The Consent Problem: Why the Monitoring Clause in Your Offer Letter May Not Count

The email arrives on a Monday morning, from a developer who resigned on Friday. It is polite and two sentences long. She would like a copy of the data the tracking tool has collected about her. And she would like the record of her consent to that collection.

The first request is a chore. The second is the problem. You go looking for the record of consent. You find what most Indian companies would find: clause 11(d) of her offer letter. "The Employee agrees that the Company may monitor its systems, equipment and premises." One line. Signed on her first day, somewhere between the PF nomination form and the NDA.

That clause is the record. This article is about why it may not count - and what the gap is quietly costing you while you believe it does.

The short answer

Probably not. Section 6 of India's DPDP Act requires consent to be free, specific, informed, unconditional and unambiguous. Legal commentary argues that a monitoring clause which is bundled into an offer letter fails many of those tests – with some analysts suggesting that such clauses are legally void instead of merely risky.

This piece goes deep on that one question. For the whole law in plain English, start with the broad explainer: Is employee monitoring legal in India? (Link the previous blog with this question)

Key takeaways:

• Compliance deadline – Complete statutory compliance has to be achieved by 13th May 2027, making notice and contract re-papering an immediate priority.*
• Proportional remediation – The corrective measure is cost-effective and straightforward – creating a plain-language and standalone notice paired with unbundled and dedicated consent workflow.*
• Unlawful processing – When the underlying consent clause fails, the ongoing data capture functions without a valid legal basis, collecting daily liabilities. Monitoring and consent failures fall under the residual penalty tier capped at 50 crore rupees (Section 33), where the regulatory authorities evaluate repetition and duration as aggravating factors.*
• Legal commentary – Industry analyses (LiveLaw, 2025) suggest that the bundled employment surveillance clauses ate void, fundamentally, meaning that the required statutory consent never existed legally. While this remains a legal interpretation instead of a binding judicial ruling, the companies are suggested to treat it as a high-risk exposure.*
• Statutory test – Section 6 sets the five cumulative tests for valid consent – free, specific, informed, unconditional and unambiguous. A clause tied directly to job acquisition for satisfying ‘free consent’ requirement.

Why does everyone believe the offer letter covers them?

For years, the standard employment contracts have acted as the default repository for workplace policies. Tracing the clauses typically reveals a standard lineage – pasted from a template during past hiring sprints and signed by every subsequent employee.

These clauses have historically satisfied the due-diligence questionnaires because ethe auditors traditionally asked whether a monitoring clause existed, to which the answer was mostly affirmative.

The standard has shifted – traditional contract law operates on the rule of signature and binding agreement whereas, statutory data protection mandates active, specific consent criteria.

The DPDP Rules notified by the Ministry of Electronics and Information Technology on 13th November, 2025, (Gazette G.S.R. 846(E)), initiated an 18-month phased rollout, culminating inn full enforcement on 13th May 2027 ((AZB Partners, 2025).

Automated data collection tools continue to populate the dashboards without generating system error when the underlying consent mechanisms fail, making this regulatory liability largely invisible until challenged.

What does Section 6 actually require - and does a bundled clause pass?

Section 6 of the DPDP Act mandates that consent must satisfy five distinct criteria simultaneously. The following matrix illustrate how the standard offer-letter clauses align against such statutory thresholds:

Furthermore, Section 6(4) establishes that withdrawing consent must be as straightforward as providing it. A clause that cannot be revoked without terminating employment fails this statutory mandate.

Practitioner commentary suggests that defective surveillance clauses are not merely non-compliant but legally void and effectively invalidate historical data collection from inception. (LiveLaw, 2025)

Doesn't "processing for employment purposes" cover monitoring anyway?

Partly - and the part it covers is not the part your clause was protecting.

Section 7 lists "certain legitimate uses" that need no separate consent, and processing for the purposes of employment is one of them. Attendance, payroll, granting and revoking system access - the routine machinery of employing someone stands on its own legal basis.

But commentary converges on a proportionality reading: routine, disclosed, work-related processing likely fits; intrusive capture - screenshots, continuous location, always-on monitoring - likely does not (CPO Magazine, 2025). That produces an uncomfortable inversion. The capture types most likely to need consent are the intrusive ones - and the intrusive ones are precisely where a vague bundled clause is weakest. The clause fails hardest exactly where you need it most.

What happens if the consent doesn't count?

Then the intrusive capture has no legal basis - and has not had one since the day it started.

That is the actual cost, and it compounds. Run illustrative numbers on a 60-person company with 40 tracked employees. Screenshots at a ten-minute cadence, eight hours a day, is roughly 1,900 images a day - around 460,000 a year. If the consent underneath them is void, that is not an archive. It is 460,000 records processed without a legal basis, each one timestamped. (Illustrative - the point is the accumulation, not the precision.)

Where does that land in the penalty schedule? A consent or monitoring failure sits under "breach of any other provision" - a ceiling of ₹50 crore (Section 33 schedule, DPDPA.com · King Stubb & Kasiva). Not the ₹250 crore figure that circulates - that tier is for a security-safeguards failure leading to a data breach. And ceilings are ceilings, not expected fines: the Board sets the actual figure using the Section 33(2) factors - gravity, duration, repetition among them. Nobody serious expects a ₹50 crore order against a mid-size company over a defective clause.

But duration and repetition are on that factor list - and silent, daily capture manufactures both. Every month the clause goes unfixed, the fact pattern worsens at the speed the storage grows.

Now price the other side. The fix is a standalone, plain-language notice - what is collected, why, who sees it, how long it is kept, how to withdraw - plus a flow that lets someone actually say yes. Roughly a day of drafting, plus legal review, against an exposure with a ₹50 crore ceiling. It is the cheapest asymmetry on your entire compliance list.

What changes when the consent is real?

Run the Monday email again - this time at a company that re-papered a year ago. The reply takes ten minutes and needs no lawyer. Attached is the monitoring notice the developer signed: a separate document, two pages, dated, plain language. It names the four things collected and the two things never collected. It names who can see the data and how long screenshots are kept. At the bottom, the withdrawal route - the same form she used to consent. You are not scrambling to construct a legal basis. You are forwarding one. That is certainty, in this corner of the law: "show me the record of my consent", answered with a document designed to be shown.

Notice what made that possible. Not legal sophistication - the notice matches reality. You can only write "we collect A, B and C, and never D" if you know, and control, exactly what your tool captures.

Since we build one of these tools (TruTimer), one honest note on the mechanism: every capture type in ours is a separate switch - screenshots, activity counters and app/window tracking are each individually controlled features. The desktop tracker records that someone typed - counts, never what they typed - and live location is off by default, with an active-tracking banner shown to the person whenever it runs. None of that makes anyone compliant; the notice, the consent flow and the policy are yours to write. What separate switches change is that your notice can say exactly what happens and nothing more - which is what specific and informed ask for.

(We're turning the notice itself into an adaptable template - a DPDPA-ready employee monitoring policy - planned as a free download.)

The check you can run this week 

Pull two documents: your current offer-letter template, and one signed copy from your most recent hire. Find the monitoring clause. Ask it five questions.

1. Was it separate? Did monitoring get its own document and its own signature - or one line inside the employment stack?

2. Is it specific? Does it name each capture type - time, screenshots, app and window usage, location? (The three capture types that draw the most complaints get their own breakdown in keystroke logging, webcam, live location - planned.)

3. Could they have declined? Was there any route to refusing the clause and still taking the job?

4. Can they withdraw as easily as they consented? Is there a named mechanism - or would withdrawal in practice mean a meeting?

5. Does it name retention? Can a person reading it learn how long a screenshot of their screen will exist?

Score it honestly. Five yeses puts you ahead of nearly every company in the country. Most templates score zero - not through malice, but lineage. If yours does, the path is short: draft the standalone notice, run a real consent flow for existing staff as well as new hires, and record the responses. Full compliance lands 13 May 2027 (AZB Partners, 2025); a government consultation has proposed shortening that runway - nothing is confirmed, but assume the time you have will not grow.

The certainty on the other side is specific: you answer the Monday email in ten minutes. If you want to see what a notice looks like when it is written against capture switches you control, we'll walk you through ours.

Frequently asked questions

Is a monitoring clause in an offer letter valid consent under the DPDP Act?

Commentary argues no. Section 6 requires consent to be free, specific, informed, unconditional and unambiguous, and a clause the job depends on struggles with every one of those tests. LiveLaw's analysis goes further, arguing such surveillance clauses are void. No ruling has settled it yet - which is exactly why re-papering now is cheap insurance.

What does a valid monitoring consent look like?

A standalone plain-language notice, separate from the offer letter, naming each capture type, its purpose, who sees the data and how long it is kept; a genuine option to decline; and a withdrawal route as easy as the consent itself. The working test is specificity: could the signer describe what is actually collected?

Do existing employees need to re-consent, or only new hires?

Existing staff are the larger exposure - capture is already running on the questioned basis, and duration is a penalty factor. The practical path is the same for both: issue the standalone notice, collect fresh consent, record the responses. Do it comfortably before the 13 May 2027 deadline, not at it.

Can we penalise an employee who refuses monitoring consent?

That is the trap inside the question. If refusal carries a job consequence, the consent collected from everyone else was arguably never free - the core of the bundling objection. The workable pattern: rest routine processing on the employment-purposes basis, and ask consent only for capture a person can genuinely decline.

This article explains the law as commentary, not legal advice. The "void" argument is a practitioners' position, not a settled ruling, and the DPDP Rules are still being operationalised ahead of May 2027 - consult a lawyer before changing your contracts or notices. Every legal claim above cites its source; facts re-verified quarterly, last on the dateModified shown above.

Sources: MeitY/PIB notification, Nov 2025 · AZB Partners on the phased rollout, 2025 · LiveLaw on surveillance clauses, 2025 · Section 33 penalty schedule, DPDPA.com · King Stubb & Kasiva on penalties and adjudication · CPO Magazine practical guide, 2025