The candidate you never hiredis still your Data Principal.

Employment is a legitimate use. Recruitment, before there is employment, may not be.

In one line: Section 7(i) allows processing without consent for employment purposes and to safeguard the employer from loss or liability, among other listed purposes. Processing outside those purposes may require consent.

The estate · HR & StaffingHover to inspect

Every offer letter, medical record and exit file is personal data.

The scene

The staffing firm's database held two million CVs. Most came from job portals, some from referrals, some from a scrape nobody admits to. Candidates from 2014 still received calls about roles. None had been asked if they minded.

Where the thinking breaks

The unclear thoughtWhat it breaksThe clearer thought
Employee data is exempt. Section 7(i) covers specified employment purposes, not everything done with staff data. Map each HR process to the employment use, or to consent.
Candidates applied, so we can keep them. An application is for a role, not for a lifetime database. Set a retention period for rejected candidates, and keep it.
Background checks are the vendor's job. The verifier processes on your behalf. Contract, limit and audit what verifiers collect.

Monitoring employees

Productivity tools, keystroke logging and camera monitoring may go beyond what employment purposes justify. The test is necessity for the purpose, not availability of the software.

The full HR & Staffing briefing

3 deep dives
Deep dive 01→

The candidate you rejected is still in your database.

A CV is not a subscription.
Deep dive 02→

The software can see everything. The law asks what you need.

Watching is easy. Justifying it is the work.
Deep dive 03→

The verifier knows more than the hiring manager.

You outsourced the check. You kept the liability.

Monday morning

  1. 01Set a deletion date for rejected candidates.
  2. 02List every monitoring tool in use and the purpose it serves.
  3. 03Review what your background verifier collects.

Questions, answered plainly

Does DPDPA require consent for employee data?

Section 7(i) allows processing without consent for employment purposes and to safeguard the employer from loss or liability, among other listed purposes. Processing outside those purposes may require consent.

How long can employers keep candidate data under DPDPA?

Only as long as needed for the purpose, such as the recruitment for which it was provided, unless law requires longer. Employers should set and apply a retention period for unsuccessful candidates.

Sector · Hospitality & TravelGuests check out. Their passports stay.Read → Sector · GamingYour fastest-growing segment may legally be children.Read → Sector · Government vendorsThe State's exemption is not your exemption.Read →

Tell us where your data sits.We'll show you where the exposure is.

A partner replies within one working day, with a first view on your penalty exposure.

Speak to a partner