How I Handle HR Data (one page)
My working rules for sensitive people data, aligned to the principles of India's DPDP Act and Rules.
Sensitive people data needs clear rules for collection, access, sharing and disposal.
I wrote these rules to guide my work in portfolio projects.
I use ten practical rules, with aggregate reporting and no personal data in public AI tools.
My working rules
How I Handle HR Data (one page)
My working rules for sensitive people data, aligned to the principles of India's DPDP Act and Rules.
- 01
Collect only what is needed.
If I can't explain why I need a field, I don't ask for it.
- 02
Use it only for the stated purpose.
Payroll data stays payroll data.
- 03
Need-to-know access.
I share with the person who needs it, not the person who asks.
- 04
Keep it accurate.
I correct errors at the source and note the change.
- 05
Keep it secure.
Official systems only, no personal messaging apps for sensitive documents, strong passwords, protected files.
- 06
Share the minimum.
Verified recipients, secure channel, only needed fields.
- 07
Keep it only as long as required.
Follow legal retention minimums, then dispose securely.
- 08
Report incidents immediately.
To the designated privacy or security contact, without waiting.
- 09
Analytics rules.
Aggregate results, suppress groups smaller than five, use synthetic data in public work.
- 10
AI rules.
No personal data in public AI tools. Placeholders instead.
This describes my working approach in portfolio projects. It is not legal advice.
This describes my working approach in portfolio projects. It is not legal advice.
In a live setting I would review the rules against official guidance and the organisation’s approved privacy procedures.