Can Employers Track Employee Location in India? What the DPDP Act Means

Employers in India have good reasons to want to know where their people are. A field auditor driving to a remote plant, a technician alone on a rooftop, a woman employee leaving a client site late. In an emergency, “where were they last?” is the first question.

But location is also one of the most personal things a phone knows. Track too much and you lose your employees’ trust, and possibly break the law.

This guide explains what India’s data protection law says, and how to use location for safety without crossing the line. It is general information, not legal advice. Talk to your lawyer about your own situation.

The short answer

Using employee location for genuine work purposes is generally allowed in India, if you:

1. use it only for a clear purpose, such as the safety of staff who travel,
2. collect only what that purpose needs (during the work trip, not all day),
3. tell employees exactly what is collected, when and who sees it,
4. keep it secure and limit who can see it, and
5. delete it when the purpose is served.

Tracking people around the clock, after working hours or on leave “just in case” fails most of these tests.

What the law says

The DPDP Act, 2023

The Digital Personal Data Protection Act, 2023 is India’s main data protection law. A person’s location is personal data, so the Act applies to it. The company is the “Data Fiduciary”; the employee is the “Data Principal”.

Normally, the Act requires consent to process personal data. But Section 7 lists “legitimate uses” that do not need consent, and one of them covers processing for the purposes of employment, along with protecting the employer from loss or liability. Location used to keep travelling staff safe sits naturally within an employment purpose.

That is not a blank cheque. The company’s other duties still apply:

• Security: take reasonable security safeguards. The Act’s penalties go up to ₹250 crore for failing to prevent a data breach this way.
• Erasure: delete personal data once the purpose is served, unless another law requires keeping it.
• Purpose: data collected for one purpose (safety on a trip) should not quietly be used for another (judging how long someone spent at lunch). A new purpose outside employment needs its own basis, usually consent.

The DPDP Rules, 2025

The Digital Personal Data Protection Rules, 2025 were notified on 13 November 2025. Most duties on companies apply after an 18-month transition, in May 2027. That is close enough that HR and IT teams are fixing their processes now, especially for sensitive data like location and health.

The proportionality idea

In 2017, in the Puttaswamy judgment, the Supreme Court held that privacy is a fundamental right, and set out a proportionality test for when the state may limit it. Employers are not the state, but the same question is a useful guide: is what you collect in proportion to the reason you collect it? Location during a trip to a remote site, for the employee’s safety: yes. A live map of everyone’s evening: no.

A fair policy, in seven rules

1. Name the purpose. For example: “Location is used to keep employees safe while travelling for work and during emergencies.”
2. Share only during a defined activity. A work trip the employee starts, or an SOS they raise. Sharing stops when the trip ends.
3. Never outside work. No tracking after hours, on leave or on weekends unless the employee is on a work trip.
4. Limit who can see it. A named Safety Desk, not every manager and not all of HR.
5. Record every look. Each time someone opens an employee’s location, log who, when and why. Show it to the employee.
6. Delete it quickly. Keep detailed routes for days, not years. Keep the summary (trip, times, outcome) as long as you need it.
7. Tell people first. Explain the rules in plain words before anything is shared, and ask employees to acknowledge them once.

Policies like this also work better. Staff who trust the system keep their phones on them. Staff who feel watched leave the phone in the car.

Health data needs extra care

Some safety apps let employees store blood group, allergies or medical conditions for emergencies. This information is deeply personal. The safest rule is simple: the employer never sees it. It should go only to the people helping in an emergency, such as the employee’s own emergency contacts and responders.

How ORBII Teams is built around this

ORBII Teams was designed with these rules from the start:

• Location only during a trip the employee started, or an SOS. The company type decides the rest: for field teams, during work trips; for office teams, only if a trip runs late or escalates; for universities, only during an SOS, and only to the security desk.
• A small circle of viewers. Only the account owner and the Safety Desk see location. HR admins manage people and settings but never see where anyone is.
• Every look is recorded. Each time someone opens a live location or a trip route, it is logged. The next app update shows each employee exactly who looked and when.
• Routes fade. Detailed route points are deleted after seven days. The trip summary stays.
• A plain notice first. Before anything is shared, the app shows each employee what their company can see, and asks them to acknowledge it once.
• Never health data. Health information stays between the employee and the people helping them in an emergency. Their employer never sees it.

Read more on our Trust Center or our employee safety app page.

This article is general information about Indian law as of November 2026, not legal advice.