DPDP Compliance for Recruitment Agencies
Recruitment agencies handle mountains of resumes and personal IDs. Learn how to navigate India's DPDP Act without the legal headache.
Discuss this page with an LLM
DPDP Action Sheet
Use this before your next workflow goes live. It keeps the useful parts visible and turns DPDP into checks your team can actually answer.
For DPDP Compliance for Recruitment Agencies, the DPDP question is how personal data enters the workflow, where it is stored, which tools touch it, what purpose was explained, and how deletion or withdrawal will work.
1. Lead Forms
Check:
- What data are you collecting?
- Is the purpose clear at the point of collection?
- Is marketing consent separate from service communication?
- Can the user withdraw consent later?
Common mistake: one checkbox that silently covers newsletters, sales calls, partner sharing and remarketing.
2. Email and WhatsApp
Check:
- Who is on the list?
- Where did consent come from?
- Is the list imported from a vendor, event, webinar, scrape or old CRM?
- Can you prove the source of consent?
Common mistake: treating every lead as permanently marketable.
3. Ads and Retargeting
Check:
- Are pixels or ad platforms receiving identifiable user behavior?
- Are audiences built from customer lists?
- Are lookalike or remarketing audiences using personal data?
Common mistake: assuming "the ad platform handles it" means your company has no DPDP responsibility.
4. Website Analytics
Check:
- Which tools run on the site?
- Are IP address, device identifiers, session IDs or form fields being captured?
- Is analytics used only for measurement, or also for profiling and targeting?
Common mistake: installing tools first and asking privacy questions later.
5. Vendor List
Make a quick list:
- CRM
- Email platform
- WhatsApp provider
- Analytics
- Ad pixels
- Form tool
- Landing page builder
- Webinar tool
For each vendor, answer: what data goes there, why, who can access it and how deletion works.
6. This Week's Action
Map one campaign from first click to final follow-up. Mark every place personal data is collected, enriched, shared, uploaded or used for targeting.
If your team cannot answer where the data came from and where it goes next, start with a data flow map before rewriting policy copy.
Book a DPDP clarity callWant all of this handled, end to end? Sanctum is the all-in-one DPDP compliance programme behind this site: legal position, data map, gap analysis, implementation, tooling, training, readiness opinion, and breach cover under one accountable owner. How all-in-one DPDP compliance works or see the Sanctum programme.
Managing Candidate Intent Data
Recruitment firms store Aadhaar numbers, previous salary slips, and health records for pre-employment checks. You often collect family details for group insurance before a candidate is even hired. You process “candidate intent” data, which reveals a person’s current employment status and financial expectations to potential competitors.
The Talent Pipeline Retention Risk
Agencies often keep resumes for decades to build a “talent pipeline.” Under DPDP, you cannot keep a candidate’s PAN or bank details indefinitely if they were not hired for the specific role they applied for. You must define a specific “expiry date” for a candidate’s profile in your Applicant Tracking System (ATS) unless they provide fresh consent for future roles.
| Workflow | Personal Data | DPDP Risk |
|---|---|---|
| CV Sourcing | Phone numbers from job boards | Processing data without a direct relationship |
| Background Verification | Aadhaar, UAN, Criminal records | Sharing sensitive IDs with third-party verification vendors |
| Client Submissions | Salary expectations, Current CTC | Disclosing financial data without explicit sharing consent |
| Psychometric Testing | Personality scores, Behavioral data | Storing behavioral profiles on international SaaS servers |
This week
Review your candidate registration form or website portal. Add a checkbox that specifically asks for permission to share the candidate’s resume with “third-party clients” for future job openings. If your current form only covers the “current application,” you cannot legally show that resume to a different client next month.
Now think about your work. Where does personal data enter your workflows? Where does it sit? Who else touches it?
Frequently asked questions
Can we still headhunt candidates on LinkedIn without prior consent?
You can view public profiles, but once you move that data into your internal database, you must notify the candidate. DPDP requires you to inform them what data you have and why you are holding it, even if you found it publicly.
Do we need a new contract with our Background Verification (BGV) vendors?
Yes, your BGV partners are Data Processors. You must have a contract that forbids them from using candidate Aadhaar or address details for any purpose other than the specific check you requested.
Can we keep resumes of "silver medalist" candidates for future roles?
Only if your initial consent form explicitly mentioned "future talent pooling." If the consent was only for a specific job ID, you must delete their data once that role is filled.