statutory filings, versus optional uses such as wellness or analytics |
A typical mid-sized Indian employer has several systems that each hold employee records: an HRMS, a payroll tool or outsourced payroll, an attendance device, an ATS, a group insurance portal, and spreadsheets in between. Without governance, the same person has three addresses, an ex-employee’s fingerprint stays in the turnstile, and the bank file goes out with an account number changed by email. Write down which system is the master for each field and let HR data integration flow one way from it.
The lawful-basis column is what changes under the DPDP Act. Its core obligations become binding on 13 May 2027, and section 8(3) asks for complete, accurate and consistent data where it is used to make a decision about the person, which turns data quality from housekeeping into an obligation. Analytics projects such as flight-risk scoring need their purpose recorded before they start, not afterwards.
Both, but the decisions belong to HR and payroll as the business owners; IT runs the controls. The employer stays the data fiduciary even when a vendor hosts everything.
A two-page version, yes: an owner per data type, who has admin access, and when files are deleted. Size changes the paperwork, not the questions.
Quarterly is a common rhythm, plus on every role change and exit; stale admin rights for people who moved out of HR are the most frequent finding in an HR audit.
Before you migrate to a new HRMS, run the quality checks above first, as covered under data migration.