DPDP for HR Teams: Employee Data, Background Checks and Candidate Consent
HR sits on some of the most sensitive personal data in the company. Here's what changes under DPDP for recruitment, background checks and employee files.
Employment data has its own legal ground
Section 7 of the DPDP Act recognises employment-related purposes as a legitimate use in narrow circumstances — processing needed for hiring, or for terminating an employment relationship, or to safeguard the employer from loss including corporate espionage or the disclosure of confidential information. This gives HR a lawful ground beyond consent for a slice of what it does, but it is not a blanket exemption for every employee data activity.
Day-to-day HR work still runs on a mix of grounds: onboarding paperwork and background checks usually flow from voluntarily provided information and legitimate use, while things like optional wellness programmes, internal surveys, or family details collected for non-mandatory benefits are better anchored in explicit consent under Section 6. Don't assume 'it's an employee' answers the lawful-basis question for everything you collect.
Candidate data and background checks
Candidates are not yet employees, so lean less on the employment carve-out and more on clear notice and, where you're relying on it, consent. Before a candidate submits a resume through your portal, give itemised notice under Section 5 describing what you collect, why, and who it's shared with — including any external background-verification vendor.
Background-check vendors are Data Processors. Section 8(2) requires a valid contract in place before you hand candidate data to them, covering the purpose of processing, security expectations, and what happens to the data when the check is complete. If the vendor pulls data from third-party sources (previous employers, education boards, credit bureaus), make sure your notice to the candidate reflects that this is happening, not just that 'a check will be conducted.'
Set a retention trigger for rejected-candidate data. Holding resumes 'in case a role opens up later' is a common practice, but under Section 8(7) data should be erased once the purpose is served unless you have a documented, separate purpose (like a talent pool) that the candidate was told about and, ideally, can opt into.
Employee files, appraisals and monitoring
Personnel files, appraisal records, disciplinary notes and payroll data are all personal data, and much of it is used to make decisions that affect the employee — which means Section 8(3)'s accuracy expectation applies. If an appraisal score or disciplinary record feeds into a promotion or termination decision, HR should have a process for employees to flag and correct factual errors, distinct from disputing the manager's judgment itself.
Workplace monitoring — email scanning, keystroke logging, CCTV in office areas — should be scoped narrowly and disclosed to employees, not just buried in an onboarding policy nobody reads. Employees have the same rights to access (Section 11) and correction (Section 12) as any other data principal, and HR is usually the team fielding those requests internally, so a clear internal process for handling them matters even before a formal grievance mechanism is invoked.
Exit and post-employment data
When someone leaves, define what gets retained (statutory records like PF/tax filings, which have their own retention mandates) versus what should be erased once its business purpose ends. A common gap is former-employee data sitting untouched in HRIS systems for years with no documented reason.
If an ex-employee submits a rights request, HR needs a route to identify and act on it even though the person is no longer active in the system — don't let 'inactive employee' become a reason requests fall through the cracks.
Where to go next
Use the Personal Data Inventory to map every category of employee and candidate data HR holds, and check background-check and payroll vendors against the Vendor Assessment before the next hiring cycle starts.