Introduction
Background verification has become one of the more data-intensive processes undertaken by Indian employers. A single pre-employment check may involve identity documents, employment history, salary information, educational credentials, criminal antecedents, financial information and, in some cases, health-related information. Much of this information may also be collected or processed by a third-party background verification agency before a candidate has even signed an offer letter.
The Digital Personal Data Protection Act, 2023 (“DPDP Act” or “Act”)1 does not prohibit background verification, but it also does not give employers an unrestricted right to collect and process personal data during recruitment. The Act expressly recognises certain legitimate uses relating to employment, while leaving an important question around the extent to which that provision applies to candidates who have not yet become employees.