DPDP Rules 2025 are now in effect. How ready is your business? Most Indian companies don't know yet.Find out in 10 minutes — free →
Recruitment agencies routinely collect, store, and share sensitive candidate data — resumes, identity documents, salary expectations, reference contacts — across multiple clients and platforms. Many of these practices were unregulated. DPDPA changes that fundamentally. Agencies that process personal data as part of their core business model are Data Fiduciaries with significant obligations.
Agencies must implement candidate consent flows at the point of CV submission. Data sharing with clients must be disclosed in the consent notice. Retention policies for rejected candidates must be defined and communicated. Third-party ATS vendors must sign Data Processing Agreements.
A recruitment agency sits at the intersection of multiple data flows: candidate personal data, client confidential requirements, background check documents, reference information, and in some cases, sensitive financial or medical data. Under DPDPA, collecting a resume constitutes collection of personal data. Sharing that resume with a client without specific consent from the candidate could constitute a violation. Retaining rejected candidate data beyond a reasonable period without notice is also a compliance gap. Agencies using third-party ATS platforms must ensure those vendors qualify as Data Processors under compliant agreements.
Map every location where candidate data is stored (ATS, email, cloud drives, spreadsheets)
Define a retention policy for active, passive, and rejected candidates
Add explicit consent language to your candidate submission forms
Update client agreements to specify data sharing scope
Sign Data Processing Agreements with your ATS vendor
Create a process for candidates to request deletion of their data
Train recruiters on what data they can and cannot share without consent
Free — takes 3 minutes
Answer a few simple questions. Get your free Readiness Score — sent to your email or WhatsApp.
Check My Readiness →Take our free 10-minute industry assessment to find out your compliance risk level.
Take Free Assessment →2-min reads, plain English, every morning. Free forever.
