Is attendance data personal data under the DPDP Act?

Attendance data is unambiguously personal data: it names a person and records when they worked, often alongside project, location and device information. The employer processing it is a data fiduciary with the full set of obligations — notice of what is collected and why, limitation to that purpose, reasonable security safeguards, and deletion when the purpose ends.

This does not put attendance tracking in conflict with labour law. Maintaining registers is a legal obligation, and the Act contemplates processing necessary for compliance with law. The tension appears only where collection exceeds what the obligation requires — the badge log is required, the continuous location history is not.

Storage limitation is where most employers have work to do. Labour rules require registers to be kept for years; nothing requires raw device telemetry, biometric templates or granular movement data to be kept at all once attendance is derived. A retention schedule that distinguishes the two satisfies both regimes; a single 'keep everything for seven years' policy satisfies neither cleanly.

Employees also have rights that attach to this data: to know what is being processed, to seek correction of inaccurate records, and to grievance redressal. An attendance record an employee cannot see or correct is a rights problem before it is a payroll problem — which is a good argument for making the record visible to the person it describes in the first place.