DPDPA Compliance for HR Firms & Recruitment Agencies in India

No — and this is the most consequential misreading in the staffing sector. Section 7(i) permits processing without consent for purposes of employment, or to safeguard the employer from loss or liability, and it is available to the employer in that relationship. A recruitment agency, RPO or search firm placing a candidate at a client company is not that person's employer, so nothing in your candidate pipeline sits under 7(i). Sourcing, screening, profiling, submitting to clients, keeping someone on file for future roles and marketing to them are all Section 6 consent purposes: itemised, plain language, in English or any Eighth Schedule language, and as easy to withdraw as to give. Two refinements worth getting right. Where you genuinely are the employer of record — contract staffing, payroll outsourcing, flexi-staffing on your own rolls — Section 7(i) does apply to those deployed employees for employment purposes, which means your business likely operates on two different lawful grounds at once and needs to know which record sits where. And Section 7(a) covers data a person voluntarily provides for a specified purpose without indicating they object to its use; a candidate who applies to one advertised role has provided it for that role, not for indefinite database retention or unrelated client submissions.

Three different problems. On pre-Act data, Section 5(2) requires that where consent was obtained before commencement, you give those Data Principals the required notice as soon as reasonably practicable — so a one-time notice exercise across your existing database is unavoidable, and for most agencies it is the single largest piece of work. On purchased and scraped data, the harder question is what lawful ground you ever had; a list bought from another consultancy carries no consent that transfers to you, and job-portal terms of use are an agreement with the portal, not consent from the candidate to your processing. Where you cannot point to a ground, the honest options are fresh consent or deletion, not silent retention. On the rest, purpose limitation and the erasure duty apply once the purpose is served: rejected applicants from closed mandates, duplicate resumes in email attachments and WhatsApp media folders, salary slips and offer letters collected for verification years ago, referee contact details captured from a candidate and never used. Also note that candidate-supplied referee and emergency-contact details belong to those individuals, who have their own access and correction rights over data you hold about them.

Split it into two categories. Processors act only on your instructions and only under a valid written contract specifying purpose, security obligations, sub-processing limits and deletion on exit — that is normally your ATS, CRM, cloud host, assessment platform and payroll software. Liability for their failures stays with you and cannot be contracted away, and most agency tech runs on click-through plans with no such contract, which is a straightforward gap to close. Client companies are different: once a profile reaches them for their own hiring decision, they are processing for their own purposes as a fiduciary in their own right, with their own ground and their own retention duties — which means every client submission is a disclosure to a third party requiring the candidate's itemised consent, and blanket circulation to a panel of clients is a purpose-limitation problem regardless of how the market normally works. Background-check vendors fall either way depending on the arrangement and need to be characterised deliberately rather than assumed. One documentation point: DPDPA has no separate "sensitive personal data" tier, so an Aadhaar copy, a disability disclosure, a criminal-record check result and a phone number all sit under one legal standard — the difference is the harm, not the rule. Separately, the Aadhaar framework's own restrictions on collecting and storing Aadhaar numbers run in parallel with DPDPA, so the safest position on Aadhaar copies is to stop retaining them unless you can point to a specific legal basis for doing so.

Two clocks start at detection and both must be met; they are cumulative, not alternatives. CERT-In requires reporting of covered cyber incidents within 6 hours. Separately under DPDPA, you must intimate every affected candidate and deployed employee without delay (Rule 7(1)), give the Board an initial description without delay (Rule 7(2)(a)), and file detailed particulars within 72 hours (Rule 7(2)(b)) — and a candidate database breach is often larger than the client's own, because you hold everyone who applied, not just who was hired. Failure to maintain reasonable security safeguards attracts up to ₹250 crore, and failure to give the required breach intimation is assessed separately at up to ₹200 crore, with the Board setting actual quantum on the facts including the scale of the operation. Recruiter laptops and personal phones holding candidate documents are the usual failure point, and full-disk encryption plus two-factor authentication on your ATS and email closes most of it. On the heavier obligations: annual DPIAs, independent data audits, algorithmic due diligence and an India-based Data Protection Officer bind Significant Data Fiduciaries only, and SDF status is conferred by Central Government notification, not triggered automatically by database size or placement volume. Every agency still owes the baseline duties in full: valid consent, purpose limitation, accuracy, erasure once the purpose ends, security safeguards, breach notification, and a published grievance channel with a named contact and a response timeline not exceeding ninety days under Rule 14(3). If you use automated CV shortlisting or scoring, note that algorithmic due diligence is an SDF-specific obligation — but the accuracy duty and the candidate's correction right apply to you regardless.