Quick Answer
Recruitment agencies and staffing firms process personal data of job candidates including CVs, background check results, and reference details. Under the DPDP Act 2023, candidate data can be processed under legitimate use (recruitment purpose) but cannot be retained indefinitely or shared with other clients without consent. Background verification firms acting as Data Processors must sign DPAs with their staffing firm clients.
Quick AnswerRecruitment firms must obtain explicit consent before sharing candidate data with employers, implement data minimisation in CV databases, and delete candidate records after defined retention periods.
DPDP Compliance Checklist
- Obtain explicit candidate consent before submitting their profile to any employer
- Implement consent refresh for CV databases older than 6 months — old consent may expire
- Restrict background verification data to verified employment checks only — no excess collection
- Allow candidates to withdraw consent and delete their data from your database on request
- Review job portal integrations (Naukri, LinkedIn, Indeed) for data sharing compliance
- Train recruiters on data minimisation — don't collect salary slips until offer stage
- Implement secure storage for background check reports — restrict access to HR and compliance
- Publish clear privacy notice on website explaining how candidate data is used
- Implement data retention policy — delete candidate data within 12 months of last interaction
- Conduct semi-annual audit of candidate database for outdated or orphaned records
Download Full Compliance Guide (Free)
Get the complete sector-specific checklist, risk areas, and 30-day action plan — delivered to your inbox.
Frequently Asked Questions
Can recruitment firms maintain CV databases indefinitely?+
No. DPDP requires purpose limitation and storage limitation. Candidate data should be deleted or consent refreshed after a defined period — typically 6-12 months of inactivity.
Does DPDP apply to background verification data?+
Yes. Background check data is sensitive personal data. Collection must be limited to what is necessary, stored securely, and deleted after the hiring decision.
Can staffing agencies share candidate data across geographies?+
Cross-border sharing of candidate data requires compliance with DPDP transfer restrictions and explicit candidate consent.
Every Sunday
The Sunday DPDP Brief
One real DPDP development explained in plain English, one practical how-to, one number from our own assessment data. Nothing else — no daily noise, no sales pitch.
No spam. Unsubscribe with one click, anytime.
