DPDP Compliance Guide for HRTech Platforms
HRTech platforms manage candidate and employee data across the lifecycle. Learn how to map data flows and manage consent under India's DPDP Act.
Discuss this page with an LLM
DPDP Action Sheet
Use this before your next workflow goes live. It keeps the useful parts visible and turns DPDP into checks your team can actually answer.
For DPDP Compliance Guide for HRTech Platforms, the DPDP question is how personal data enters the workflow, where it is stored, which tools touch it, what purpose was explained, and how deletion or withdrawal will work.
1. Lead Forms
Check:
- What data are you collecting?
- Is the purpose clear at the point of collection?
- Is marketing consent separate from service communication?
- Can the user withdraw consent later?
Common mistake: one checkbox that silently covers newsletters, sales calls, partner sharing and remarketing.
2. Email and WhatsApp
Check:
- Who is on the list?
- Where did consent come from?
- Is the list imported from a vendor, event, webinar, scrape or old CRM?
- Can you prove the source of consent?
Common mistake: treating every lead as permanently marketable.
3. Ads and Retargeting
Check:
- Are pixels or ad platforms receiving identifiable user behavior?
- Are audiences built from customer lists?
- Are lookalike or remarketing audiences using personal data?
Common mistake: assuming "the ad platform handles it" means your company has no DPDP responsibility.
4. Website Analytics
Check:
- Which tools run on the site?
- Are IP address, device identifiers, session IDs or form fields being captured?
- Is analytics used only for measurement, or also for profiling and targeting?
Common mistake: installing tools first and asking privacy questions later.
5. Vendor List
Make a quick list:
- CRM
- Email platform
- WhatsApp provider
- Analytics
- Ad pixels
- Form tool
- Landing page builder
- Webinar tool
For each vendor, answer: what data goes there, why, who can access it and how deletion works.
6. This Week's Action
Map one campaign from first click to final follow-up. Mark every place personal data is collected, enriched, shared, uploaded or used for targeting.
If your team cannot answer where the data came from and where it goes next, start with a data flow map before rewriting policy copy.
Book a DPDP clarity callWant all of this handled, end to end? Sanctum is the all-in-one DPDP compliance programme behind this site: legal position, data map, gap analysis, implementation, tooling, training, readiness opinion, and breach cover under one accountable owner. How all-in-one DPDP compliance works or see the Sanctum programme.
Data Lifecycle in HRTech
HRTech platforms automate the employee lifecycle, from candidate sourcing to final settlement. This industry processes high volumes of personal information including salary history, bank details, and health declarations for insurance. This data moves constantly between internal HR teams, third-party payroll processors, and background verification vendors.
Managing Candidate and Employee Consent
The most significant conflict in HRTech involves data retention for rejected candidates. Platforms often store resumes for years to build a talent pool. Under DPDP, you must obtain specific consent for this “future consideration” or delete the data once the specific role is filled. For active employees, consent must be granular. You must separate payroll processing from optional engagement activities like office galleries or voluntary surveys.
Third-Party Data Flows
HR platforms act as intermediaries between the employer and various service providers. When an HRTech platform sends data to an insurance provider or a background screening firm, it must ensure a Data Processing Agreement is in place. These platforms must also allow employees to see who has accessed their data. Detailed audit logs are now a technical requirement for any software handling employee records.
| HR Process | Data Types Involved | DPDP Compliance Risk |
|---|---|---|
| Recruitment | Resumes, Aadhaar, interview scores | High (Retention risk) |
| Payroll | Bank details, PAN, tax declarations | High (Financial data) |
| Benefits | Nominee names, health history | Very High (Sensitive) |
| Offboarding | Exit interviews, final settlement | Medium (Data deletion) |
| Background Check | Education history, criminal records | High (Third-party sharing) |
This week
Select your recruitment module and identify every field collected from candidates. Determine which fields are necessary for the job application and which are optional. Update the upload screen to include a checkbox for candidates to opt-in to being contacted for future, unrelated job openings.
Now think about your work. Where does personal data enter your workflows? Where does it sit? Who else touches it?
Frequently asked questions
Do we need consent for mandatory tax and payroll processing?
While DPDP allows processing for certain employment-related purposes, you must still provide notice. Best practice involves including payroll processing in the initial employee privacy notice while seeking explicit consent for optional benefits.
How long can an HRTech platform keep a former employee's data?
You must delete data once the employment purpose is fulfilled, unless other Indian laws like tax or labor codes require longer storage. Define these specific timelines in your retention policy to ensure compliance.
Are psychometric test results considered personal data?
Yes, psychometric scores and personality profiles are personal data because they link to an identifiable candidate. These must be protected with the same security standards as financial records and shared only with authorized hiring managers.