1. Meaning

In an employment and HR compliance environment, confidential data and restricted data should not be treated as identical categories.

Confidential data

Confidential data is information that is not intended for public disclosure and whose unauthorised disclosure could harm the employer, employees, customers, or business partners.

Examples include:

• employee salary information;
• employment contracts;
• business strategies;
• customer information;
• internal financial information;
• performance evaluations;
• disciplinary records;
• trade secrets;
• internal investigations;
• non-public product information.

Restricted data

Restricted data is a higher-sensitivity category. Access should normally be limited to specifically authorised individuals because disclosure, misuse, alteration or loss could create substantial legal, financial, security or personal harm.

Examples may include:

• authentication credentials;
• highly sensitive employee records;
• medical information;
• biometric information;
• investigation evidence;
• privileged legal communications;
• merger/acquisition information;
• security architecture;
• highly sensitive trade secrets;
• whistleblower information;
• information subject to specific regulatory restrictions.

Thus:

All restricted data may be confidential, but not all confidential data necessarily needs restricted-data controls.

2. Why the distinction matters

Organisations frequently make the mistake of having a single "confidential" label for everything.

That approach creates two problems.

Problem 1 — Over-classification

If everything is classified as restricted, employees may become accustomed to seeing restrictive controls and start ignoring them.

Problem 2 — Under-protection

If genuinely sensitive information is merely marked "confidential", too many employees may receive access.

A good data-governance framework therefore uses different levels of protection.

For example:

3. Confidentiality is different from access restriction

A confidentiality obligation primarily concerns how information may be used or disclosed.

An access restriction concerns who can access it in the first place.

For example:

An employee may legitimately have access to confidential HR information because of their job. They may still be prohibited from:

• forwarding it to colleagues;
• copying it to personal email;
• uploading it to an unauthorised cloud service;
• discussing it publicly;
• using it for personal purposes.

Restricted information adds another layer:

Only specifically authorised persons should be able to access the information at all.

4. Legal framework in India

Handling confidential and restricted information can involve several areas of Indian law.

Information Technology Act, 2000

The IT Act provides an important statutory framework for information security, unauthorised access and disclosure of certain information.

Digital Personal Data Protection Act, 2023

Where the information constitutes digital personal data, organisations must consider the obligations under the DPDP framework, including appropriate safeguards and obligations relating to processing and protection of personal data.

Indian Contract Act, 1872

Confidentiality obligations can arise contractually through:

• employment agreements;
• NDAs;
• vendor agreements;
• settlement agreements;
• consultancy contracts.

Copyright Act, 1957

Unauthorised copying or exploitation of protected material may create separate intellectual-property issues.

Trade secrets/common-law protection

India does not currently have one comprehensive standalone trade-secrets statute equivalent to some jurisdictions. Protection may instead arise through:

• contracts;
• equitable principles;
• confidentiality obligations;
• common-law remedies;
• intellectual-property principles.

5. Classification framework

An organisation should define each category precisely.

Confidential

Information where unauthorised disclosure could cause:

• commercial harm;
• employee harm;
• reputational damage;
• contractual breach;
• competitive disadvantage.

Examples:

• salary bands;
• internal presentations;
• customer lists;
• business plans;
• internal correspondence.

Restricted

Information where unauthorised access or disclosure could cause:

• serious personal harm;
• significant financial loss;
• regulatory consequences;
• major competitive damage;
• litigation risk;
• security compromise.

Examples:

• whistleblower identity;
• investigation files;
• medical information;
• privileged legal advice;
• acquisition negotiations;
• encryption keys;
• administrator credentials.

6. Access should follow the need-to-know principle

The fundamental control is:

Employees should receive access only to information necessary to perform their legitimate duties.

For example:

HR administrator

May access:

• employee master records;
• payroll information.

Should not automatically access:

• CEO's investigation file;
• whistleblower identity;
• legal advice;
• acquisition documents.

Payroll employee

May access:

• salary;
• bank details;
• tax information.

Should not automatically access:

• performance investigation documents.

Legal team

May access:

• privileged communications;
• investigation documents.

But legal access should itself be appropriately controlled.

7. Role-based access control

Organisations should use RBAC — Role-Based Access Control.

Example:

Technical administrators should not automatically receive unrestricted access to the underlying content merely because they maintain the system.

8. Encryption requirements

Sensitive information should be protected through encryption:

At rest

Examples:

• HR databases;
• laptops;
• file servers;
• cloud storage;
• backup systems.

In transit

Examples:

• employee portals;
• email transmission;
• API communication;
• vendor transfers.

During use

Where technically feasible, highly sensitive data can also be protected through:

• secure processing environments;
• tokenisation;
• masking;
• access-controlled applications.

9. Data loss prevention

A DLP programme should detect and prevent unauthorised movement of restricted information.

Controls can include:

• blocking uploads to personal cloud storage;
• preventing external email transmission;
• monitoring large downloads;
• detecting sensitive data in attachments;
• restricting USB transfers;
• watermarking documents;
• disabling unnecessary printing;
• controlling screenshots where appropriate.

However, monitoring must itself be proportionate and legally compliant.

10. Confidentiality agreements

Employment contracts and NDAs should specify:

1. What constitutes confidential information.
2. What constitutes restricted information.
3. Permitted purposes of use.
4. Permitted recipients.
5. Security requirements.
6. Disclosure exceptions.
7. Return/deletion requirements.
8. Duration of confidentiality.
9. Consequences of breach.
10. Treatment of information after termination.

A good clause should avoid defining everything as confidential without distinction.

11. Employee obligations

Employees handling confidential or restricted data should be required to:

• access information only for legitimate purposes;
• maintain passwords securely;
• use approved systems;
• avoid personal email;
• avoid unauthorised cloud services;
• verify recipients before sending information;
• report suspected breaches;
• follow clean-desk policies;
• securely dispose of documents;
• return company information after employment ends.

12. Handling during investigations

Investigation information should ordinarily receive a high level of protection.

For example, an internal harassment or misconduct investigation may contain:

• allegations;
• witness statements;
• interview recordings;
• emails;
• photographs;
• medical information;
• disciplinary recommendations.

Access should therefore be restricted to persons with a legitimate investigative, HR, legal or decision-making role.

Confidentiality should not, however, be used to prevent an employee from exercising a statutory right or participating lawfully in an investigation or proceeding.

13. Whistleblower information

Whistleblower records deserve particularly strong controls.

The organisation should consider:

• pseudonymisation;
• restricted case numbers;
• separate identity files;
• limited investigator access;
• secure reporting channels;
• access logging;
• anti-retaliation protections.

The person's identity should not be unnecessarily circulated through ordinary HR systems.

14. Medical and health-related information

Medical information should generally receive more restrictive handling than ordinary HR information.

Examples:

• medical certificates;
• occupational-health assessments;
• disability documentation;
• counselling records;
• fitness-to-work reports.

Access should be limited to persons who genuinely need the information.

Managers ordinarily need to know the workplace consequence of a medical assessment rather than unnecessary medical details.

15. Monitoring employee access

Organisations should maintain audit logs recording:

• who accessed the information;
• what was accessed;
• when it was accessed;
• what was downloaded;
• what was changed;
• what was transmitted externally.

For restricted information, periodic review of access logs is particularly important.

16. Retention and deletion

Confidentiality does not mean keeping information forever.

The organisation should establish:

Collection → Classification → Access → Use → Sharing → Retention → Deletion

At the end of the retention period:

• electronic files should be securely deleted;
• physical documents should be securely destroyed;
• access permissions should be revoked;
• backups should be handled according to the applicable retention architecture.

17. Third-party/vendor handling

Confidential and restricted information is frequently shared with:

• payroll vendors;
• HR software providers;
• cloud providers;
• recruitment agencies;
• consultants;
• auditors;
• external investigators;
• legal advisers.

Contracts should address:

• permitted processing;
• confidentiality;
• security safeguards;
• subcontracting;
• access controls;
• incident notification;
• audit rights;
• deletion/return;
• post-termination obligations.

A company should not assume that its own internal classification controls automatically apply to an external processor.

18. Data breach response

When restricted information is accidentally disclosed, the organisation should immediately:

Step 1 — Contain

Disable access and prevent further disclosure.

Step 2 — Preserve evidence

Maintain:

• access logs;
• emails;
• system records;
• device information;
• relevant documents.

Step 3 — Assess

Determine:

• what information was disclosed;
• whose information was affected;
• who received it;
• whether it was copied;
• whether it was further distributed.

Step 4 — Notify internally

Escalate to the appropriate:

• information-security team;
• privacy/data-protection team;
• HR;
• legal;
• management.

Step 5 — Consider legal notification

Where required by applicable law or regulation, determine whether notification to authorities or affected persons is necessary.

19. Six important Indian case laws

1. John Richard Brady v. Chemical Process Equipments P. Ltd., 1987 SCC OnLine Del 134

The Delhi High Court dealt with confidential business information and protection against misuse by persons who had access to such information.

Principle: Courts can protect confidential commercial information where disclosure or misuse would cause commercial injury.

Relevance: Employers should identify genuinely confidential information and impose appropriate contractual and equitable protections.

2. American Express Bank Ltd. v. Priya Puri, 2006 SCC OnLine Del 638

The Delhi High Court considered confidentiality and protection of business information in an employment context.

The court distinguished between legitimate confidential information and information that an employee is simply capable of remembering or using based on general skill and experience.

Principle: Not every piece of information obtained during employment automatically becomes a protected trade secret.

Relevance: Data classification should be specific rather than declaring every employee-related or business-related fact "restricted."

3. Diljeet Titus v. Alfred A. Adebare, 2006 SCC OnLine Del 813

The Delhi High Court considered confidential information and intellectual-property material in the context of an employment/professional relationship.

Principle: Confidential and proprietary materials can receive judicial protection against unauthorised use.

Relevance: Organisations should clearly identify proprietary documents, restrict access and maintain evidence demonstrating ownership and confidentiality.

4. Emergent Genetics India Pvt. Ltd. v. Shailendra Shivam, 2011 SCC OnLine Del 2776

The Delhi High Court considered confidential business information and employee obligations relating to proprietary information.

Principle: Confidential commercial information can warrant protection, particularly where contractual obligations and misuse of proprietary material are established.

Relevance: Confidentiality agreements should identify the nature of protected information and corresponding employee obligations.

5. Navigators Logistics Ltd. v. Kashif Qureshi, 2018 SCC OnLine Del 12936

The Delhi High Court dealt with protection of confidential business information and employee-related restrictions.

Principle: Protection of legitimate confidential information must be distinguished from an impermissible attempt to restrain ordinary competition.

Relevance: A confidentiality provision should protect information, rather than being drafted as an indirect substitute for an unenforceable post-employment restraint.

6. Burlington Home Shopping Pvt. Ltd. v. Rajnish Chibber, 1995 SCC OnLine Del 314

The Delhi High Court dealt with confidential information and customer/business databases.

Principle: Confidential business databases and proprietary information can receive protection against unauthorised exploitation.

Relevance: Customer databases, business records and proprietary datasets should receive appropriately controlled access and should not be treated as ordinary employee information.

20. Key principles from the case law

The cases demonstrate several important principles:

1. Confidential information can be legally protected

Courts may restrain misuse or disclosure of legitimate confidential information.

2. Not everything is confidential

Information must possess characteristics that justify protection.

3. Trade secrets and ordinary employee knowledge are different

An employee's general knowledge, experience and skills cannot simply be converted into company property.

4. Contractual confidentiality is important

Well-drafted employment agreements and NDAs strengthen the employer's position.

5. Confidentiality cannot become an unlawful restraint

A confidentiality provision should not merely disguise an attempt to prevent legitimate competition.

6. Technical security should complement contractual protection

A company claiming that information is highly confidential should also demonstrate that it actually restricted access and implemented reasonable security measures.

21. Practical HR classification policy

A company can implement the following framework:

Confidential

Access: Need-to-know within relevant business functions.

Controls:

• password protection;
• access permissions;
• encryption;
• confidentiality obligations;
• controlled sharing.

Restricted

Access: Named/approved individuals only.

Controls:

• MFA;
• encryption;
• RBAC;
• access logging;
• DLP;
• download restrictions;
• periodic access reviews;
• enhanced incident response.

22. Common mistakes

Mistake 1: Marking everything confidential

This weakens the credibility of the classification system.

Mistake 2: Giving broad HR access

HR employees should not automatically receive access to every sensitive employee record.

Mistake 3: No access logs

Without logs, it may be difficult to establish who accessed or disclosed restricted information.

Mistake 4: Personal email transfers

Employees should not transfer sensitive company information to personal accounts.

Mistake 5: Poor offboarding

When an employee leaves, organisations should immediately:

• revoke credentials;
• terminate system access;
• recover devices;
• retrieve documents;
• disable cloud access;
• remind the employee of continuing confidentiality obligations.

Mistake 6: Overreliance on NDAs

An NDA cannot compensate for inadequate technical and organisational security.

23. Recommended compliance matrix

Conclusion

The distinction between confidential and restricted data is fundamentally a matter of risk-based information governance.

Confidential information should be protected against unauthorised disclosure and misuse. Restricted information requires an additional layer of protection because access itself should be limited to specifically authorised persons.

For HR purposes, salary data, employment contracts and internal business information may ordinarily be confidential, while investigation files, whistleblower identities, medical records, privileged legal communications, sensitive M&A information and security credentials may warrant restricted classification.

The strongest compliance model combines clear contractual obligations, data classification, need-to-know access, RBAC, encryption, audit logs, DLP, vendor controls, retention rules and a documented breach-response process. The Indian case law also makes clear that protection is strongest when the employer can demonstrate both a genuine confidential interest and concrete measures taken to preserve confidentiality.