Infosys ↗

Overview

Infosys processes data in two capacities: as a data fiduciary (employee data, visitor data, recruitment data) and as a processor (processing client data on behalf of enterprise customers). DPDP affects both roles differently, and Infosys’ global privacy framework needs India-specific layering.

DPDP Readiness: Section-by-Section Analysis

Section 6 — Consent & Notice ⚠️

For 230K+ employees: employment data processing consent is largely covered by employment agreements. But DPDP requires:

• Separate consent for employee monitoring (email, internet, workspace cameras)
• Health data consent (wellness programs, insurance, COVID tracking)
• Background check data consent with specific retention

Section 8 — Obligations of Data Fiduciary ✅

Enterprise-grade security across all dimensions. One of the strongest security postures in Indian industry.

Section 9 — Data Retention ⚠️

Employee data retention partially defined by labor laws. But:

• Employee performance review data — how long after exit?
• Internal communication data (email, chat) — retention?
• Workspace surveillance footage — retention?

Client Data Processing ⚠️

As a processor for global clients, Infosys must navigate:

• Indian employee access to client personal data
• DPDP obligations when Indian employees process foreign personal data
• Client contractual requirements vs. DPDP requirements

Risk Assessment

Recommendations

1. Create India-specific DPDP policy — Layer on top of global privacy program
2. Address employee data comprehensively — Consent, retention, and rights for 230K+ employees
3. Implement DPB escalation alongside global privacy complaint channels
4. Add Section 14 nomination for employee data
5. Clarify processor obligations under DPDP for client data processing

How Does Your Policy Compare?

🔍 Run Your Free DPDP Audit →

Analysis conducted by DPDP Consulting, a Meridian Bridge Strategy initiative. For a comprehensive compliance roadmap, book a free consultation.