Recruitment and staffing agencies handle large volumes of candidate personal data — CVs, IDs, references, background checks — and share it with client employers. Under the DPDP Act, both collection and sharing need a basis, and 'we'll keep your CV forever' is no longer safe.
Sourcing and consent
Candidates giving you their CV for a role is a legitimate use for that purpose — but using their data for unrelated roles, marketing, or a long-term database needs consent and a notice.
Sharing with client employers
Passing candidate data to employers is a disclosure the candidate should expect. Be transparent about who you share with, and contract appropriately where you act as a processor.
Background checks and sensitive data
Verification data is sensitive in practice — collect only what's needed, secure it, and delete when the purpose ends.
A recruitment checklist
- Clear notice; consent for database retention and reuse.
- Transparency about sharing with employers.
- Secure handling of IDs and verification data.
- Retention limits for CVs of non-hired candidates.
How DPDP Bridge helps
DPDP Bridge helps recruiters and staffing firms put consent, transparency and retention around candidate data and employer sharing. Take the free assessment to see exactly where you stand and what to do next.
This article is general information about the DPDP Act and is not legal advice. For guidance specific to your organisation, take the free assessment or speak to our team.