The Digital Personal Data Protection Act 2023 treats every resume, application form and interview note as personal data. The hiring company is the data fiduciary; an agency or ATS vendor working on its behalf is usually a processor. Notice, consent, erasure and breach duties apply from 13 May 2027 under the DPDP Rules, with penalties up to 250 crore rupees for failing security safeguards.
Key takeaways:
- Candidates are data principals. The employment exemption in the Act is written for existing employees, and the law firms that have looked at it say not to rely on it for candidates.
- Consent at application, with a notice in plain language, is the safe basis. Keeping a candidate in a talent pool for future roles needs its own consent.
- Erase when the purpose is served or consent is withdrawn, whichever comes first, and make your ATS vendor and agencies erase too.
- A staffing agency is a fiduciary for its own database and usually a processor inside a client's hire. Write both roles into the contract.
- The three-year retention cap in the Rules applies to large e-commerce, gaming and social media platforms, not to recruiters. Your retention period is the one you set and state.
This guide is written for hiring teams, not as legal advice. A lawyer reviewed the final draft on [date]. Check the Rules and your counsel before changing a process.
Most guidance on the DPDP Act is written for the whole company. The pages that rank for recruiters are either a short vendor explainer or a law firm's deep dive on background verification. Neither gives a recruiter a list to work through. This one does: what the Act and the Rules say, what each rule means for a resume, what to do with the database you built before consent was a thing, how an agency holding a client's data is treated, and which features in an ATS or recruitment management system make the list possible.
What the DPDP Act is and when it applies to recruitment
The Act received the President's assent on 11 August 2023. The Digital Personal Data Protection Rules 2025 were notified by G.S.R. 846(E) on 13 November 2025. The Rules come into force in three phases :
- 13 November 2025: definitions and the Data Protection Board.
- 13 November 2026: registration and obligations of consent managers.
- 13 May 2027: notice and consent, fiduciary obligations, security, breach reporting, erasure, data principal rights, cross-border rules.
So the rules that change a recruiter's day are eighteen months away from the gazette date. That is the window for fixing the process. Vendor blogs that say enforcement for HR is already under way are ahead of the Rules.
Who is the data fiduciary and who is the data processor in a hire
The data principal is the person the data is about: the candidate. The data fiduciary decides the purpose and means of processing: the company hiring. The data processor processes on the fiduciary's behalf under a contract: the ATS or RMS vendor, the background verification agency, and often the staffing agency. The fiduciary carries the obligations and the penalties. It must make its processors erase data when it does.
What counts as candidate personal data
Name, phone, email, address, date of birth, photo, resume, education and employment history, salary, references, interview notes and scores, test results, call recordings and transcripts, background check reports, and any ID documents collected at offer. All of it is personal data under the Act. There is no separate category for a resume because the candidate sent it to you.
The DPDP Act's rules for candidate data, in plain words
| Rule | What it means for hiring | What to do |
|---|---|---|
| Notice and consent (Rule 3) | Before using a resume you must show a plain-language notice: what data, what purpose, how to withdraw, how to complain | A consent step at application, time-stamped, with the notice text stored |
| Purpose limitation (Section 7(a)) | Data given for one role is for that role | Separate consent for the talent pool and future roles |
| Erasure (Section 8(7)) | Erase when purpose is served or consent is withdrawn, whichever is earlier, unless law requires retention | A retention period per role, an erasure workflow, and the same instruction to vendors and agencies |
| Pre-erasure notice (Rule 8(2)) | At least 48 hours' notice before erasure, for the classes listed in the Rules | Not required of recruiters by class; good practice to send one |
| Rights (Sections 11 to 14) | Access, correction, erasure, grievance, nomination; answer within 90 days (Rule 14) | A grievance channel on the careers page and a way to pull one candidate's full record |
| Security safeguards (Section 8(5)) | Reasonable security; breaches must be reported | Role-based access, audit logs, encryption, a vendor with a SOC 2 or ISO 27001 report |
| Breach reporting (Rule 7) | Tell each affected candidate and the Board without delay; full report to the Board within 72 hours | An incident plan that names who tells whom, with the ATS vendor's contract matching it |
| Cross-border (Section 16, Rule 15) | Transfers allowed except to countries the government restricts | Know where the ATS, the BGV vendor and the client hold data |
| Penalties (Section 33) | Up to 250 crore rupees for security safeguard failures, 200 crore for breach notification failures, 50 crore for other obligations | Treat the ATS contract as a compliance document |
Sources for the table: MeitY gazette; AZB & Partners; PIB backgrounder; S.S. Rana.
Notice and consent at application
The notice must be understandable on its own, in plain language, with an itemised list of the data, the purposes, a link to your site, and how to withdraw consent as easily as it was given. A checkbox buried in a job board's terms does not meet that. The application form on your careers page, the vendor portal an agency uses, and the WhatsApp opt-in all need the same notice.
Purpose limitation: the resume is for this role unless they agree otherwise
Lakshmikumaran & Sridharan read Section 7(a) to mean a candidate's data is usable for the purpose they gave it for, and that keeping them in a pipeline for other roles needs fresh consent. The practical form is a second checkbox: "Keep my profile for similar roles for 12 months."
Retention and erasure: how long to keep a candidate record
The Act does not give recruiters a number. It gives a test: erase when the purpose is served, unless another law requires you to keep it. The three-year cap in the Third Schedule applies to large e-commerce, online gaming and social media platforms. So the recruiter sets the period, states it in the notice, and keeps to it. Many teams pick six to twelve months after a role closes for unsuccessful candidates; the number matters less than the fact that it is written down and enforced by the system.
Candidate rights: access, correction, erasure, grievance
A candidate can ask what you hold, ask you to correct it, ask you to erase it, and complain if you do not. The Rules give up to 90 days to respond. The hard part is not the policy; it is pulling one person's record out of five systems, three agencies and a BGV vendor. That is an ATS feature, covered below.
Penalties and the Data Protection Board
The Board hears complaints and imposes penalties. The amounts are large enough that a hiring team's data practice is now a board-level question, not an HR one.
The old resume database problem: what to do with CVs collected before consent
Every recruiter has one: ten years of resumes in a database, a shared drive and old email. None of those people consented to anything beyond the role they applied for. Three options, in order of effort.
First, re-consent. Send one message to everyone in the database you can still reach, with the notice and a link to opt in to the talent pool. Keep those who say yes. Second, time-box. Set a cut-off, say 24 months since last contact, and erase everything older. Third, erase and start again with consent at the door. Most teams do the first and the second together, and are surprised how small the useful database was.
Whatever you choose, do it before 13 May 2027 and record what you did. The Board will ask what your process was, not whether it was perfect.
Staffing agencies: holding client data as a processor
An agency holds two kinds of candidate data. Its own database, collected under its own notice, where it is the fiduciary. And the candidates it submits to a client's role, where it processes on the client's instructions and is usually a processor. Trilegal's guidance on background checks makes the same distinction for BGV agencies, which it says typically act purely as processors.
What the client agreement must say
Section 8(2) of the Act lets a fiduciary engage a processor only under a valid contract. So the client agreement needs to say which party is fiduciary for which data, what the agency may do with the candidate's data after the role closes, how long each party keeps it, who answers a candidate's erasure request, and who tells whom in a breach. Agencies that work inside a client's vendor management system should check that the VMS terms say the same. Our vendor management system for recruitment guide covers the portal side.
Submitting one candidate to three clients
The agency's notice must cover it: "We will share your profile with employers whose roles match, and tell you which." Submitting to a client's direct competitor without the candidate knowing is a purpose the candidate did not agree to. The fix is the same as the ownership rule in any good agency: ask, and log the answer.
Background verification and cross-border transfers under the DPDP Act
A background check is processing of its own. King Stubb & Kasiva's checklist for employers: give notice, run only checks relevant to the role, collect the minimum, put the BGV agency under a Section 8(2) contract, set a retention policy for unsuccessful candidates, and map any cross-border flow under Section 16 . The BGV vendors say the same from their side: OnGrid asks for explicit, purpose-specific consent in a standalone document rather than a line in the offer letter ; SpringVerify will not start a check without signed consent .
Cross-border transfers are allowed except to countries the central government restricts by notification. The practical question for a recruiter is where the ATS, the BGV vendor and, for agencies, the client hold the data. Ask, and write the answer into the data map.
The DPDP recruitment checklist
- [ ] A plain-language notice on every application route: careers page, job boards, agency portal, WhatsApp opt-in
- [ ] Consent captured with a time stamp and the notice version stored
- [ ] A separate consent for the talent pool and future roles
- [ ] A stated retention period per role, enforced by the system
- [ ] An erasure workflow that reaches backups, the ATS vendor, BGV vendors and agencies
- [ ] A grievance channel on the careers page and a named owner
- [ ] A way to pull one candidate's full record within days, not weeks
- [ ] Role-based access: agencies see only their submissions; interviewers see only their candidates
- [ ] Audit logs on who viewed and changed each record
- [ ] A Section 8(2) contract with the ATS vendor, each BGV vendor and each agency
- [ ] A breach plan: who tells candidates, who files the 72-hour report to the Board
- [ ] A data map showing where each system holds data, including outside India
- [ ] A decision on the old database: re-consent, time-box or erase, recorded
- [ ] Consent and notice for call recordings, AI interviews and transcripts
- [ ] A date for legal review of all of the above before 13 May 2027
Sample consent notice for a job application
How we use your data (Recruit360.AI sample notice; edit before use and have counsel review)
Who we are: [Company], [address], [grievance email].
What we collect: your name, contact details, resume, education and work history, salary details, interview notes, assessment results and, if you reach the offer stage, identity documents and a background check report.
Why: to consider you for [role] and to contact you about it.
Who sees it: our hiring team, interviewers, our recruitment software provider [name], and [BGV vendor] if you reach the offer stage. Staffing agencies that submitted your profile see only their own submission.
How long: [12] months after this role closes, unless you ask us to erase it sooner or a law requires us to keep it.
Your choices: you can ask for a copy, a correction or erasure, or withdraw consent, by writing to [grievance email]. We reply within 90 days. You can complain to the Data Protection Board of India.
[ ] I consent to the use of my data for this role.
[ ] Optional: keep my profile for similar roles for 12 months.
ATS and RMS features that make DPDP compliance possible
Consent capture at application with the notice version and time stamp on the record. Retention rules per role that start the clock at close and erase on schedule. An erasure workflow that covers backups and sends the instruction to vendors and agencies. One-click export of a single candidate's full record for an access request. Audit logs on every view and edit. Role-based access so an agency in the vendor portal sees only its own submissions. Consent prompts before AI interviews, call recordings and WhatsApp messages. A SOC 2 or ISO 27001 report you can read before signing. The scoring matrix in how to choose recruitment software carries these as a weighted row.
How Recruit360.AI helps with the DPDP checklist
Recruit360.AI records consent at application with the notice text and a time stamp, holds a retention period per requisition, and runs erasure as a workflow that logs what was deleted and when. Agencies in the vendor portal see only their own submissions. AI Interview and Agent Calling ask for consent before recording, and the transcript sits on the candidate record under the same retention rule. Audit logs cover every view. The platform is SOC 2 compliant and GDPR ready; ask for the report on the demo, and bring your counsel's checklist.
Frequently asked questions
Does the DPDP Act apply to job applicants?
Yes. A resume, an application form and interview notes are personal data, and the candidate is a data principal. The employment exemption in Section 7(i) is written for existing employees; law firms advise employers to use notice and consent for candidates.
When do the DPDP rules for recruitment take effect?
The Rules were notified on 13 November 2025. Consent manager rules apply from 13 November 2026. Notice, consent, erasure, breach reporting and data principal rights apply from 13 May 2027.
Do I need consent to keep a resume on file?
You need a notice and consent for the role applied for. Keeping the profile for future roles is a different purpose and needs its own consent, usually a second checkbox.
How long can a recruiter keep candidate data under the DPDP Act?
Until the purpose is served or consent is withdrawn, whichever is earlier, unless another law requires retention. The three-year cap in the Rules applies to large e-commerce, gaming and social media platforms, not to recruiters. Set your own period and state it.
Is a staffing agency a data fiduciary or a data processor?
Both, depending on the data. It is the fiduciary for its own database and usually a processor when it submits candidates into a client's hiring process. The client contract should say which role applies to which data.
What are the penalties under the DPDP Act?
Up to 250 crore rupees for failing to take reasonable security safeguards, up to 200 crore for failing to report a breach, and up to 50 crore for other breaches of the Act.
Do I need consent to record an AI interview or a screening call?
Treat recordings and transcripts as personal data collected for the role. Tell the candidate before recording and record their consent. The transcript then follows the same retention rule as the rest of the record.
What should I ask my ATS vendor about DPDP?
Where data is hosted, how consent is captured and stored, how retention and erasure work including backups, whether audit logs and role-based access exist, how a single candidate's record is exported, and whether they will sign a Section 8(2) processor contract.
Does a background check need separate consent?
The BGV vendors and law firms say yes: explicit, purpose-specific consent in a standalone document before the check starts, naming the checks and the agency.
Can candidate data be sent outside India?
Yes, except to countries the central government restricts by notification. Know where your ATS, BGV vendor and clients hold data and record it in a data map.