Screening, Background Verification and Candidate Data
India now has a data protection statute, and almost every published account of what it requires an employer to do is describing obligations that are not yet in force. This guide sets out the actual commencement position, what will bind and when, and the one question about job applicants that the statute does not clearly answer.
- What is in force today, and what commences in 2027
- The employment legitimate use, and its ambiguous wording
- Applicants against employees
- What a background check may cover
- What may not be asked, and the surprisingly thin statutory basis
The single most important thing on this page
India's data protection obligations for employers are real, dated, and not yet in force. Both halves of that sentence matter.
The Digital Personal Data Protection Act, 2023 is commencing in phases, and the provisions an employer would need to comply with are not among those in force. In force immediately from 13 November 2025: sections 1(2), 2, 18 to 26 which constitute the Data Protection Board, 35, 38 to 43, 44(1) and 44(3). In force at one year, 13 November 2026: sections 6(9) and 27(1)(d). In force at eighteen months, 13 May 2027: sections 3 to 17, 6(1) to (8) and (10), 27 other than 27(1)(d), 28 to 34, 36, 37 and 44(2).
Read that list against what an employer actually needs. Notice at section 5, consent at section 6, the legitimate uses at section 7, the general obligations of a data fiduciary including security safeguards and breach notification at section 8, the significant data fiduciary obligations at section 10, data principal rights at sections 11 to 14, and the penalties at section 33 with the Schedule that carries the amounts. All of them are in the eighteen-month tranche. What is live today is the constitution of the Data Protection Board and an amendment to the right to information legislation.
The Rules follow the same shape. The Digital Personal Data Protection Rules, 2025 were notified as G.S.R. 846(E) on 13 November 2025, with rules 1, 2 and 17 to 21 in force on publication, rule 4 at one year, and rules 3, 5 to 16, 22 and 23 at eighteen months.
What this means in practice, said carefully
It does not mean nothing applies. Contractual obligations, confidentiality obligations, sectoral rules and the general law of privacy all continue. What it means is that a page or a vendor telling you that you must obtain data protection consent because the law requires it is describing a duty that binds from May 2027, not today. The right response is not to wait. It is to build the consent, notice, retention and deletion practices now, because eighteen months is not long for an organisation that processes candidate data at volume, and because building them is good practice regardless of the commencement date.
The penalty amounts, when they commence, are large enough to be worth planning against: up to 250 crore rupees for breach of security safeguards, up to 200 crore rupees for failure to notify a breach, up to 200 crore rupees for obligations regarding children, up to 150 crore rupees for significant data fiduciary obligations, up to 10,000 rupees for breach of a data principal's own duties, and up to 50 crore rupees residually.
A job applicant is not obviously an employee, and the section is not clear
Section 7 of the Act lists certain legitimate uses for which personal data may be processed without consent. Clause (i) covers processing for the purposes of employment or those related to safeguarding the employer from loss or liability, such as prevention of corporate espionage, maintenance of confidentiality of trade secrets, intellectual property, classified information, or provision of any service or benefit sought by a data principal who is an employee.
Whether that covers a job applicant, or only someone who is already an employee, is genuinely unsettled, and an employer should plan against the conservative reading. The qualifier who is an employee attaches grammatically to the final limb about provision of a service or benefit, not to the opening words for the purposes of employment, so a case can be made that recruitment is covered. But the Act does not define the expression, no authority confirms it reaches prospective employment, and there is no Board or judicial guidance because the relevant sections are not yet in force. Clause (i) should not be relied on for a candidate before employment begins.
| Recruitment stage | Lawful basis to plan against |
|---|---|
| Applicant | Consent under section 6 |
| Shortlisted or interviewed candidate | Consent |
| Background verification | Specific informed consent covering the checks, the sources, the verification agency and the disclosures |
| Offer accepted, employment not commenced | Consent. Accepting an offer does not make the person an employee |
| Employment commenced | Clause (i) may support processing genuinely necessary for employment or for safeguarding the employer |
| Optional or unrelated processing after joining | Consent, unless another statutory basis applies |
Employment ordinarily begins on the contractual joining date unless the contract expressly creates the relationship earlier, so an accepted offer is not a safe dividing line.
Clause (i) is not unrestricted permission after joining either. The processing still has to connect with employment, legal compliance, employee benefits or a recognised employer risk. Marketing, unrelated analytics, unnecessary surveillance and retention beyond the purpose all need their own justification.
Our practice is the conservative one: specific consent from candidates, a clear notice of what will be collected, from whom, for what purpose and for how long, and no reliance on the legitimate use for anyone who has not joined. That is compliant under either reading, which is why it is the one we recommend.
What a check should cover, and how to keep it proportionate
A background check should be scoped to the role. The test worth applying is whether each element of the check relates to a requirement of the job, because that is the test that will be applied later if the check is challenged, and it is also the test that keeps the data set small enough to secure.
Employment history and dates, qualifications, professional registrations where the role requires one, and references are the ordinary core. Identity and address verification are routine. Financial and criminal checks are role-specific rather than default, and applying them to every hire is both disproportionate and a liability, because it accumulates sensitive data about people who were not appointed.
Three operational rules matter more than the list. Collect once, from a defined source, and record what was checked and when. Retain for a defined period with a deletion date, particularly for unsuccessful candidates, who are the largest and most-forgotten data set in any recruitment function. And keep the verification outcome separate from the assessment record, so that a decision can be explained without exposing the underlying data.
There is no nationwide criminal record database a private employer may search, and no general requirement to obtain police verification for every private-sector hire. What is lawfully available is narrower than most vendors imply: an employee or private-firm verification service where the relevant state or local police offer one, and the procedures and permitted applicants vary by state; a certificate the candidate obtains and supplies, noting that a passport office police clearance certificate is designed for residence, overseas employment and visas rather than domestic employee verification; a search of public court records through the official eCourts system; proportionate candidate declarations with the supporting order or judgment where something is disclosed; and an authorised verification agency acting on the employer behalf.
A private employer does not obtain access to the national crime records, the police network or non-public investigation data, and a screening company does not acquire it either by being one. A name-only court-record match is not proof that the candidate is the person involved: identity, court, case number and final disposition all have to be checked before anything is done with it.
Consent should be express, written, and taken before the check starts. The notice should identify the checks, the jurisdictions and period covered, the information and documents required, the employer and any agency receiving the data, the employment purpose, any overseas access, the retention period, and how the candidate may correct or explain a disputed result.
Where verification is mandatory it is by sector, not in general. The clearest national example is private security: under the Private Security Agencies (Regulation) Act, 2005 and the applicable rules an agency must verify the character and antecedents of guards and supervisors through the prescribed process. Aviation and restricted-site access, childcare and school rules, transport or platform-driver requirements adopted by a state, government contracts and licence conditions, and regulator fitness and propriety tests can each add a requirement. These are tested role by role and state by state and must not be presented as one general rule.
What may not be asked, and the thinner-than-expected basis
This is an area where the intuitive answer is wrong in both directions. The constitutional guarantees against discrimination in employment are directed principally at the State and do not operate as a complete code for a private employer. But it is not true that no statutory restriction applies. India has no single list of questions a private employer may not ask, and that is a different thing from interviews being unrestricted. Several statutes expressly restrict discrimination, testing or the use of information during recruitment.
Sex and gender. Section 3(2)(ii) of the Code on Wages prohibits discrimination on the ground of sex while recruiting for the same or similar work and in conditions of employment, except where the employment of women in that work is lawfully restricted. It replaced the Equal Remuneration Act from 21 November 2025, and guidance still citing the 1976 Act is describing repealed law.
Transgender status. Sections 3 and 9 of the Transgender Persons (Protection of Rights) Act, 2019 prohibit an establishment, including a private one, from discriminating in recruitment, employment and promotion.
HIV status. Section 3 of the HIV and AIDS (Prevention and Control) Act, 2017 prohibits denial or termination of employment and other unfair treatment on the basis of HIV status, and section 5 restricts testing without informed consent. An HIV test cannot be required as a routine recruitment condition.
Disability. The 2016 Act does not give private-sector applicants an exact equivalent of the broad non-discrimination duty it imposes on government establishments by section 20, but private establishments sit inside the equal-opportunity-policy and accessibility framework, and a question or decision inconsistent with that creates statutory risk.
Harassment. The prevention of sexual harassment legislation protects an aggrieved woman at a workplace whether or not she is employed there, so intrusive or suggestive questioning at interview can engage it.
Personal data. Once the substantive data protection provisions commence, applicant information collected through interviews and forms needs a lawful purpose and valid consent, and consent is limited to what is necessary for that purpose. A question unrelated to assessing suitability will be hard to justify.
There is still no comprehensive national private-employment prohibition covering every characteristic such as religion, caste, marital status, pregnancy, age or sexual orientation in the form some other jurisdictions have. Sectoral rules, state laws, government contracts and the employer own equal-opportunity policy may add protection.
Beyond that, questions about pregnancy, marital status, disability, religion, caste or personal belief that are not directly relevant to job performance can be challenged as discriminatory even without a specific prohibition, and they generate data you then have to justify holding. The practical rule is simple: ask what the job requires, record why you asked it, and do not collect what you cannot use.
On salary history specifically, there is no Indian restriction. No central or state legislation prohibits a private employer from asking about current or previous salary, requesting a payslip, or considering salary history when formulating an offer, and no Government Bill, draft legislation or formal regulatory proposal introducing an Indian salary-history ban had been identified as at 17 September 2026. The Labour Codes do not introduce one. Discussion of pay equity and of the bans operating in parts of the United States should not be described as an Indian legislative proposal.
That does not make the information unrestricted. Section 3 of the Code on Wages prohibits sex discrimination in recruitment for the same or similar work, so salary history must not be used to carry an unlawful pay disparity forward. A payslip carries tax, bank, provident fund and identity details that are not needed to negotiate a salary, so a verification request should be limited or redacted. When the data protection provisions commence, collecting salary history will need a specified purpose and, for a candidate, valid consent. And a refusal to hand over an unredacted payslip should not be treated as dishonesty where the relevant facts can be verified less intrusively.
Asking for salary expectations rather than salary history is better practice and we recommend it, but it is a recommendation and not a legal requirement. Compensation is better set from the role, internal parity, skills and market value than by applying an increment to what someone was paid before.
Questions about screening and candidate data
If the data protection obligations are not in force, why act now?
Because eighteen months is short for an organisation that processes candidate data at volume, because retention practices built badly are expensive to unwind, and because the practices themselves are sensible independent of the statute. The commencement date is a reason to plan, not a reason to wait.
How long should we keep unsuccessful candidate data?
For a defined period, decided in advance, with an actual deletion mechanism rather than an intention. The specific period should be set against your own need to defend a hiring decision and against any sectoral requirement, and it should be stated to candidates in the notice.
Can we use an outsourced verification vendor?
Yes, and the relationship needs to be documented, because when the obligations commence a processor acting on your behalf does not transfer your responsibility. Contract for what they may collect, from where, how long they hold it and what they do on termination.
Can we run automated screening?
Operationally yes. Two cautions: keep a record of the criteria and why they relate to the role, and keep a human decision point, because a screening rule that correlates with a protected characteristic is difficult to defend and harder still to detect once it is embedded in a tool.
Where to go next
Talent Acquisition
Back to the main page: how we recruit, what we take on, and how to reach us.
Hiring Under the Labour Codes: What an Offer Must Now Say
What actually commenced on 21 November 2025 and what did not, the appointment letter that is now a statutory obligation, the redefined meaning of wages and what it does to a salary structure, and the registrations a first hire triggers.
Executive Search and Senior Appointments
Leadership hiring where the appointment is also a corporate act: key managerial personnel, director appointments and the checks that precede them, and the independent director databank and proficiency test.
Contract Staffing, Fixed Term Employment and Gig Workers
The three non-permanent routes and when each is lawful: fixed term employment and its one-year gratuity, contract labour at the raised threshold with the core activity prohibition, and the aggregator obligations now live for platform work.
Campus Hiring, Internships and Apprenticeships
The employer side of campus recruitment, the legal difference between an intern, an apprentice and an employee, apprenticeship obligations and stipends, and the incentive schemes currently running.
Send an enquiry
If you are building a verification process or reviewing candidate data retention, tell us the volume and the roles. The proportionality question is answered differently for twenty senior hires a year and for two thousand.
Position as at 17 September 2026. Reviewed every six months.
This page is general information, not professional advice. Indian employment law is in the middle of the largest transition it has had in seventy years. The four Labour Codes commenced on 21 November 2025, two of them only in part, repealing twenty-nine central Acts. New central rules under two of the Codes were notified in May 2026 and new provident fund and pension schemes in June 2026, one of which was corrected in August 2026. The Digital Personal Data Protection Act is commencing in phases that run to 2027. Several positions on these pages are marked as unresolved because the primary source could not be read, and a page that pretended otherwise would be worth less than one that says so. Take professional advice before acting on anything on this page. We are happy to be that adviser, but we do not act on a web page, ours or anyone else's, without one.