Getting a new India employee productive on day one comes down to three decisions: who supplies and owns the laptop, how it’s secured, and how access is granted and removed. Two Indian rules shape those decisions. The Digital Personal Data Protection (DPDP) Act and Rules require reasonable security safeguards for personal data, with penalties of up to ₹250 crore. And CERT-In’s 2022 cybersecurity directions require organisations in India to report specified cyber incidents within six hours and keep system logs for 180 days.
This guide covers the options for supplying IT equipment for EOR employees in India, a practical security baseline, access on day one and the last day, what the Indian rules mean in practice, and how responsibilities split between you and your Employer of Record (EOR). Information was checked against the sources listed at the end on 20 October 2026.
Device options at a glance
| Option | How it works | Pros | Watch out for |
|---|---|---|---|
| Ship a laptop from abroad | You buy a laptop at home and courier it to India | Same model and image as your other staff | Customs clearance, import duty and paperwork, delays, warranty that may not be honoured locally |
| Buy locally in India | A laptop is bought in India for the employee | Fast delivery, local warranty and service, GST invoice | Who owns it, and how it’s enrolled in your device management |
| EOR-provided equipment | Your EOR supplies and supports the laptop as part of its plan | No import or procurement work for you; local support | Configuration standards and return process at exit |
| Bring your own device (BYOD) | The employee uses a personal laptop | No hardware cost | Hard to secure, mixes personal and company data, harder to recover data at exit |
For most companies, buying locally or using EOR-provided equipment is faster and simpler than shipping from abroad. BYOD is best avoided for roles that touch source code, customer data or financial systems.
Shipping laptops to India: what to know
Shipping a laptop to an employee in India means importing it. Expect customs clearance, import duty and taxes, and documentation such as an invoice and the recipient’s details. Shipments can be held for days or weeks if paperwork is incomplete, and a warranty bought abroad may not be serviced in India. If you do ship:
- Use a courier experienced with commercial imports into India, and agree in advance who is the importer and who pays duty.
- Pre-configure and enrol the device in your device management before it ships.
- Plan for repairs locally, or keep a spare device in India.
- Remember that you’ll need to recover the device when the employee leaves.
Buying locally in India
Buying in India avoids import delays and gives you local warranty and service. Decide up front:
- Who owns the device. With an EOR, the device may be owned by the EOR’s entity, by your company, or leased. Write it into your agreement.
- How it’s configured. Use automated enrolment so the device arrives ready for your device management, or have the employee enrol it on first login.
- Accessories. Monitor, keyboard, headset and webcam make a real difference for video-heavy teams.
- Refresh cycle. Plan replacement every three to four years for engineering roles.
Typical setups by role
| Role | Device | Extra controls |
|---|---|---|
| Software engineer | High-memory laptop, external monitor | Code repository access by team, secrets management, no production access by default |
| Data or AI engineer | High-spec laptop; heavy workloads run in the cloud | Data access by approved dataset, no customer data on local drives |
| Finance and accounting | Standard laptop, two monitors | Strict access to financial systems, approval workflows, background verification |
| Customer support | Standard laptop, quality headset | Access to support tools only, masked customer data where possible |
| Managers | Standard laptop | Access to HR information limited to their team |
A security baseline for India EOR employees
Apply the same security standard to employees in India as anywhere else. A practical baseline:
| Control | What good looks like |
|---|---|
| Device management (MDM) | Every company device enrolled, with policies for passcodes, encryption, updates and remote lock or wipe |
| Full-disk encryption | Enabled and enforced on every laptop |
| Operating system and app updates | Automatic, with a deadline for critical patches |
| Endpoint protection | Endpoint detection and response on every device, monitored centrally |
| Single sign-on and multi-factor authentication | One identity for all company apps, with MFA everywhere, ideally phishing-resistant |
| Least-privilege access | People get only the systems their role needs; admin rights by exception |
| Password manager | Company-managed, for any credential not behind single sign-on |
| Secure network access | A VPN or zero-trust access for internal systems; no shared accounts |
| Backups | Work stored in company cloud systems, not only on the laptop |
| Security awareness training | At onboarding and at least yearly, including phishing simulations |
| Logging | Logs enabled on key systems and kept long enough to investigate incidents |
Day one: getting access right
- Create accounts before the start date: identity, email, chat, code repositories and the tools the role needs.
- Deliver and enrol the laptop before day one, so the first morning is spent working, not waiting.
- Grant access by role, using groups rather than individual permissions.
- Run security training in week one, and have the employee confirm your acceptable-use and data policies.
- Confirm IP and confidentiality terms are in the appointment letter, so work created from day one belongs to your company.
The last day: removing access and recovering equipment
Exits in India move quickly. Final wages are due within two working days of the last working day under Section 17(2) of the Code on Wages, so plan IT offboarding at the same time:
- Schedule access removal for the end of the last working day: identity, email, code repositories, cloud consoles and third-party tools.
- Transfer ownership of documents, repositories and shared drives before access is removed.
- Recover company devices with a pre-paid courier or drop-off, and wipe them through device management.
- Revoke tokens and keys, including API keys, SSH keys and personal access tokens.
- Record the handover, so you can show what was returned and removed.
If the employee is on garden leave during the notice period, remove system access at the start of garden leave. See our guide to the notice period in India.
Indian rules that affect devices and security
CERT-In cybersecurity directions
The CERT-In directions of 28 April 2022, issued under Section 70B of the Information Technology Act, apply to service providers, intermediaries, data centres, body corporates and government organisations in India. Key requirements, as summarised by Khaitan & Co:
- Report specified cyber incidents to CERT-In within six hours of noticing them, including unauthorised access to systems or data, data breaches and leaks, and compromise of critical systems.
- Keep logs of ICT systems for a rolling 180 days, securely and within India, and provide them to CERT-In when asked.
- Synchronise system clocks with the National Informatics Centre or National Physical Laboratory time servers, or sources traceable to them.
- Name a point of contact for CERT-In.
Non-compliance can lead to imprisonment of up to one year, a fine of up to ₹1 lakh, or both. CERT-In publishes FAQs on the directions that explain how they apply.
DPDP Act and Rules
The Digital Personal Data Protection Act 2023 and the DPDP Rules, notified on 14 November 2025, require reasonable security safeguards for personal data. That includes employee data and any customer personal data your India team handles. According to the government’s summary, penalties go up to ₹250 crore for failing to maintain security safeguards and up to ₹200 crore for failing to notify a breach. Laptops are where much of that data lives, so encryption, device management and fast offboarding are part of DPDP compliance, not just good IT practice.
What this means in practice
- Agree with your EOR, in writing, how a security incident involving an India employee or device is reported and who notifies CERT-In and affected individuals.
- Make sure logs from systems used in India are kept long enough and can be produced if needed.
- Keep customer and employee personal data off local drives where possible.
- Get legal advice on how the directions apply to your specific setup.
If a device is lost or stolen
- The employee reports it immediately to IT and their manager, ideally within an hour.
- IT locks or wipes the device through device management and signs the user out of all sessions.
- Reset credentials and revoke tokens stored on the device.
- Assess what data was on it. If personal data may have been exposed, decide quickly whether it’s a reportable incident under the CERT-In directions or the DPDP Rules, and involve your EOR if the employing entity is affected.
- File a police report where theft is involved; it’s often needed for insurance.
- Issue a replacement so the employee can keep working.
A written, rehearsed process matters most here, because the six-hour CERT-In reporting window doesn’t leave time to work things out from scratch.
Monitoring employees: be transparent
Security tools often collect data about how devices are used. Under the DPDP framework, people should know what personal data is collected and why. Tell employees in writing what your device management and security tools monitor, keep monitoring proportionate to security needs, and avoid collecting personal content you don’t need. Hidden or excessive monitoring damages trust and creates legal risk.
Who is responsible for what
| Area | You | Your EOR |
|---|---|---|
| Security standards for your systems and data | Set and enforce them | Support them in the employee’s contract and policies |
| Laptop supply | Supply it yourself, or | Supply it as part of the plan, where included |
| Device management and endpoint protection | Usually run by your IT team | Ensure the employee follows policy |
| Accounts and access to your tools | Grant and remove | Notify you of start and exit dates |
| Security training | Company-specific training | General awareness training, where included |
| Employee personal data (HR, payroll) | Handle only what you need | Protect as the employer |
| Incident reporting in India | Report incidents in your systems | Coordinate where the employing entity is involved |
| Equipment recovery at exit | Wipe and reassign | Coordinate return as part of offboarding |
Customer security reviews
If you sell to enterprises, your customers will ask how you secure people and devices outside your home country. Be ready to show:
- Your device management and encryption policy, and evidence it’s applied in India.
- Your access control and offboarding process, including timelines.
- Background verification for employees with access to customer data. See our guide to background verification in India.
- Security awareness training records.
- How your EOR protects employee data, and which company employs your team. See direct vs indirect EOR.
What to put in your equipment and security policy
- Who owns company equipment, and what must be returned at exit.
- Acceptable use, including personal use and software installation.
- Requirements for home networks, public Wi-Fi and travel.
- How to report a lost or stolen device, and how quickly.
- Rules for customer data, source code and confidential documents.
- What monitoring tools collect, and why.
- Consequences of policy breaches.
Reference the policy in the employee’s appointment letter, and ask for written acknowledgement at onboarding.
Budget checklist for each new India employee
- Laptop suited to the role, bought locally or supplied by your EOR.
- Accessories: monitor, keyboard, mouse, headset and webcam.
- Software licences, including device management and endpoint protection.
- Internet or home-office allowance, if you offer one.
- Security training.
- Courier and recovery costs at exit.
- A refresh every three to four years.
Global EOR platforms increasingly sell IT equipment as an add-on; Multiplier, for example, lists IT asset procurement in 130+ countries on its pricing page. Compare what’s included in each provider’s base fee.
Why StratEdge Global: one partner, one platform
StratEdge Global builds equipment and security into employment, so your India team is ready on day one.
- KnowBe4 security awareness training included in every plan, from $349 per employee per month with health insurance.
- Laptop and accessories, a dedicated office seat and on-site HR and infrastructure support included in the ENHANCED plan at $549 per employee per month.
- Background verification and priority compliance support included in ELEVATE at $749.
- India employees employed through StratGrid Private Limited in Bengaluru, with one team coordinating onboarding, offboarding and equipment.
- Real-time visibility of start dates, exits and documents in EmpleYor.
See pricing, or book a free 30-minute call to plan equipment and security for your India team.
Sources
Official sources
- CERT-In: Directions under Section 70B(6) of the IT Act, 28 April 2022
- CERT-In: FAQs on the Cyber Security Directions
- Press Information Bureau: Digital Personal Data Protection Rules, 2025
Legal and industry analysis
- Khaitan & Co: CERT-In directions and cyber incident reporting
- LiveLaw: Code on Wages and the two-working-day final settlement rule
- Multiplier pricing: IT assets add-on
All sources checked on 20 October 2026.
This guide is general information, not legal or security advice. Requirements depend on your systems, data and contracts; take advice for your situation.
FAQ
Should I ship a laptop to my employee in India or buy one there?
Buying in India is usually faster and simpler. Shipping from abroad means customs clearance, import duty and paperwork, and the warranty may not be honoured locally.
Who owns a laptop provided to an EOR employee?
It depends on your agreement. The device may belong to your company, to the EOR’s entity or to a leasing provider. Put ownership and return terms in writing.
Do CERT-In rules apply to my India team?
CERT-In’s 2022 directions apply to body corporates and other organisations in India, including requirements to report specified incidents within six hours and keep logs for 180 days. Take legal advice on how they apply to your setup and your EOR.
Is BYOD allowed for India employees?
It’s allowed, but risky for roles with access to source code, customer data or financial systems. Company-managed devices are easier to secure and recover.
How quickly should access be removed when an India employee leaves?
By the end of the last working day, or at the start of garden leave. Final wages are due within two working days, so plan IT offboarding alongside the final settlement.
Does StratEdge Global provide laptops?
Yes. The ENHANCED plan includes a laptop and accessories, a dedicated office seat and on-site HR and infrastructure support, at $549 per employee per month.
What security training should India employees receive?
Security awareness training at onboarding and at least once a year, including phishing simulations, plus company-specific training on handling customer data and source code. StratEdge Global includes KnowBe4 training in every plan.
Can my EOR run device management for my India employees?
Usually your own IT team runs device management so all employees follow one standard. Your EOR supports it through the employment contract and policies, and can supply and support devices where its plan includes them.