While I was debating on DGPSI-HR and a specific provision related to “Contract Employees”, the issue of GIG workers came to the table. In this context I am trying to look into the Karnataka platform based gig workers (Social Security and Welfare Act 2025) which is interesting to discuss. This is a topic for deeper discussion amongst HR law experts but I am presenting this here to draw their attention and to comment on the specific provision of DGPSI-HR.
The DGPSI-HR is a special framework under the DGPSI (Data Governance and Protection Standard of India) meant for providing a guideline for DPDPA compliance by HR divisions of organizations as well as HRMS companies.
There are two model implementation specifications in the framework which state as follows.
MIS 4( DGPSI-HR) :
All contract employees, consultants, and outsourced personnel engaged by the Organization who have access to or process Personal Data shall act under the authority of the Organization and shall be bound by written confidentiality, security and data-protection obligations aligned to the Digital Personal Data Protection Act, 2023 (DPDPA).
Where a consultant or service provider independently or jointly determines the purposes and means of processing Personal Data, such party shall be treated respectively as a Data Fiduciary or Joint Data Fiduciary for that processing.
MIS 5( DGPSI-HR) :
Where the Organization supplies its employees to another organization and such personnel process Personal Data under the instructions of the recipient organization, the recipient organization is the primary Data Fiduciary
The supplying Organization to which the individual worker has “Employment” obligations shall be considered as jointly determining the means of processing and hence both organizations shall be considered as data fiduciaries. (This is consistent with the employment status of such workers )
The Organization supplying personnel shall ensure project specific back-to-back contractual obligations with such personnel, including confidentiality, security and lawful-processing duties, aligned with its obligations under any Data Processing or Joint Data Fiduciary agreements.
We shall discuss these provisions in today’s open house discussion on DGPSI-HR in a zoom session (Link available in the image above). Interested persons may attend and contribute their thoughts on this 27 specifications framework.
Naavi
