Does DPDP Act Apply to Company Data on Personal Devices and Vice Versa?
Authored by Ammu Brigit
Hybrid work has blurred a line that data protection law still cares about a great deal: where does company data end and personal life begin? Employees routinely check office email on personal phones, call customers from personal numbers, and sit on WhatsApp groups that mix work and home. Just as often, personal Gmail or banking accounts get opened on a company laptop during a lunch break.
With India’s Digital Personal Data Protection Act, 2023 (“DPDP Act”) now moving from statute to enforced reality, it is worth analysing: does the law care which device you are using? The answer is more than a yes or no and the understanding of the same matters for both employees and the organisations that employ them.
The Law Doesn’t Regulate Devices but the Data and Roles
The DPDP Act is built around two central roles: the Data Fiduciary (the entity that decides why and how personal data is processed typically the employer) and the Data Principal (the individual whose data it is typically the customer or employee). Obligations under DPDP are attached to these roles, not to hardware. A company doesn’t stop being responsible for customer data just because that data happens to pass through an employee’s personal phone rather than a company-issued one.
This single idea explains almost everything about how the Act treats two situations that show up constantly at work, and that are essentially reverses of each other: (A) using a personal device to handle company data, and (B) using a company device to access a personal account. They look similar on the surface i.e., a device crossing the work/personal line but the law treats them very differently, because the data crossing that line is different in each case.
Scenario A: Company Data on Personal Devices
When an employee uses a personal device to do company work, the employer remains the Data Fiduciary for whatever personal data flows through it. A few common examples:
Office email synced to a personal phone. The moment a company mailbox is added to a personal device, a customer’s or a colleague personal data(names, numbers, correspondence) is being processed outside the organisation’s managed IT environment. The company’s duty to maintain “reasonable security safeguards” under the Act doesn’t disappear just because it doesn’t own the phone rather it becomes harder to discharge.
Calling customers from a personal mobile number. A customer’s phone number and the substance of the call are personal data processed for the company’s purposes. Left unmanaged, that number lands in the employee’s personal contacts, call log, and possibly backed-up chat threads. The company is still accountable for such which now lives somewhere it can neither monitor nor secure. If that phone is lost, sold, or compromised, the resulting exposure is a company data problem wearing a personal-device disguise.
A personal number added to an official WhatsApp group. This is the least concerning of the three, precisely because the primary data at stake is the employee’s own number which belongs to the employee, who has presumably consented to its use. The real risk is what else flows through that group: customer details, other employees’ information, internal messages which are all now sitting on a personal, unmanaged device and possibly backed up to a personal cloud account. Once company data lives on a device the company doesn’t control makes proving “reasonable security safeguards” difficult.
Scenario B: Personal Accounts on Company Devices
When an employee logs into a personal Gmail account, personal banking app, or social media profile on a company laptop, the company is generally not the Data Fiduciary for that data. It belongs to the employee (or to Google, the bank, or the platform in question), and the DPDP Act’s core obligations don’t attach to the company simply because it’s hardware was the access point.
Where the Act does re-enter the picture is more specific: if the company monitors that activity such as logging browsing history, capturing keystrokes, taking periodic screenshots, or running DLP (data-loss-prevention) tools that record login activity, the company starts collecting personal data about the employee. At that point, the company becomes the Data Fiduciary for that surveillance data, and needs a lawful basis to justify and secure it. The DPDP Act’s “legitimate use” provisions do allow employment-related processing (protecting the employer from harm, for instance), but that’s a justification for reasonable monitoring, not a blanket licence for unrestricted surveillance of personal activity.
The foregoing does not suggest that organisations should prohibit personal devices for business use, or bar personal use of company equipment. It does suggest that governance frameworks should reflect where accountability under the DPDP Act actually resides:
- Personal-device arrangements and acceptable-use rules should be formally documented in employment contracts, HR policies and IT governance frameworks. A Data Fiduciary’s responsibility does not depend on who owns the device, and the absence of a written policy is unlikely to assist in a breach or regulatory inquiry.
- Monitoring of company-issued devices should rest on a documented justification, for which the Act’s employment-related “legitimate use” provision may provide support, and should be disclosed to employees through policy. Monitoring without a defined basis or scope may itself create compliance exposure.
- Customer-facing channels, such as calls, messaging applications and personal email, should be expressly addressed in data-handling policies and, where third-party providers are involved, in vendor or processor agreements. Prevailing practice is not a reason to treat these channels as outside the Act.