Keeping candidate details 'just in case' can get your business in trouble now.
You collected resumes last year. Some candidates were rejected. But their Aadhaar copy, phone number, and address are still sitting in your WhatsApp or email. Now the new data law says you cannot keep that information forever. If you run a recruitment firm or hire staff regularly, this applies to you. Every resume you hold is someone's personal information. And the law is watching.
Say you run a small placement agency in Pune. A candidate sent you their resume in 2024. You kept it in a WhatsApp folder. Now in 2026, you share it with a new client without asking the candidate. That is a violation. Or say you store salary slips and Aadhaar copies of 200 rejected candidates. The law says delete them once the hiring is done. You must also tell candidates how their information will be used before you collect it.
Stop sharing resumes with clients without asking the candidate first.
Delete old rejected candidate files older than six months from your system.
Check if your business is ready. Takes 3 minutes. Visit saralprivacy.com/assessment
“Just because a resume was sent once does not mean it can be reused forever.”
Free — takes 3 minutes
Answer a few simple questions. Get your free Readiness Score — sent to your email or WhatsApp.
Check My Readiness →Take our free 3–5 minute industry assessment to find out your compliance risk level.
Take Free Assessment →Free Download
The Complete DPDPA Compliance Guide
Plain English. Everything your business needs to understand the DPDP Rules 2025 — written for founders, not lawyers. Now in 7 Indian languages.
Download the Guide →5 Ready-to-Use Templates
Start complying — not just reading
Privacy Notice, Consent Language, Data Inventory, DSR SOP, Vendor Register. Delivered free to your email.
2-min reads, plain English, every morning. Free forever.
