Advice and guides / For employers
The DPDP Act 2023 and candidate CVs
A CV is personal data. Most hiring teams in India are holding thousands of them with no consent record and no deletion date, and have not thought about it.
This is a plain summary for hiring teams, not legal advice. Have your counsel review how the Act applies to your organisation.
The Digital Personal Data Protection Act 2023 covers digital personal data, and a CV is exactly that: a name, contact details, employment history and often an address, sitting in an inbox, a drive folder and an applicant tracking system at the same time.
If your organisation decides why and how that data is processed, you are the Data Fiduciary for it, and the obligations sit with you rather than with your recruitment agency.
Notice and consent
Consent has to be free, specific, informed and unambiguous, and it has to be accompanied by a notice telling the person what is being collected, what for, how to withdraw consent, how to raise a grievance, and how to complain to the Data Protection Board of India.
For hiring that means the application form, not a link buried in a footer. Two practical consequences most teams miss: consent must be as easy to withdraw as it was to give, and a CV forwarded to you by an agency still needs a lawful basis behind it.
Purpose limitation
Data collected for one role cannot quietly become a permanent talent pool for every future role unless the person was told that and agreed. If you want to keep CVs for future openings, say so in the notice and let people opt out of that specifically.
Retention and deletion
You are expected to stop keeping personal data once the purpose is served. In hiring, that means an actual retention period with an actual deletion process behind it, not a shared drive that has grown since 2019.
- Set a retention period and write it in the notice. A fixed number of days from the last application is easy to explain and easy to automate.
- Keep a longer period only where you can justify it, for example evidencing a placement.
- Deletion has to reach every copy: the ATS, the drive, the inbox, the spreadsheet somebody exported, and the agency holding it on your behalf.
- If you use processors, your contract with them has to carry the same obligations down.
Candidate rights you will actually get asked about
- Access to what you hold about them, and a copy.
- Correction of anything wrong or out of date.
- Erasure.
- Withdrawal of consent, after which processing stops and deletion begins.
- A named grievance officer, reachable, who answers within a stated time.
What to do this month
Three things, in order. Find out where candidate CVs actually live in your organisation, including the informal copies. Put a real notice and a real consent tick on the application form. Pick a retention period and build something that enforces it, even if that something is a calendar reminder and a person.
Where an agency fits
A consultancy handling screening for you is processing candidate data, and your agreement with them should say what they may do with it, how long they keep it, and what happens on termination. Ask. If the answer is vague, that vagueness is now your exposure as well as theirs.
Our own notice, retention period and grievance route are published on the privacy page, and the consent tick sits on the application form itself rather than in a footer.