Hiring under the DPDP Act: CVs, interviews and background verification

A single job opening can bring in hundreds of CVs, each with a name, phone number, address, education, salary history and sometimes a photo. Most of those people will never work for you. Under the DPDP Act, you still owe them duties.

Candidates aren’t employees yet

Section 7(i) allows processing “for the purposes of employment”. Whether that extends to candidates is debated. Many organisations will take a cautious route:

• Rely on the “voluntarily provided” legitimate use (section 7(a)) for a CV a candidate sends for a specific job, used for that job.
• Use consent for anything beyond that: keeping CVs for future openings, sharing with group companies, or background verification.

Job portals and recruiters

• A recruitment agency that sources candidates for you may be a fiduciary for its own database and a processor when it handles your hiring.
• Applicant tracking systems are processors. They need a contract.
• Downloading CVs from job portals in bulk and keeping them indefinitely is risky. Use them for the role, then delete.

Background verification

Background verification (BGV) checks education, previous employment, address, criminal records and sometimes credit. It involves third parties and sensitive information, so:

• Get clear consent with a notice that says which checks will be done, by whom and how long results will be kept.
• Limit checks to what the role needs. A credit check for a delivery associate is hard to justify.
• Make sure the BGV vendor has a contract covering security, sub-processing and deletion.
• Give candidates a way to correct errors before you act on adverse findings. Section 8(3) requires accuracy when data is used to make a decision about someone.

Interview notes and assessments

Notes, scores and recordings are personal data. Keep them factual, store them securely, and delete them on a schedule. A candidate can ask for a summary of the data you hold.

Retention

Set periods, for example:

These are examples, not legal limits. Choose periods that fit your needs and any legal duties.

Checklist

1. Add a short privacy notice to job ads and application forms.
2. Ask separately before keeping CVs for future roles.
3. Get specific consent for background checks.
4. Sign processor contracts with ATS and BGV vendors.
5. Delete candidate data on schedule.

Go deeper

Our courses cover HR and recruitment scenarios in detail. Browse the courses.

This article is for education and is not legal advice.