The verification report included the candidate's neighbours' comments, her parents' occupations and a photograph of her home. The employer had asked for education and last employer.
Where the thinking breaks
The unclear thought What it breaks The clearer thought
The vendor decides what to check.
The employer sets the purpose; the vendor processes within it.
Specify exactly what each role requires to be checked.
Reports are kept for audit.
Keep what law or genuine dispute risk requires, then erase.
Set a retention period for verification reports.
Scope by role
A cashier and a CFO need different checks. Define check packages per role and forbid anything outside them.
Monday morning
01 Read three recent verification reports.
02 Mark anything beyond the requested scope.
03 Tighten the vendor contract.
Questions, answered plainly
Is a background verification vendor a Data Processor under DPDPA? +
Generally yes, when it verifies candidates on the employer's instructions. The employer remains responsible for the processing.
What can employers check about candidates under DPDPA? +
Only what is necessary for the stated purpose of the role, with notice to the candidate. Checks should be proportionate and data retained only as needed.
Sector · HR & Staffing The candidate you never hired is still your Data Principal. Read →
HR & Staffing · Deep dive The candidate you rejected is still in your database. Read →
HR & Staffing · Deep dive The software can see everything. The law asks what you need. Read →
Tell us where your data sits. We'll show you where the exposure is.
A partner replies within one working day, with a first view on your penalty exposure.
Speak to a partner →
Under the Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025: notice — Section 5 read with Rule 3; consent — Section 6, with Consent Managers under Rule 4; reasonable security safeguards — Section 8(5) and Rule 6; personal data breach intimation — Section 8(6) and Rule 7; erasure — Section 8(7) and Rule 8; children's data — Section 9 and Rule 10; Significant Data Fiduciaries — Section 10 and Rule 13; Data Principal rights — Sections 11 to 14 and Rule 14; transfer outside India — Section 16 and Rule 15; penalties — Section 33 and the Schedule. Published by AMLEGALS (Anandaday Misshra, Founder & Managing Partner).
