DPDP compliance for recruitment and staffing companies
Recruitment firms collect sensitive candidate data and share it widely. The DPDP Act sets clear rules on consent, retention, and candidate rights.
What candidate data do recruitment firms process under DPDP?
Recruitment databases contain rich personal data: full name, contact details, address, date of birth, educational qualifications, employment history, salary details, skill assessments, psychometric test results, reference contacts, and background verification reports. Some roles collect health data (pre-employment medicals) or criminal record information — both sensitive categories. The breadth of this data and the large volumes processed make recruitment firms a significant DPDP risk category.
Do candidates need to consent before their CV is shared with an employer?
Yes. Sharing a candidate's personal data with a prospective employer is a processing activity that requires a lawful basis. For most recruitment scenarios, candidate consent at registration — if properly scoped — covers sharing with employers for roles the candidate has applied for. However, sharing a CV with employers the candidate has not specifically applied to, or sharing with multiple employers simultaneously without disclosure, requires explicit consent for that specific use. Review your registration consent form for scope.
How long can recruitment firms retain candidate data in their talent pool?
Retaining CVs in a talent pool beyond the active application period requires a lawful basis. If a candidate applied for a specific role and was not placed, retaining their data for future opportunities requires fresh consent or a clear disclosure at the time of original application that data will be retained for a defined period. Many firms retain data for years without any lawful basis — audit your ATS database and implement a retention schedule with automated deletion after the consented period.
Does DPDP apply to background verification data?
Background verification — criminal record checks, employment verification, educational credential verification — involves sensitive personal data and must be disclosed to the candidate before it is initiated. You need the candidate's explicit consent to conduct background checks, and the results (especially criminal record information) are sensitive. Third-party BGV agencies are Data Processors requiring DPAs. Negative BGV results that affect a hiring decision must be handled carefully — candidates may have the right to know and dispute the decision.
What are candidate rights under DPDP for recruitment data?
Candidates can request access to the data held in your ATS and talent pool, request correction of inaccurate information (wrong employment dates, misquoted salary, incorrect qualification), and request erasure once their active application is closed. Build a candidate data request mechanism — email or web form — that can locate data across your ATS, talent pool database, and any shared employer portals. The right to erasure does not prevent you from retaining data if you have a statutory obligation (for example, if a candidate was placed and an employment record must be kept).
What do staffing companies need to do differently from recruitment firms?
Staffing companies that place contractors and temporary workers also process payroll data, attendance records, timesheet information, and client site access credentials — a different and broader data profile than a pure recruitment firm. Contractors placed at client sites have data shared with those clients in a processor relationship. Staffing companies must have DPAs with client organisations where the client determines how contractor data is used. Payroll data for contractors may also be subject to statutory retention requirements under EPF, ESI, and tax laws.
Frequently asked questions
Can we keep a candidate's CV after they ask us to delete it?
If the candidate's only interaction with you was an unsuccessful application and there is no statutory obligation to retain the data, you must delete it on request. You cannot retain a CV in your talent pool against a candidate's wishes 'just in case' a future role comes up — that requires their ongoing consent. However, if the candidate was placed and there is a contractual or statutory record-keeping obligation, you can retain the data needed to fulfil that obligation.
Do we need a DPA with the employers we send CVs to?
When you share a candidate's CV with an employer who then makes their own hiring decisions based on the data, the employer becomes a Data Fiduciary (or at minimum a joint Fiduciary) for that data — not your Data Processor. You should still include data protection clauses in your client agreement covering what the employer can do with candidate data sent to them, but the relationship is different from a standard DPA. If the employer only stores the CV on your system and you make the decision, they may be a Processor.
Does DPDP require us to get consent every time we send a candidate's profile to a new employer?
At the point of registration or job application, you can obtain a consent that covers sharing the candidate's profile with multiple potential employers in your network — provided this is clearly disclosed. The consent must be specific enough that the candidate understands their CV will be shared with employers for relevant roles. If you share with employers for roles significantly outside the scope the candidate registered for, that sharing requires fresh consent.
Assess your recruitment firm DPDP compliance
Niti Bharat's DPDP Readiness Assessment covers recruitment and staffing companies — candidate consent, ATS retention, BGV risk, employer data sharing agreements, and candidate rights.
Start Recruitment DPDP Assessment