Background Checks on New Hires: What You Can Verify and the Candidate Notice Under DPDP
You can verify a candidate's education, past employment, address and criminal record, but get specific, informed consent first: it is unclear whether the DPDP Act's employment exemption covers people not yet hired. Give a standalone notice listing each check and the agency, bind the agency by contract, and delete reports once their purpose is over.
Background verification (BGV) is where hiring meets data protection. A single report can hold a candidate's Aadhaar, degree certificates, salary slips from a former employer and the result of a police check, and it usually passes through an outside agency. This post covers what an employer can check, the legal basis for doing it under the Digital Personal Data Protection (DPDP) Act, 2023 and the DPDP Rules, 2025, and how long to keep the result.
What you can check, and how
| Check | How it is usually done | Watch out for |
|---|---|---|
| Education | Degree certificate checked with the university or through the National Academic Depository on DigiLocker | Verify only the qualifications the role requires |
| Previous employment | Confirmation of dates, designation and exit status from the former employer's HR; relieving letter; salary slips | Former employers may confirm only facts, not opinions |
| Address | Physical visit or digital verification against documents | Collect current address, not every past address |
| Identity | PAN, passport, or Aadhaar by offline or masked verification | Do not store full Aadhaar numbers without need |
| Criminal record | Police or character verification through the state police citizen portal, or court-record searches by an agency | Ask only about what is relevant to the role |
| References | Calls to referees the candidate names | Record facts, not hearsay |
India has no central criminal-record database open to private employers. Police verification services, forms and fees vary by state, and court-record searches by agencies only cover what is publicly available.
When you ask about criminal cases, ask precise questions. In Avtar Singh v. Union of India (2016), the Supreme Court held that an employer must consider the facts objectively and cannot treat a person as having suppressed information that the verification form did not clearly ask for.
The legal basis: consent, not assumption
Section 7(i) of the DPDP Act lets an employer process personal data without consent "for the purposes of employment" and to protect itself from loss or liability. That clearly covers existing employees. Whether it covers a candidate who has not yet joined is not settled: commentators, including the International Bar Association's note on prospective employee checks, point out that the language appears to assume an existing employment relationship.
The safe course for pre-joining BGV is consent under Section 6: free, specific, informed and unambiguous, given by a clear affirmative action. Two practical rules follow:
- ✓A line buried in the offer letter or a pre-ticked box is weak. Use a separate BGV consent form.
- ✓Consent must match the checks. Consent to "verify education" does not cover a credit report or social-media screening.
Once the person joins, ongoing checks (for example, re-verification for a client project) can rely on the employment ground, but tell the employee first.
What the candidate notice should say
The Rules require a standalone notice in clear and plain language that lets the person give informed consent. For BGV, it should list:
- Each check you will run, and the personal data used for it.
- The purpose: assessing suitability for the specific role.
- The verification agency's name and role.
- How the candidate can withdraw consent, and what withdrawal means for the offer.
- How long you keep the report.
- A contact person for questions, and the right to complain to the Data Protection Board.
Withdrawal is not free of consequence. If a candidate withdraws consent for a check the offer depends on, the employer can treat the condition as unmet, as long as the offer letter says so.
The verification agency
An agency running checks on your behalf is a data processor. Under Section 8(2) you may engage one only under a valid contract. The contract should cover:
- ✓the data categories and the only purposes for which they may be used;
- ✓security safeguards, such as encryption, access control and logs;
- ✓a ban on reusing the data or building its own database from your candidates;
- ✓any sub-contractors, such as field agents for address checks;
- ✓breach reporting to you without delay;
- ✓return or deletion of data when the engagement ends.
You remain responsible for what the agency does. Penalties under the Act reach ₹250 crore for failing to take reasonable security safeguards.
How long to keep BGV reports
Section 8(7) requires erasure once the purpose is served, unless another law requires you to keep the data. A workable schedule:
| Situation | Keep | Then |
|---|---|---|
| Candidate not hired | Until any dispute window you define is over, typically a few months | Delete the report and documents |
| Candidate hired | For the period of employment, as proof of the check | Delete after exit, plus the period you need for claims |
| Consent withdrawn | Only what you need to record the withdrawal | Delete the rest |
Keep a short record that the check was done and its outcome, and delete the underlying documents earlier. Most DPDP obligations, including notice, security and erasure, apply from May 2027, 18 months after the Rules were notified in November 2025. Building the process now avoids redoing every offer template later.
A worked example
A Kochi IT services firm hires through campus and lateral drives. In one quarter it screens 80 selected candidates, paying its agency ₹1,500 per standard package (education, last employment, address and police verification).
- Cost: 80 × ₹1,500 = ₹1,20,000.
- Consent: each candidate signs a one-page BGV consent listing the four checks and the agency.
- Outcome: 68 join, 9 decline the offer and 3 fail the employment check.
- Retention: reports for the 12 who did not join (9 + 3) are deleted after 90 days; the firm keeps only a line noting the check and result. The 68 joiners' reports move to their HR files with access limited to two people.
- Vendor: the agency confirms in writing that it has deleted all 80 files from its systems after delivering the reports.
Frequently asked questions
Can we run BGV after the employee has joined?
Yes, and many employers do it within the first weeks. Make the offer and appointment letters conditional on a satisfactory check, and tell the employee before you start.
Can we ask for a credit report?
Only with specific consent and where it is relevant to the role, such as positions handling cash or client funds. Do not make it a standard check for every hire.
Do we need consent to call a referee the candidate named?
Naming the referee implies agreement to that call, but say in the notice that you will contact referees.
Sources
- ✓Government notifies DPDP Rules, Press Information Bureau
- ✓Prospective employee background checks: privacy considerations in India, International Bar Association
- ✓Employee background verification under the DPDP Act, King Stubb & Kasiva
This is a summary, not legal advice. Confirm your BGV consent form and vendor contract with a data protection lawyer, and check the DPDP Act and Rules on meity.gov.in.
Written by
HR Manager, Airwix Technologies (Sleet)
Nihit Dobariya is the HR Manager at Airwix Technologies in Ahmedabad, where he runs HR and payroll for the team behind Sleet. He writes about payroll, PF and ESIC, professional tax, the labour codes and everyday HR practice for Indian employers, and checks each rule against the official notification before it is published.
LinkedIn profile →