The verifier knows morethan the hiring manager.
Background checks concentrate the most sensitive data in the least visible vendor.
In one line: Generally yes, when it verifies candidates on the employer's instructions. The employer remains responsible for the processing.
You outsourced the check. You kept the liability.
The scene
The verification report included the candidate's neighbours' comments, her parents' occupations and a photograph of her home. The employer had asked for education and last employer.
Where the thinking breaks
Scope by role
A cashier and a CFO need different checks. Define check packages per role and forbid anything outside them.
Monday morning
- 01Read three recent verification reports.
- 02Mark anything beyond the requested scope.
- 03Tighten the vendor contract.
Questions, answered plainly
Is a background verification vendor a Data Processor under DPDPA?
Generally yes, when it verifies candidates on the employer's instructions. The employer remains responsible for the processing.
What can employers check about candidates under DPDPA?
Only what is necessary for the stated purpose of the role, with notice to the candidate. Checks should be proportionate and data retained only as needed.
Tell us where your data sits.We'll show you where the exposure is.
A partner replies within one working day, with a first view on your penalty exposure.
Speak to a partner