Is screenshot monitoring legal under the DPDP Act?

Start with what a screenshot actually contains. It captures whatever was on screen: personal messages, a colleague's data in an open ticket, a client's confidential document, banking details in another tab. The employer becomes the custodian of all of it, including personal data belonging to people who never had any relationship with the employer.

The Digital Personal Data Protection Act, 2023 requires processing for a specified lawful purpose with data limited to what is necessary for it, plus notice to the data principal. Against that standard, screen capture is a poor fit: the stated purposes — knowing whether someone worked, how long, on what — are all achievable with a fraction of the data. Where a less intrusive means achieves the same purpose, the intrusive one is difficult to characterise as necessary.

Consent does not rescue it easily. Employment-context consent is structurally difficult because refusal carries career consequences, a criticism levelled at employer consent under comparable regimes for years. Nor does disclosure alone: telling people they are being screenshotted addresses the notice requirement, not the minimisation one.

Businesses with a genuinely specific need — a regulated trading floor, a defined incident investigation — are in a different position from businesses screenshotting everyone continuously by default. The former can document necessity, scope and retention. The latter is collecting a large volume of sensitive material with a thin justification and an obligation to keep it secure.