HR Tech, Staffing and Recruitment: A DPDP Act Impact Study

Executive summary

Overall impact: Medium-High.

This study covers the businesses that sit between employers and people: job portals and hiring apps, applicant tracking (ATS), HR management (HRMS) and payroll software, staffing and payroll outsourcing firms, background verification (BGV) vendors, and recruiting agents placing Indians in jobs abroad. The employer's own duties are covered in Trayambic's article on background checks and employee monitoring; this study does not repeat them.

Under the Digital Personal Data Protection Act, 2023 (the DPDP Act), a data fiduciary decides why and how personal data is used, a data processor handles it on a fiduciary's behalf, and a data principal is the person the data is about. Much of this sector works as a processor for employers, which tempers the impact. But its own databases, from CV banks and talent pools to verification records, make it a fiduciary too, and the data is among the most sensitive a private business holds.

Four of the twelve areas on our scorecard rate High. The three biggest changes:

• Role is the product. A staffing company is an employer for its associates, a processor when it runs a client's payroll and an independent fiduciary for its candidate database. Contracts, notices and product settings must follow each role.
• Candidates have rights employees may lack. Applicants share data voluntarily or with consent, so the rights of access, correction and erasure apply to them. Rejected candidates' data must go when the purpose ends, and a talent pool needs its own consent.
• Verification must be accurate, not just thorough. Court-record matches, provident fund histories and Aadhaar checks feed hiring decisions, so the accuracy duty in section 8(3) and the Aadhaar rules apply directly.

Background

Segments. Job portals hold job seekers' profiles and let recruiters search them. ATS, HRMS and payroll software holds clients' candidate and employee records. Staffing firms, including employer-of-record and apprenticeship providers, put associates on their own rolls and deploy them at clients. BGV vendors check identity, address, education, employment and court records, often through field agents. Recruiting agents registered under the Emigration Act, 1983 source workers for foreign employers.

Data principals. Job seekers and candidates, including those never hired; associates; clients' employees; referees and former managers; nominees and family members; emigrants and their next of kin.

Data. CVs, salary history, identity documents, bank details, Universal Account Numbers (UANs) for provident fund, education certificates, address-check photographs, criminal-record results, assessment scores, interview recordings, AI screening scores and health declarations.

Flows. Portal to recruiter; ATS to hiring manager; staffing firm to client; BGV vendor to field agents, universities, former employers and court databases; payroll to the EPFO, ESIC and tax authorities; recruiting agent to foreign employers and the eMigrate portal; and throughout, to cloud, messaging and AI model providers.

Legal framework

The DPDP Act and Rules

• Roles (section 2). A fiduciary decides purposes and means "alone or in conjunction with other persons", so two businesses can be joint fiduciaries for the same data.
• Grounds (sections 6 and 7). Consent, or a listed legitimate use. Section 7(a) covers data voluntarily provided for a specified purpose. Section 7(i) covers processing "for the purposes of employment", safeguarding the employer from loss or liability, and services an employee seeks. There is no legitimate-interests ground.
• Notice (section 5; Rule 3). Required with every consent request: itemised data, specified purposes and the means to withdraw and complain.
• Rights (sections 11 to 13; Rule 14). Access and correction run against a fiduciary to whom the person gave consent, including under section 7(a). Grievances must be answered within 90 days at most.
• Duties (section 8; Rules 6 and 7). Processors only under a valid contract (8(2)); accuracy where data drives a decision (8(3)); security safeguards, including logs kept a year (8(5)); breach notice to each person and the Board, with a 72-hour report (8(6)); erasure when the purpose ends, including by processors (8(7)).
• Children (section 9; Rule 10). Verifiable parental consent for anyone under 18, which reaches apprentices and interns.
• Claims (section 17(1)(a)). Processing "necessary for enforcing any legal right or claim" is largely exempt.

The main obligations commence on 13 May 2027, when section 43A of the IT Act is also omitted.

Other instruments

How they fit together

Section 38 makes the DPDP Act apply in addition to these laws and prevail in a conflict. The labour and emigration duties mostly operate through section 8(7): records a law requires are "necessary for compliance" and may be kept, but only the records listed and only for as long as required. Filing them with the EPFO, the Shram Suvidha portal or eMigrate is a disclosure required by law to the State, covered by section 7(d). Sharing between a staffing firm and its client is not.

Section 16(2) preserves stricter transfer rules. The DPDP Act restricts no country today, so sending a CV to an employer in the Gulf is permitted. Bank clients are different: the RBI's outsourcing directions can require their vendors to keep data in India.

Analysis

The Trayambic DPDP Impact Scorecard

Overall impact: Medium-High

Three roles in one company

The commonest mistake in this sector is to describe the whole business as a processor. Role depends on the dataset.

• Staffing. For associates on its rolls, the staffing firm is the employer and can rely on section 7(i). The client, as principal employer, is not a mere recipient: the OSH Code makes it answerable for wages a contractor fails to pay (s.55), so it needs some associate data, and it processes more for its own reasons, such as gate access and system logs. Section 7(i) speaks of processing "for the purposes of employment" without saying whose employment, which supports the client's reliance on it. That reading is untested. The contract should say who is fiduciary for what, and the client should receive proof of payment rather than payslips and bank details.
• Payroll outsourcing. Running payroll for a client's own employees is processing on instructions. An employer-of-record arrangement is different: the provider is the legal employer while the client directs the work, which points to joint fiduciaries.
• ATS and recruitment process outsourcing. Processors for each client's candidates, until candidates are pooled across clients. A shared pool is the vendor's own purpose.
• Job portals. Fiduciaries for profiles, and intermediaries for what users post. A recruiter who downloads a CV becomes a fiduciary for its copy. In our view, a profile visible only to paying recruiters has not been "made publicly available", so the exclusion in section 3(c)(ii) does not help.
• BGV vendors. Processors when running a client's checks; fiduciaries for any database they build and reuse.

Trayambic's vendor contracts checklist sets out the contract clauses for processor and fiduciary positions.

Candidates: more rights than employees

Trayambic's background checks article explains why section 7(i) is an uncertain fit for people not yet employed. Section 7(a) is firmer ground for one thing: an application to a named role, where the candidate supplied her CV for exactly that purpose. Pooling, onward sharing with other clients, verification and model training are separate purposes, each needing consent.

Because those grounds carry access and correction rights, a rejected candidate can have stronger statutory rights than an employee processed under section 7(i). She can ask what was held, who received it and, once the purpose ends, for erasure.

Retention is where most firms fail. Section 8(7) requires erasure once the role is filled and any reasonable period for queries has run. Section 17(1)(a) relieves processing "necessary for enforcing any legal right or claim"; that does not obviously extend to keeping every application in case someone sues. Set a fixed period, and run talent pools on consent that expires and is renewed. Job portals must keep registration data for 180 days after an account closes under the IT Rules; after that, section 8(7) requires erasure unless another law applies.

AI screening raises the same accuracy question at scale. Section 8(3) applies whenever a score drives a decision. MeitY's guidelines are voluntary, so firms should set their own controls: human review of AI rejections, regular testing of outcomes across groups, plain disclosure in the candidate notice, and no training on clients' candidates without instruction. Trayambic's article on training AI on personal data covers the training question.

Verification data: Aadhaar, UAN and court records

Aadhaar. Authentication and offline verification need consent, and after offline verification the Aadhaar number may not be stored. Staffing and payroll firms collect Aadhaar for provident fund and ESI registration under section 142 of the Code on Social Security. Reusing that copy for a background check is a new purpose. Keep the two apart.

UAN histories. Some vendors ask candidates for their UAN and a one-time password, or log in to EPFO services for them. In June 2025 the EPFO warned members that external entities offering its services are not authorised by it and may compromise their personal information. Consent to such a check must be specific, credentials must never be kept, and a candidate-downloaded service history is the safer source. A gap in the record should prompt a question to the candidate, not a red flag.

Court records. Vendors search compiled databases of orders and cause lists. Many assume the exclusion for data made public under a legal obligation covers them. That is doubtful: the link between a court record and a particular candidate is the vendor's own inference, and the inference drives the decision. Name matches produce false positives, and a database entry rarely shows how a case ended. Confirm each match against the source record, report the outcome rather than the mere existence of a case, and show the candidate any adverse match before it reaches the client.

Statutory records: contract labour and overseas placement

Staffing firms that supply contract labour hold licences under section 47 of the OSH Code and keep registers that may be electronic. Those registers are records the law requires, so section 8(7) allows them to be kept. It does not allow everything else in an associate's file to be kept alongside them.

Recruiting agents carry heavier record duties. The Ministry of External Affairs' registration conditions require permanent records at the place of business, including bio-data of every emigrant recruited with next-of-kin details, a register of charges signed by each emigrant, and compensation claims. These may be kept as required. Sending a candidate's passport and CV to a foreign employer is a transfer the DPDP Act permits, but the notice should name the employer and country for each demand. Next-of-kin details are a third person's data and should be used only for the purposes the records serve.

The Ministry published a draft Overseas Mobility (Facilitation and Welfare) Bill, 2025 to replace the 1983 Act. As of October 2026 we found no record of its enactment.

Worked example: a staffing and payroll company in Pune

An unnamed Pune company deploys 18,000 associates at about 300 clients, runs payroll for 150 small businesses, operates a careers app with a candidate database, places nurses with Gulf hospitals and uses an AI tool to rank CVs.

1. 1.Role register. Employer for associates; processor for payroll clients; fiduciary for the candidate database; recruiting agent for overseas placements.
2. 2.Associates. Section 7(i) for HR records. Clients receive attendance and proof of wage payment, not bank details, and issue their own notices for site monitoring.
3. 3.Candidates. Applications rest on section 7(a), one role at a time. The talent pool moves to a 12-month consent with renewal reminders; other non-hired candidates' data is erased six months after the decision.
4. 4.AI ranking. Every AI rejection is reviewed by a recruiter, outcomes are tested quarterly by gender and region, and the vendor contract bars training on candidate data.
5. 5.Verification. Aadhaar by offline modes without storing the number; employment through candidate-downloaded service histories; court matches confirmed at source, with seven days for the candidate to respond.
6. 6.Overseas desk. Consent per demand naming the hospital and country; emigration records kept as required; everything else erased when the placement closes.
7. 7.Payroll clients. A standard processing agreement with Rule 6 controls and incident notice within hours, so clients can meet the 72-hour report.

Compliance framework

Phased roadmap

• Now to December 2026: role register; data inventory; stop new cross-client pooling.
• January to March 2027: consents and notices; retention schedule; verification protocols; contract updates.
• April to May 2027: rights handling; first erasure run; incident rehearsal with a key client.
• Ongoing: track the Overseas Mobility Bill, UIDAI rules, court rulings on de-indexing and SDF notifications.

Recommendations

1. 1.Write down your role for every dataset. Most disputes in this sector will turn on whether you were a fiduciary or a processor.
2. 2.Treat candidates as rights-holders. They have stronger statutory claims than many employees, so build access and erasure into the product.
3. 3.Put an expiry date on every CV. Rejected applications and talent pools need fixed periods and renewal, not indefinite storage.
4. 4.Verify the verifier. Confirm court matches at source, never keep EPFO credentials, and give candidates a chance to explain before a report goes out.
5. 5.Keep statutory registers and everything else in separate stores, so that legal retention does not become an excuse to keep the rest.
6. 6.Govern AI screening like any other decision-maker, with human review, testing and disclosure.

Key takeaways

• HR tech and staffing firms play several DPDP roles at once: employer, processor and independent fiduciary. Each dataset needs its role recorded.
• Candidates processed under consent or section 7(a) have access, correction and erasure rights, often stronger than employees under section 7(i).
• Rejected candidates' data and talent pools need fixed retention periods and, for pools, renewable consent.
• Aadhaar, UAN and court-record checks drive hiring decisions, so section 8(3) accuracy and the Aadhaar rules apply directly.
• Labour and emigration record duties justify keeping the records they list, not whole personnel files.