DPDP Act for recruiters in India

If you recruit in India, you handle personal data for a living. Every CV, phone number, salary detail and reference note is someone’s personal information, and the Digital Personal Data Protection Act, 2023 (the DPDP Act) is the law that governs how you are allowed to hold and use it. This guide is a plain walk through what that means for a recruiting desk, so you can run a compliant operation without turning into a legal scholar.

One thing up front, and it matters: this is general guidance, not legal advice. The Act and its rules have detail that a general article should not pretend to settle for you, and the specifics depend on how your business is set up. Treat this as the map that helps you ask a lawyer the right questions, and let them confirm how each piece applies to you.

Why the DPDP Act applies to you

The Act is built around two roles. A data principal is the individual whose data is being handled: for you, that is the candidate. A data fiduciary is whoever decides how and why that personal data is processed. When you collect a CV, store it, score a candidate against a role and submit them to a client, you are deciding how and why their data is used. That makes you a data fiduciary, with duties under the Act.

This is true whether you are a solo recruiter with a folder of resumes or an agency with a database of thousands. The scale changes the risk, not the principle. If you hold candidate personal data, the Act speaks to you.

The duties, in plain terms

The Act can be reduced to a handful of obligations that are mostly common sense once you see them together.

Give a clear notice. When you collect a candidate’s data, they should know what you are collecting and why. A plain notice, in language a person actually understands, is the foundation. It is not a wall of legalese; it is you being straight about what happens to their information.

Have a lawful basis. You need a lawful reason to process the data, and consent given against that notice is the main one. There are certain legitimate uses the Act recognises, but for a recruiter the clean practice is transparency plus the candidate’s agreement to be represented. Which basis fits which situation is a question for your lawyer.

Collect only what you need. Data minimisation is a real duty, not a nicety. Collect what the purpose requires, not everything you could. A recruiter rarely needs a candidate’s full identity documents at first contact, for instance. Ask for what the stage actually calls for.

Keep it only as long as you need it. Personal data is not yours to hold forever. The principle is that you keep it for the purpose you collected it for, then erase it. Set a retention period you can justify, be honest with candidates about it, and clear out data that has gone cold.

Keep it secure. You are expected to put reasonable security safeguards in place to protect the data you hold. For most desks that means the basics done properly: access control, not leaving candidate data in unsecured spreadsheets or shared drives, and using tools that take security seriously.

Handle breaches properly. If a personal data breach happens, the Act requires you to notify the Data Protection Board and the affected individuals. Have a plan for this before you need it.

Candidate rights you have to be able to honour

The flip side of your duties is the candidate’s rights. Under the Act a candidate can ask you what personal data you hold about them and how you are using it, ask you to correct or complete it, and ask you to erase it where there is no longer a lawful reason to keep it. They can also raise a grievance and expect it to be addressed.

The practical test is simple: if a candidate emailed you today and asked for everything you hold on them, could you find it, show it, and delete it cleanly? If your candidate data is scattered across an inbox, a spreadsheet, a WhatsApp history and three job-board accounts, honouring that request is slow and error-prone, and the gaps are exactly where a compliance problem hides.

This is one of the quiet reasons to keep candidate data in one organised system rather than spread across ad-hoc tools. When every candidate is a single record you can find, export and delete, the rights the Act gives people become a short task instead of a scramble. It is also why a tool that builds export and delete in from the start, and handles data with DPDP-aligned care, takes real weight off a small desk. RecruiterDesk keeps each candidate as one record you control, so finding, correcting or erasing their data is something you can actually do on request. See how it handles your data in the data protection page.

What good practice looks like on a small desk

You do not need a compliance department. You need a few habits.

• Be transparent from first contact. Tell candidates what you hold and why, in plain words.
• Collect what the stage needs, not everything. Push detailed documents to the point in the process where they are actually required.
• Keep candidate data in one place you control, not scattered across personal inboxes and sheets, so you can act on it when you need to.
• Set a retention period and actually enforce it. Decide how long a cold candidate record stays, and clear it when it passes.
• Know your grievance channel. Have a route for a candidate to raise a concern, and a person who owns it.
• Treat security as part of the job, not an afterthought, especially once you hold data at volume.

None of this slows down good recruiting. If anything, a clean, well-organised candidate database makes you faster, because the same discipline that keeps you compliant is the discipline that keeps your desk sharp. For the wider operating picture in India, our guide to GST for recruitment agencies covers the tax side of the same clean-records habit.

The line to remember

The DPDP Act is not a reason to fear holding candidate data; it is a set of sensible duties around doing it responsibly. Be clear about what you collect and why, collect only what you need, keep it secure and only as long as you need it, and be ready to show, correct or delete a candidate’s data when they ask. Do that, and compliance becomes a by-product of running an organised desk rather than a separate burden.

And because the detail matters, get a lawyer to confirm how the Act and its rules apply to your specific business. This guide helps you ask the right questions; it does not replace that advice.