India HR Guide

#HRhelpdesk #IndiaHRGuide #MandeepSingh, In this episode, Mandeep Singh examines the most serious implications of the Information Technology Act for HR practitioners, focusing on penalties, misconduct, and negligence in a digital workplace.
He explains how common workplace actions such as accessing a colleague’s system without authorisation, deleting organisational data before exit, impersonation through shared credentials, misuse of passwords or digital signatures, and non‑consensual photography during official events can move beyond internal misconduct and become statutory violations under law. Mandeep stresses that HR policies must clearly communicate that certain behaviours are not only violations of company rules but also carry legal consequences. He also addresses privacy‑related issues in digital communication and identity, explaining why preventive policies, training, and enforcement are essential. The episode then explains the legal concept of negligence, distinguishing it from genuine mistakes. Negligence, he clarifies, arises from the absence of systems, controls, and safeguards, and can result in compensation liability. The discussion concludes with a clear message: building a culture of technology compliance, enforcing policies, and ensuring accountability is fundamentally an HR responsibility, not merely an IT function.

#HRhelpdesk #IndiaHRGuide #MandeepSingh, In this episode, Mandeep Singh discusses a simple but powerful HR best practice with significant legal implications: collecting and formally recording an employee’s authorised personal email address.
He explains why HR teams already maintain personal contact details, including permanent addresses, for situations such as absconding, issuing reminders, serving notices, processing exits, sending full and final settlements, and issuing Form 16. Mandeep highlights the risk of relying on job application email addresses, particularly after employees exit the organisation. The episode introduces the concept of taking a clear declaration from employees specifying the personal email address on which official electronic communication can be sent. Once such an address is declared, any communication sent to it can be treated as duly served, eliminating disputes around notice delivery, acknowledgements, and physical signatures. Mandeep also discusses practical limitations of this approach, explaining why it may not be suitable for certain categories of employees. When implemented correctly, this practice strengthens HR governance, simplifies compliance, and protects organisations during exits, disputes, and disciplinary actions.

#HRhelpdesk #IndiaHRGuide #MandeepSingh, In this episode, Mandeep Singh explains how the Information Technology Act recognises digital records as legally valid, and why HR practitioners must clearly understand the difference between a digital record and an original digital record. He clarifies that while screenshots, scanned documents, or photographs are all digital records, they are not treated as original digital records when original proof is required. An original digital record must be issued digitally in its original form and be capable of demonstrating authenticity. Using simple, practical examples, Mandeep explains when scanned copies may be acceptable and when they are not, and why HR teams cannot treat screenshots or scans as substitutes for originals in every situation. The discussion makes it clear that the requirement is not about format preference, but about evidentiary value. From an HR perspective, the episode highlights why document handling practices for employee certificates, records, and digital files must reflect this distinction. Understanding what qualifies as an original digital record helps HR practitioners avoid weakening their documentation through casual shortcuts and ensures compliance with how the law treats digital records.

#HRhelpdesk #IndiaHRGuide #MandeepSingh, In this episode, Mandeep Singh examines how the Information Technology Act applies to everyday HR practices, beginning with digital signatures and secure systems. He starts by explaining what a digital signature actually is under the IT Act, and why scanned signatures, typed names, or casual electronic acknowledgements do not qualify as legally valid digital signatures. Using employment documentation as an example, Mandeep explains the difference between offer acceptance and appointment letters, clarifying why appointment letters require stronger evidence and why digitally signed documents are treated as original records that cannot be altered after signing. The discussion then moves into the concept of reasonable security practices and secure systems. Mandeep explains why organisations have a duty to put safeguards in place, and why cybersecurity is not only about technology but also about how employees access systems, use credentials, and follow policies. The episode highlights HR’s role in governing employee conduct, access controls, training, and enforcement, and explains that due diligence under the IT Act means being able to demonstrate that systems and safeguards were actually in place, not merely written into policy.

#HRhelpdesk #IndiaHRGuide #MandeepSingh, This episode focuses on how the Information Technology Act defines everyday digital tools that HR practitioners use but rarely view through a legal lens. Mandeep Singh begins with the concept of the “addressee” and explains why the distinction between the “To” field and “CC” field in emails matters under law. Emails, he explains, are not merely communication tools but electronic records, and clarity on intended recipients strengthens an organisation’s ability to rely on those records. The discussion then examines what qualifies as a “communication device” under the IT Act, covering phones, messaging applications, and other tools capable of transmitting text, audio, video, or data. Mandeep goes on to unpack how the Act defines a computer, computer system, and computer network, and why HR platforms such as HR portals, VPNs, shared drives, and biometric systems fall squarely within these definitions. The episode further introduces the concept of a “computer resource”, explaining that software, databases, networks, and stored information are all protected resources under the Act. Together, these definitions help HR professionals understand the legal scope of the digital systems they already manage, forming the foundation for compliant HR policies, controls, and workplace practices.

#HRhelpdesk #IndiaHRGuide #MandeepSingh, In this episode, Mandeep Singh sets the foundation for understanding why the Information Technology Act is not only an IT or cybersecurity topic, but also a core Human Resources responsibility. He explains how today’s workplace is fundamentally digital, built around emails, messaging platforms, HRMS, biometric attendance systems, surveillance tools, and electronic employee records. While these systems are often designed, implemented, and maintained by technology teams, Mandeep explains that their day‑to‑day use directly governs employee behaviour, conduct, discipline, and accountability. He highlights that most digital workplace systems primarily manage employees rather than customers, which naturally brings the HR function into the centre of technology governance. The discussion focuses on why HR policies, misconduct frameworks, standard operating procedures, and training programmes must reflect how these technologies are actually used by employees. The episode makes it clear that unless HR actively embeds technology governance into HR systems and practices, organisations risk inconsistency, behavioural gaps, and weak accountability in a digital workplace.

#HRhelpdesk #IndiaHRGuide #MandeepSingh, Who is actually responsible when employee data leaks, the IT team, the organisation, or the HR practitioner? And are everyday HR habits quietly creating serious DPDP compliance risks? In this episode, Mandeep Singh shifts the discussion from definitions and intent to the deepest and most operational layer of the Digital Personal Data Protection Act: data security and personal accountability. He introduces the idea of data nominations, drawing parallels with gratuity and insurance nominations, and explains why individuals should be encouraged to nominate people who can exercise data rights on their behalf in cases of death or incapacity. Personal data, he stresses, is an asset, like money, insurance, or intellectual property and deserves the same level of foresight and protection. The episode then addresses a common misconception: that data security is only the responsibility of technology teams. Mandeep explains that while systems and safeguards exist, responsibility ultimately sits with the data fiduciary and practically with HR practitioners who handle personal data every day. From locking computers and password‑protecting salary files to avoiding careless emails, printer leftovers, and unsecured scans, he shows how routine HR actions can create or prevent data breaches.
He explains that negligence can expose organisations to severe penalties and personal accountability. The episode closes with a clear message: HR cannot use personal data for every purpose, only for employment purposes or with consent and what data is collected must match how it is used.

#HRhelpdesk #IndiaHRGuide #MandeepSingh, What happens when an employee asks, “What personal data do you have about me and why?” Who in the organisation is actually responsible for answering that? And when someone withdraws consent, are HR systems ready to stop using the data immediately? In this episode, Mandeep Singh takes the DPDP discussion deeper by focusing on data governance, consent management, and the right to erase personal data. He explains the concept of significant data fiduciaries and why organisations need clearly identified responsibility for managing personal data. From an HR perspective, he highlights the importance of nominating HR team members as data officers for internal employees, creating a clear point of contact for all personal data related queries. Mandeep explains why organisations must know exactly what personal data they hold, the purpose for which it is used, the time period for which it is retained, and whether consent is required. He walks through how consent must be recorded, how withdrawal must be tracked, and why data use must stop the moment consent is withdrawn. The episode also explains the practical meaning of data erasure. Using recruitment examples, Mandeep clarifies when organisations can retain candidate data for employment purposes and when deletion becomes mandatory, with confirmation back to the individual. Finally, the discussion addresses the heightened sensitivity around children’s personal data. Mandeep explains why extra care, parental consent, and legal guidance are essential whenever organisations engage with or collect personal data relating to children.

#HRhelpdesk #IndiaHRGuide #MandeepSingh, Once we understand what personal data is, the next critical question is simple: when is an organisation actually allowed to use it? Does every use of employee or candidate data qualify automatically or does the law draw a clear line? In this episode, Mandeep Singh explains the core context of the Digital Personal Data Protection Act by focusing on one central idea: personal data can only be collected, processed, or retained for legitimate use or with explicit consent. He clarifies that employment purpose is a subset of legitimate use, but not everything HR does automatically falls under it. The discussion walks through what employment purpose really means: entering into an employment relationship, sustaining it through the employee lifecycle, meeting statutory and contractual obligations, and managing employment‑related risk. Using practical HR examples, Mandeep explains why data such as date of birth is legitimately collected to verify age or statutory thresholds, but how using the same data for activities like birthday greetings does not qualify as employment purpose and therefore requires consent. He highlights how small, routine HR actions often cross this boundary without being noticed. A key illustration in this episode is recruitment. Mandeep explains how resumes flow across multiple email IDs inside organisations, often far beyond employment decision‑makers, creating situations where personal data cannot be fully controlled, deleted, or safeguarded. The episode shows how DPDP principles directly impact everyday HR practices, especially how organisations collect, share, retain, and protect personal data.

#HRhelpdesk #IndiaHRGuide #MandeepSingh, What does digital personal data really mean for HR? Is this only an IT or legal responsibility, or does it fundamentally sit with the HR practitioner? And in the day‑to‑day employer employee relationship, who actually owns personal data, who processes it, and who is accountable for getting it right? In this episode, Mandeep Singh explains digital human resources through the lens of the Digital Personal Data Protection Act. Rather than focusing on HR tech tools, the discussion centres on the systems, processes, and technologies that directly influence everyday HR actions. The episode makes it clear why HR practitioners are deeply involved in personal data management, not just as transmitters of information, but also as creators and safe custodians of employee data. Mandeep walks through why employer, employee relationships are built on continuous exchanges of personal data, maintained and generated by the organisation through HR. He explains how even when HR or IT policies exist, implementation responsibility largely sits with HR practitioners. The discussion focuses specifically on digital personal data and what the DPDP Act expects HR to deliver, without going section by section into the law. The episode introduces key definitions, data principal, data fiduciary, and data processor, and explains how these apply in an HR context. It also clarifies what constitutes personal data, including how individuals can be identified even without direct reference to their name. This conversation is designed to help HR practitioners understand what they must practically deliver under the DPDP Act.