Regulatory Insights
DPDP Act 2023: What Every Employer Must Do Before Collecting Candidate Data
India's Digital Personal Data Protection Act reshapes hiring workflows. A practical compliance checklist for HR teams.
Mithun Mohan writes · 1 min read · 17 Oct 2026
Mithun Mohan
Principal Consultant · Plexus Search
The new consent standard
The DPDP Act requires consent that is free, specific, informed, unconditional and unambiguous. Pre-ticked boxes in application forms no longer qualify.
Notice obligations
Employers must tell candidates what data is collected, the purpose, and how to withdraw consent or raise a grievance with the Data Protection Board.
Retention and erasure
Candidate data must be erased once the hiring purpose is served, unless retention is required by law. Build automated deletion into your ATS.
Penalties
Failure to take reasonable security safeguards can attract penalties of up to ₹250 crore per instance.
The Neetiman Brief
Fraud alerts and regulatory shifts, weekly.
One email. No noise. Unsubscribe anytime.