Every resume stored in your ATS or shared folder is personal data under DPDPA. Recruitment agencies handling candidate profiles for multiple clients face layered obligations they may not be aware of.
Recruitment agencies routinely collect, store, and share sensitive candidate data — resumes, identity documents, salary expectations, reference contacts — across multiple clients and platforms. Many of these practices were unregulated. DPDPA changes that fundamentally. Agencies that process personal data as part of their core business model are Data Fiduciaries with significant obligations.
Agencies must implement candidate consent flows at the point of CV submission. Data sharing with clients must be disclosed in the consent notice. Retention policies for rejected candidates must be defined and communicated. Third-party ATS vendors must sign Data Processing Agreements.
A recruitment agency sits at the intersection of multiple data flows: candidate personal data, client confidential requirements, background check documents, reference information, and in some cases, sensitive financial or medical data. Under DPDPA, collecting a resume constitutes collection of personal data. Sharing that resume with a client without specific consent from the candidate could constitute a violation. Retaining rejected candidate data beyond a reasonable period without notice is also a compliance gap. Agencies using third-party ATS platforms must ensure those vendors qualify as Data Processors under compliant agreements.
Map every location where candidate data is stored (ATS, email, cloud drives, spreadsheets)
Define a retention policy for active, passive, and rejected candidates
Add explicit consent language to your candidate submission forms
Update client agreements to specify data sharing scope
Sign Data Processing Agreements with your ATS vendor
Create a process for candidates to request deletion of their data
Train recruiters on what data they can and cannot share without consent
Free — takes 3 minutes
Answer a few simple questions. Get your free Readiness Score — sent to your email or WhatsApp.
Check My Readiness →Take our free 3–5 minute industry assessment to find out your compliance risk level.
Take Free Assessment →Free Download
The Complete DPDPA Compliance Guide
Plain English. Everything your business needs to understand the DPDP Rules 2025 — written for founders, not lawyers. Now in 7 Indian languages.
Download the Guide →5 Ready-to-Use Templates
Start complying — not just reading
Privacy Notice, Consent Language, Data Inventory, DSR SOP, Vendor Register. Delivered free to your email.
2-min reads, plain English, every morning. Free forever.
