HR, staffing and recruitment firms process large volumes of candidates' and employees' personal data and must comply with the DPDP Act by 13 May 2027. Employers can process employee data for employment purposes without consent, but candidate databases, CVs from job portals and background checks need a lawful ground and a notice. Staffing firms must work out, contract by contract, whether they act as a Data Fiduciary or a Data Processor for their clients.
- Deadline
- 13 May 2027
- Employee data
- Legitimate use (s.7(i))
- Candidate CV databases
- Need notice and retention limits
- Client contracts
- Fiduciary or processor?
Where hr, staffing and recruitment firms face the most DPDP risk
| Area | What to do |
|---|---|
| CV databases and job-portal downloads | Notice to candidates; delete stale CVs on a schedule |
| Background verification | Tell the candidate, limit checks to the role, contract with the BGV vendor |
| Payroll for clients | Act as processor under a written contract with security and breach terms |
| Sharing CVs with multiple clients | Candidate's agreement before submitting to each client |
| ID documents (Aadhaar, PAN) | Mask Aadhaar numbers, restrict access, encrypt storage |
Other rules that apply alongside the DPDP Act
- Aadhaar Act rules on storing and masking Aadhaar numbers
- Labour and tax laws on keeping employee records
Where another law sets a stricter or longer requirement, follow both: the DPDP Act does not override sector rules on retention or storage.
Six steps to comply
- Map candidate and employee data flows, including job portals and client handovers.
- Decide your role (fiduciary or processor) for each client service and update contracts.
- Add a candidate privacy notice and a CV retention period.
- Secure ID documents and bank details; mask Aadhaar.
- Prepare a breach plan, since staffing databases are a frequent target.
- Train recruiters on consent before sharing CVs.
Most DPDPA duties apply from 13 May 2027, with penalties up to ₹250 crore per breach. See the DPDPA 2027 roadmap and the DPDP compliance checklist.
Want it done for you? Our DPDP compliance service covers data mapping, notices, consent, vendor contracts, breach plans and staff training for staffing agencies, recruitment firms, payroll and HR-tech providers.
Frequently asked questions
Is a staffing agency a Data Fiduciary or a Data Processor under DPDP?
It depends on the service. For its own candidate database it is a Data Fiduciary. When it runs payroll or onboarding on a client's instructions, it is usually the client's Data Processor and needs a contract.
How long can recruiters keep CVs under the DPDP Act?
Only as long as needed for the purpose the candidate gave it for. Set a retention period, for example 12 to 24 months, and delete or re-confirm after that.
DPDP guides for other industries
- DPDP Act (DPDPA), 2023: complete guide
- DPDP compliance checklist
- DPDPA 2027 compliance: deadline and roadmap
- DPDP compliance cost in India
- DPDP compliance for hospitals and healthcare
- DPDP compliance for edtech, schools and coaching
- DPDP compliance for fintech, nbfcs and lending apps
- DPDP compliance for e-commerce and d2c brands
- DPDP compliance for real estate developers and brokers
See all deadlines on the compliance calendar, or browse the compliance hub.
This guide is general information based on the law as of 25 October 2026, not legal advice. Rules and dates can change by notification; speak to a professional about your situation.