DPDP Act and Employee Background Verification: What Indian Employers Must Know Before Running Checks in 2026

The Digital Personal Data Protection Act, 2023 commonly referred to as the DPDP Act  fundamentally changes the legal framework for how Indian employers collect, process, and store candidate data during background verification. Before the DPDP Act, background verification operated in a legal grey area. Employers could collect candidate documents, share them with verification agencies, and retain the results indefinitely without a formal legal framework governing the process.

That grey area no longer exists. The DPDP Act establishes clear rules for processing personal data, and employee background verification falls squarely within its scope. Employers who run background checks without understanding these rules face penalties of up to 250 crore rupees for significant non-compliance.

This guide covers what the DPDP Act means for background verification specifically not the full scope of the law, but the parts that directly affect how you verify candidates before and after hiring.

Why Background Verification Is Covered Under the DPDP Act

Background verification involves collecting personal data from a candidate PAN numbers, Voter ID numbers, UAN, address details, educational credentials and processing that data by querying external databases, comparing records, and generating reports. Under the DPDP Act, anyone who processes personal data is a Data Fiduciary. The employer is the Data Fiduciary. The candidate is the Data Principal.

This means the employer has specific legal obligations regarding how they collect verification data, what they do with it, how long they keep it, and who they share it with. These obligations apply regardless of whether the employer runs the checks in-house or uses a third-party verification agency.

Consent: The Foundation of Compliant Verification

The DPDP Act requires that personal data be processed only for a lawful purpose and with the Data Principal's consent (unless a specific exemption applies). For background verification, this means the candidate must consent to their data being used for verification purposes before the process begins.

What constitutes valid consent under the DPDP Act is more specific than what most Indian employers currently do. Consent must be free the candidate cannot be coerced. It must be specific consent to verification is not the same as consent to process data for other purposes. It must be informed  the candidate must know what data is being collected, why, and how it will be used. And it must be clear buried in page 47 of an employment contract does not qualify.

In practical terms, this means employers should have a standalone consent form or a clearly identified section in the offer letter that specifically addresses background verification. It should state which checks will be conducted (identity verification, employment history, criminal records), what data will be collected (PAN, Voter ID, UAN, etc.), who will process the data (the employer, a named verification platform, or a named agency), and how long the verification data will be retained.

A candidate who declines consent cannot be verified, and processing their data anyway is a violation of the Act. However, an employer can make a conditional offer that requires verification as a condition of employment the candidate's choice is whether to accept the condition, not whether to waive their data rights.

Data Minimisation: Collect Only What You Need

The DPDP Act establishes a data minimisation principle you should collect only the personal data that is necessary for the stated purpose. For background verification, this means collecting only the document numbers and data points required for the specific checks you are running.

If you are running PAN, Voter ID, and UAN verification, you need the candidate's PAN number, Voter ID number, and UAN. You do not need their Aadhaar number, bank account details, family information, or medical history for these checks. Collecting data beyond what the verification requires violates the minimisation principle.

This is where digital verification platforms offer a structural advantage over traditional agencies. When you submit a candidate file to a traditional agency, you typically send a comprehensive dossier copies of all identity documents, address proof, educational certificates, salary slips, and more. The agency receives far more data than any single check requires.

A self-serve digital platform like Compose1 Verify collects only the specific data point required for each check a PAN number for PAN verification, a Voter ID number for Voter ID verification, a UAN for employment verification. No document copies are uploaded. No excess data is collected. The platform queries the government database with the number, returns the result, and that is the extent of the data processing. This aligns naturally with the DPDP Act's minimisation requirements.

Purpose Limitation: Use Verification Data Only for Verification

Data collected for background verification must be used only for background verification. Using the same data for marketing, profiling, employee scoring, or sharing with other departments for unrelated purposes violates the DPDP Act's purpose limitation principle.

In practice, this means the verification report and the underlying data should be accessible only to the HR team members responsible for hiring decisions. It should not be shared with marketing, sales, or business development teams. The PAN number collected for verification should not be reused for any purpose other than verification and statutory compliance (like TDS processing, which has its own legal basis).

Employers should establish internal access controls that limit who can view verification data and audit logs that record who accessed it. This is good data governance regardless of the DPDP Act, but the Act makes it a legal requirement.

Data Retention: You Cannot Keep Verification Data Forever

The DPDP Act requires that personal data be retained only as long as necessary for the purpose for which it was collected. For background verification, this creates a specific challenge: how long do you need to keep the verification report?

There is no single correct answer, but the reasoning should be documented. For candidates who are hired, retaining the verification report for the duration of employment plus a reasonable period after (for legal and audit purposes) is defensible. For candidates who are not hired, the verification data should be deleted once the hiring decision is final and any appeal or dispute period has passed.

The key point is that indefinite retention keeping verification reports in a filing cabinet or a shared drive forever is no longer acceptable. Employers need a data retention policy that specifies how long verification data is kept and a deletion process that actually executes it.

Third-Party Verification Agencies: Your Liability Does Not Transfer

Many Indian employers assume that using a third-party verification agency transfers the data protection responsibility to the agency. This is incorrect under the DPDP Act.

When you share candidate data with a verification agency, the agency becomes a Data Processor acting on your behalf. You remain the Data Fiduciary. You are still responsible for ensuring that the data is processed lawfully, that the agency has adequate security measures, and that the candidate's rights are respected.

This means you should have a written data processing agreement with your verification agency that specifies what data they will receive, how they will process it, how long they will retain it, and what security measures they have in place. If the agency suffers a data breach involving your candidates' data, you are obligated to notify the affected candidates and the Data Protection Board not the agency.

This is another area where self-serve digital verification simplifies compliance. When you run checks directly through a platform, you control the data flow end-to-end. You enter the document number, the platform queries the government database, and the result comes back to you. There is no candidate dossier sitting on an agency's server. There is no spreadsheet of candidate PAN numbers being emailed between the agency's operations team. The data footprint is smaller, the processing chain is shorter, and the compliance surface area is narrower.

Practical Compliance Checklist for Indian Employers

Before verification: Obtain specific, informed consent from the candidate for background verification. Document which checks will be conducted and what data will be collected. Ensure the consent form is standalone or clearly identified, not buried in other documents.

During verification: Collect only the data required for the specific checks. Use platforms that query government databases directly rather than collecting document copies. Maintain access controls on verification data. If using a third-party agency, have a data processing agreement in place.

After verification: Store verification reports with appropriate access controls. Establish a retention period and deletion schedule. Delete verification data for candidates not hired within a defined period. Ensure the candidate can request access to their verification data if they ask.

Ongoing: Train HR team members on DPDP Act requirements for verification. Audit your verification process annually. Review and update your data processing agreements with third-party agencies. Document your compliance measures the DPDP Act does not just require compliance, it requires demonstrable compliance.

Compliant Verification Is Also Faster Verification

The DPDP Act's requirements data minimisation, purpose limitation, retention limits might sound like they add friction to the verification process. In practice, they push employers toward the same digital, self-serve verification approach that is already faster and cheaper than the traditional model.

When you verify through Compose1 Verify, you naturally comply with most DPDP Act requirements by default. You collect only document numbers, not copies. You process data for a specific, stated purpose. The data footprint is minimal. There is no sprawling candidate dossier being shared across multiple parties. The verification is fast (minutes, not weeks), targeted (specific checks, not blanket packages), and documented (digital records with timestamps).

The DPDP Act does not make background verification harder. It makes the old way of doing verification photocopied documents in filing cabinets, candidate dossiers emailed to agencies, indefinite retention of personal data legally untenable. The compliant way to verify employees in 2026 is also the faster, cheaper, and more reliable way. That is not a coincidence.