Background Verification Under DPDP: What Employers Can Check, and How

Who this is for: HR, talent acquisition and procurement teams that commission background verification (BGV), and the legal teams that approve it.

Background verification sits where recruitment, security and privacy meet. It protects employers from fraud and misrepresentation, but it also involves collecting identity documents, address proofs, education and employment records, references and sometimes criminal records, often through third-party vendors who contact universities, former employers and police.

Under the DPDP Act, BGV is lawful when it is transparent, proportionate and controlled. This guide covers how.

The lawful basis

Background checks generally rely on documents and information the candidate provides for the purpose of verification, together with their authorisation for the employer or its vendor to verify them with third parties. Checks connected to an offer of employment can also be seen as employment purposes under Section 7(i).

Whatever basis you rely on, two things make it hold up:

• a clear notice before the check, explaining what will be verified, which sources will be contacted, which vendor will do it and how long results are kept
• a specific written authorisation from the candidate, separate from the offer letter's other terms

Check only what the role requires

Proportionality is the core discipline. A blanket package of every available check for every role collects far more than most roles need.

Define a check matrix by role level and function, and apply it consistently.

Handling Aadhaar and identity documents

Aadhaar raises additional legal restrictions under the Aadhaar Act. In practice:

• prefer masked Aadhaar (showing only the last four digits) or offline verification methods
• do not collect or store full Aadhaar numbers unless a law permits it
• do not photocopy identity documents into general HR folders
• restrict access to identity documents and delete copies once verification is complete

Criminal record checks

Criminal record information can seriously affect a person's prospects. Limit criminal checks to roles where they are justified, tell the candidate in advance, keep results in a restricted file, and give the candidate an opportunity to explain an adverse finding before you withdraw an offer.

Your BGV vendor is your processor

The BGV vendor collects data on your behalf, so it is your Data Processor. Under Section 8(1), you remain responsible for what it does. Your data processing agreement should require:

• processing only for the checks you order
• Rule 6 security safeguards, especially for identity documents
• breach notification to you within a short window
• no use of candidate data for the vendor's own databases or products
• deletion of documents and reports after a fixed period
• disclosure of any sub-contractors, such as field verification agents

Retention

Keep the verification outcome, and any records needed for employment or legal reasons, for as long as they are required. Delete supporting documents, detailed reports and unsuccessful candidates' verification data once the purpose is served (Section 8(7)). See HR records retention.

Checklist

How ConsentifyAI helps

ConsentifyAI records the notice and authorisation each candidate gives for verification, links the BGV vendor and its contract to the processing activity in your ROPA, and applies retention rules so verification documents are deleted on schedule.