For HR teams, recruitment agencies and staffing firms
DPDP compliance for HR and recruitment
Every organisation is an employer, and every hiring process piles up CVs, ID proofs and background checks. The DPDP Act gives employers a specific legitimate use for employment, but candidates and recruiters sit outside it. ConsentKit covers both sides.
- Employment purposes
- Legitimate use, no consent
- Candidate CVs
- Need a notice and a limit
- Full compliance
- 13 May 2027
Northwind Logistics asks for your consent
Choose how we may use your application. You can change this anytime.
Where the DPDP Act touches hire to retire
Candidates need consent. Employees are mostly covered by the employment legitimate use. Pick a stage to see where the line falls.
What changes for HR on 13 May 2027
Every employer is a data fiduciary for its staff. Recruitment is where the consent duties bite hardest.
Candidates need a notice and a choiceSections 5 and 6
Applying for one role is not consent to join a talent pool or be shared with other companies.
A careers-page notice with separate choices for each use of the CV.
Employment is a legitimate use, within limitsSection 7(i)
Processing for employment and to protect the employer from loss or liability does not need consent. It still needs a notice, security and purpose limits.
An employee notice and a register mapping HR data to purposes.
Background checks need a clear basisSection 6
Candidates should know what will be checked and by whom, and verification vendors must be bound by contract.
Background check consent and a vendor register.
Recruiters need consent to submit CVsSection 6
Agencies need each candidate’s consent before sending a CV to a client.
Per-client submission consent tracked in your ATS.
Employees and candidates have rightsSections 11 to 14
They can request access, correction and erasure where law allows, and raise grievances.
A request portal for staff and candidates with deadlines.
HR systems need real securitySection 8(5) and Rule 6
HRMS, payroll and ATS systems hold salaries, bank details and IDs. Access logs must be kept for at least a year.
Access controls and audit evidence for your HR stack.
A plan for HR and TA teams
Start with recruitment, where consent is needed, then tidy employee records.
Map HR data
List ATS, HRMS, payroll, background vendors, insurers and agencies.
Fix the careers page
Add candidate notices and choices, and set talent pool retention.
Employee notice and vendors
Publish an employee privacy notice and update vendor contracts.
Clean up and train
Delete old candidate data and train HR on requests and breaches.
For every kind of HR function
Templates for your role in hiring.
In-house HR teams
Employees plus your own hiring.
Recruitment agencies
Candidates submitted to many clients.
Staffing firms
Contract workers deployed at client sites.
Background verification firms
Processors for employers.
HRMS and payroll vendors
Processors with many client employers.
Campus hiring teams
Student data shared by colleges.
DPDP compliance for HR teams near you
Local guidance and onboarding in these cities, with support from our team in Kolkata.
Related sectors
Questions HR teams are asking
For the full picture, read our DPDP Act guide or compliance checklist.
Do we need employees’ consent to process their data?
Not for employment purposes. Section 7(i) allows processing for employment and to safeguard the employer from loss or liability. You still need a notice, security and purpose limits.
Can we keep CVs of candidates we didn’t hire?
Only with their consent for a talent pool, for a period you state. Otherwise delete them once the role is filled.
Can recruiters send a CV to several clients?
Only with the candidate’s consent for each submission.
Is employee monitoring allowed?
Monitoring to protect the employer can fall under the employment legitimate use, but it should be disclosed and proportionate.
How long do we keep ex-employees’ records?
As long as labour, tax and PF laws require. Delete the rest when its purpose ends.
Get your hiring and HR ready before May 2027
The readiness check takes about ten minutes and gives you a gap report built for HR and recruitment.