Jurisdiction - India
Reports and Analysis
Asia Pacific – Do Employers Have A Right To Access And To Disclose Employee Data Without Consent?

4 November, 2014


When can an employer access and disclose their employees’ personal data in different jurisdictions? We compare the rules in Australia, China, Hong Kong, India, Indonesia, Japan, New Zealand, Singapore, South Korea and Taiwan.


  Are There Any Restrictions In Relation To Accessing And Disclosing Employee Data Without Consent?  Comment
Australia  Yes 
  • The Privacy Act sets out a series of principles that govern the collection, use, disclosure and storage of personal data.
  • There are specific exemptions for any act or practice that is directly related to an “employee record”.
  • In addition to the Privacy Act, employee data is also protected by other legislations.
China Yes 
  • In general, an employer may only collect employee data that is directly related to their employment.
  • Disclosure of such data is subject to the employee’s written consent.
  • Companies that collect personal information electronically shall:
    • obtain prior consent before the collection and use of such data;
    • keep the data strictly confidential; and
    • adopt technical measures to ensure the information is kept confidential.
Hong Kong Yes 
  • An employer is prohibited from collecting and using employees’ personal data for any purpose other than the purpose for which the personal data was to be used at the time of collection.
  • However, such prohibitions are subject to exemptions, such as the prevention of crime.
India  Yes 
  • Employers must comply with the provisions subscribed in the relevant legislation when collecting, receiving, processing, storing, dealing or handling electronic information.
  • Employers are required to obtain prior written consent from the employee at the time of:
    •  collecting such information; and
    •  disclosure of such information to a third party (subject to exemptions).
    • Employers are required to adopt and implement reasonable security practices and procedures for the protection of any personal information.
Indonesia No 
  • The position is unclear.
  • Provisions on data protection are dispersed in a number of different regulations. There are also a number of laws which could impact the access to and disclosure of employees’ data.
  • There are relevant laws that apply to electronic system operators. Any information about individuals which is kept, stored in electronic devices can be considered personal data and must be treated as confidential.
  • Employers are prohibited from accessing and distributing electronic information without the employees’ express consent.
  • Written consent is not required in situations where:
    •  the employment agreement contains a clause allowing access and disclosing of personal data; or
    • the employee has waived the confidential nature of the relevant data.
Japan Yes 
  • Personal data can be collected and processed without the consent of the employee, provided the purpose for which it will be used is notified to the employee.
  • Employee consent is required for all other purposes.
  • Prospective employers are prohibited from collecting information about race, ethnic origin, beliefs, or associations of the prospective employees with the labour union.
  • An organisation can use personal data jointly with a third party without consent, if it notifies the individual that the personal data will be jointly used with a particular party and why.
  • There are several exceptions where an employer can disclose an employee’s personal data to a third party without the latter’s consent.
New Zealand Yes 
  • An employer may not collect personal information from an employee unless it is needed for a lawful purpose connected with a function or activity of the employer.
  • In general, employers need to inform their employees in advance. However, this is subject to several exceptions.
  • An employer that holds personal information that was obtained in connection with one purpose shall not use the information for any other purpose, except in limited circumstances.
  • An employer who holds personal information must not disclose the information to another person or body or agency, except in limited circumstances.
Singapore Yes 
  • Local legislation prevents the collection, use and disclosure of personal data without consent
  • Certain exemptions apply to managing the employment relationship, such as if the data is necessary for evaluative purposes, investigations or proceedings
South Korea Yes 
  • Local legislation prevents the collection, use and provision of personal data or information without prior consent.
  • Certain exemptions apply to the employment context, such as where special provisions exist in law or it is necessary to observe legal obligations.
Taiwan Yes 
  • An employer can use and disclose the personal data of its employees if such activity can be covered by the purpose of employee management.
  • Otherwise, the employer needs to meet an exemption as prescribed under local legislation.


The different rules across Asia illustrate the need for carefully tailored data protection practices which adopt a company’s global policy but are also compliant with local laws.


herbert smith Freehills


For further information, please contact:


Fatim Jumabhoy, Herbert Smith Freehills

[email protected]

Comments are closed.