DPDP Act for HR Teams: What Changes for Candidate Data by May 2027

India's Digital Personal Data Protection Act, 2023 (DPDP Act) applies to digital personal data, and recruiting runs on it: CVs, contact details, interview notes, offer letters and ID documents. The Digital Personal Data Protection Rules, 2025 set out how the Act works in practice and when each part starts.

The dates

The Rules were notified in November 2025 and come into force in phases (AZB & Partners, Mondaq):

For most HR teams, May 2027 is the date that matters. That leaves time to fix processes now, rather than in a rush.

Which recruiting data is covered

• Application details: name, email, phone, address, CV and cover letter.
• Assessment and interview data: scorecards, notes and recordings.
• Offer and onboarding data: salary, bank details, PAN and Aadhaar.
• Data in emails, spreadsheets and chat, not only in your ATS.

As the employer, you decide why and how candidate data is processed, which generally makes you the data fiduciary. Your ATS and other vendors usually act as data processors on your behalf.

Consent at application

The Act lets you process personal data with consent or for certain "legitimate uses", including some employment purposes. How far the employment ground reaches for job applicants is a question for your lawyer. Many employers take the cautious route for candidates: a clear notice at the application form explaining what data is collected and why, and a separate, optional consent for anything beyond the application itself, such as keeping the CV for future roles or sending WhatsApp updates.

Requests: access, correction and erasure

Candidates have rights over their data, including to get information about it, to have it corrected and to have it erased, and to raise a grievance. In practice that means you need:

• A simple way for candidates to make a request.
• One place where requests are logged, assigned and given a due date.
• A way to export a candidate's data, and to erase it from every system, including spreadsheets and email.
• A record of what you did and when.

The Rules set expectations on how quickly grievances are handled. Check the current text for the exact period and set your internal deadline inside it.

Retention: how long to keep CVs

Personal data should be kept only as long as it's needed for the purpose it was collected for. For rejected candidates, decide a retention period (for example a number of months after the job closes), apply it consistently, and delete or anonymise data after that. Keep a record that the clean-up ran.

ID documents and Aadhaar

Collect ID documents only when you need them, usually at the offer or onboarding stage, not at application. Store them encrypted, limit who can open them, and log every view. For Aadhaar, show staff a masked version with only the last four digits visible wherever the full number isn't required.

Breaches

The Rules require breaches to be reported to the Data Protection Board and to the people affected, with a detailed report to the Board within 72 hours of becoming aware of the breach (subject to any extension the Board allows). Make sure your vendors will tell you quickly if something goes wrong on their side.

A 10-point checklist

1. 1List where candidate data lives: ATS, email, spreadsheets, chat, shared drives.
2. 2Write a plain-language notice for the application form.
3. 3Make optional consents (talent pool, WhatsApp) separate and unticked by default.
4. 4Give candidates one place to make requests.
5. 5Log every request with an owner and a due date.
6. 6Be able to export and erase a candidate's data everywhere it's stored.
7. 7Set a retention period for rejected candidates, and automate the clean-up.
8. 8Collect ID documents only at onboarding; mask Aadhaar for staff.
9. 9Check your vendors' contracts and breach-notification commitments.
10. 10Write down your breach response, including the 72-hour report.

Notices that candidates can actually read

A notice should tell candidates, in plain language, what data you collect, why, who it's shared with (for example your ATS provider or a background check provider), how long you keep it, and how to make a request or complaint. Put it on the application form, not in a footer link nobody opens.

Who does what in your team

Your vendors

Your ATS, background check provider and payroll system all handle candidate data for you. Check that each one lets you export and erase data, restricts access by role, logs access to sensitive documents, and will tell you promptly about a breach on their side.

How OneATS helps

OneATS is built to support these processes: candidates can ask for access, correction or erasure from their application status link; requests appear in Settings → Privacy with a due date (30 days by default, which you can change); admins can export a candidate's data or erase it from their company; you set how long candidate data is kept; and Aadhaar previews show only the last four digits, with the original encrypted and every view logged. The tools help, but compliance depends on your own processes too.