This article is general information, not legal advice. Check current requirements and consult counsel for your situation.
What the DPDP Act is The Digital Personal Data Protection Act, 2023 is India’s data protection law. It sets out how organisations (called data fiduciaries) may collect and use the personal data of individuals (data principals), and the rights individuals have over their data. Its rules are being brought into effect in phases, so check the current status.
Principles that matter for background verification - Notice. Candidates should be told what data is collected, why and how to exercise their rights. - Consent. Consent should be free, specific, informed and unambiguous, and easy to withdraw. - Purpose limitation. Data collected for verification should not be reused for unrelated purposes. - Data minimisation. Collect only what the checks need. - Accuracy. Data used to make decisions should be accurate and kept current. - Storage limitation. Delete or anonymise data when the purpose is complete. - Security. Protect data with reasonable safeguards, and manage breaches responsibly. - Grievance redressal. Provide a way for individuals to raise concerns.
The employment nuance The Act recognises certain “legitimate uses” of personal data, which include some employment-related purposes. That does not remove the need for care: background verification involves third-party data, sensitive checks and decisions with real consequences for the candidate. Clear notice and explicit consent remain the safest practice, particularly when data is collected from outside sources.
Candidate rights - Ask what personal data is held and how it is used. - Request correction of inaccurate data. - Request erasure when the purpose is complete, subject to legal retention requirements. - Withdraw consent for future processing. - Raise a grievance with the organisation and, if unresolved, escalate through the mechanisms the law provides.
What employers and providers should do 1. Give candidates a plain-language notice listing every check. 2. Record consent with date and time. 3. Collect only the documents the role requires. 4. Restrict access to verification data to those who need it. 5. Set and publish a retention period. 6. Let candidates see and respond to adverse findings. 7. Choose providers that can show how data is secured.
How HireScore approaches this HireScore is built around candidate consent, candidate control over who sees the full report, visible validity dates and a dispute process. Read more about how HireScore works and our privacy policy.
Frequently asked questions
Do I have to consent to background verification?
Employers may require verification as a condition of hiring, and you can decline, but they may then choose not to proceed. You are entitled to know what is being checked and why.
Can I ask an employer to delete my verification data?
You can request erasure once the purpose has been served, subject to any retention periods the law requires. Ask the employer or their provider for their retention policy.
Does the DPDP Act ban background checks?
No. It governs how personal data is handled during them: with notice, purpose limitation, safeguards and respect for individual rights.