DPDP Act Compliance for Recruitment Agencies as per DPDP Act 2026: The Complete Guide

Recruitment agencies in India handle a large volume of personal data, including resumes, contact information, work history, education, salary expectations, ID documents, and background check results. Keeping this information secure is key to earning candidates' trust and complying with India’s data protection rules.

DPDP Act compliance is now a top priority for recruitment agencies in India as they get ready for the Digital Personal Data Protection (DPDP) Act, 2023, and the related Rules, 2025. These laws set out how digital personal data must be handled, including rules for transparency, consent, security, and individual rights. The Rules were announced in November 2025 and will be rolled out in stages—official government announcement.

For recruitment firms, compliance involves more than adding a privacy policy to a website. Agencies must review how candidate information is collected, stored, shared with employers, retained, and deleted.

KavachOne helps organizations improve their privacy and compliance by offering digital solutions for structured data protection.

This guide covers what the DPDP Act requires from recruitment agencies, practical steps for compliance, common challenges, and how KavachOne can support you.

Under the DPDP Act, job applicants and professionals are classified as Data Principals, while recruitment firms and hiring agencies act as Data Fiduciaries. When an agency collects candidate information directly to build talent benches or source on behalf of multiple enterprise clients, it determines the purpose and means of data processing.

Staffing firms regularly deal with DPDP Act compliance. This guide offers practical advice on India’s privacy rules.

Recruitment agencies handle some of the most sensitive personal information, such as contact details, salary history, ID documents, education records, and psychometric test results. Now that the DPDP Act is in effect across India, the recruitment industry must change how it operates.

Keeping resumes without reason, sharing spreadsheets without control, and sending candidate profiles without consent now carry big risks. Following the DPDP Act is not just a legal step—it is essential for client trust, candidate relationships, and keeping your business running.

Under India's privacy regime, data roles carry strict statutory duties:

• Data Fiduciary: the entity that determines the purpose and means of the processing of personal data. Recruitment agencies are Data Fiduciaries when they source, maintain candidate pools, and manage direct applicants.

• Data Processor: an entity that processes data on behalf of a Fiduciary. If an agency is shortlisting candidates under the terms of a contract with a corporate client, it will often be acting as a Data Processor.

• Data Principal: The individual whose data is processed (in this instance job applicants, sourced candidates and employee referrals).

High-Risk Touchpoints in Daily Recruitment

1. Passive Sourcing: Scraping public directories or sourcing resumes from job portals without obtaining explicit, itemized consent.

2. Client Submissions: Emailing candidate resumes containing Aadhaar numbers, PAN details, or current compensation slips to prospective employers without prior authorization.

3. Internal Talent Pools: Maintaining unencrypted spreadsheets and historical databases of unplaced candidates without a defined retention schedule.

Navigating the DPDP landscape requires operationalizing several core data protection principles:

1. Granular and Itemized Consent Notices

Pre-ticked boxes and generic language in forms are against the rules. Agencies must provide a clear notice that sets out:

• The various categories of personal data which are collected.

• The explicit objective (i.e., assessing suitability for a particular role rather than simply adding to an ongoing talent pool).

• How the candidate can exercise their rights or withdraw consent.

• Information regarding the agency's Data Protection Officer (DPO) or grievance officer.

2. Purpose Limitation and Data Minimization

Only collect what you actually need at the application stage. Asking for full ID cards, salary slips, and home addresses at that stage can create additional compliance risks.

3. Data Retention and Erasure Protocols

The DPDP rules state that you must delete the data when its primary purpose has been fulfilled or when consent is withdrawn. If a candidate is rejected or doesn't wish to remain in your talent pool, you cannot retain their data indefinitely.

4. Candidate Rights Infrastructure

Data Principals hold rights to:

• Access a summary of their personal data and the identities of the corporate clients with whom it was shared.

• Correct any out-of-date work histories or contact numbers.

• Erase records upon request.

• Have access to a defined grievance redressal mechanism prior to escalating the matter to the Data Protection Board of India (DPBI).

1. Audit your data sources: List all the ways applicant profiles come into your agency, like job boards, WhatsApp, email, or your internal ATS, and find out where this data is stored.

2. Update your intake forms: Add clear DPDP notices to your career portals and resume collection forms.

3. Establish Data Processing Agreements (DPAs): Update contracts with hiring clients and background verification (BGV) vendors to formally define data-handling limits.

4. Implement Access Controls: Enforce role-based access control (RBAC) and encryption across your applicant tracking tools.

5. Appoint a Grievance Redressal Officer: Publish their contact details prominently on your website and recruitment portals.

Manual tracking of consent forms, candidate erasure requests, and vendor agreements creates high administrative overhead for fast-moving hiring teams. KavachOne provides an end-to-end data privacy and DPDP compliance platform engineered to automate compliance across complex talent workflows.

Key Capabilities of KavachOne

• Centralized Consent Lifecycle Management: Capture, record, and track candidate consent across portals, job application forms, and email communications with auditable timestamps.

• Automated Data Subject Requests (DSR/SRM): Offer candidates a self-service portal to view, correct, or request erasure of their profiles, reducing manual HR intervention.

• Intelligent Retention and Purge Workflows: Define custom retention policies (e.g., auto-purge unsuccessful profiles after 180 days unless re-consented) to maintain zero-liability talent databases.

• Vendor and Client Risk Assessment: Standardize Data Processing Agreements (DPAs) and monitor compliance status across third-party background checkers and enterprise clients.

• Privacy by Design for ATS Integration: Integrate via API with leading Applicant Tracking Systems to minimize workflow disruption.

• Reduce risk: Protect your firm from DPBI fines for security issues or processing data without consent.

• Build client trust: Show that your firm is ready to work with large companies and meets their strict vendor requirements.

• Work faster: Automate repetitive compliance tasks so your recruiters can focus on filling roles instead of managing spreadsheets.

Proactive data governance gives your agency an edge and builds trust with both candidates and top hiring partners. Moving to modern privacy systems protects you from regulatory risks and keeps your placements on track.

Ready to simplify DPDP Act compliance for your recruitment agency? Book a demo with KavachOne to discover how automated consent tracking, privacy workflows, and data governance fit directly into your hiring operations.

No. The DPDP Act does not accept blanket or implied consent. Agencies need to get clear, specific consent from candidates before sharing their data with employers or background checkers.

3. What happens to candidate data after a hiring role is closed?

You must delete applicant records once the hiring process ends, unless the candidate has explicitly agreed to remain in your talent pool for future job openings.

4. How does KavachOne automate DPDP Act compliance for staffing firms?

KavachOne offers a privacy suite with tools like ConsentiQo for multilingual consent notices, automated data deletion for unplaced resumes, and candidate request portals for access or erasure. These features help reduce manual compliance work.

5. What are the penalties for non-compliant recruitment agencies in India?

The Data Protection Board of India (DPBI) can fine agencies up to ₹250 Crore for each violation, such as serious security failures, processing data without consent, or failing to prevent data breaches.

6. Can candidates ask an agency to delete their profile permanently?

Yes. Candidates have the legal right to withdraw their consent and request that their data be deleted. KavachOne makes this easy with self-service DSAR tools that quickly remove candidate data from your systems and client shares.