Is consent under the DPDP Act different from standard HR consent forms?

Compliance Checklist· 28 items

DPDP Act Compliance Checklist for HR Teams (Background Verification Focus)

A practical DPDP Act compliance checklist specifically for HR teams — covering every obligation related to candidate data collection, background verification, and data retention.

Consent Framework

5 items

Create a separate DPDP-compliant BGV consent form (not bundled with employment agreement)

Consent form specifies: what data is collected, purpose, who will access it, retention period

Consent form includes candidate rights: access, correction, erasure, withdrawal, grievance

Consent is obtained via positive affirmative action (not pre-ticked boxes)

Consent is stored with timestamp and version for audit purposes

Data Processor Management

5 items

Sign a Data Processing Agreement with your BGV vendor

DPA specifies: scope, security standards, sub-processor controls, breach notification (72 hours)

DPA includes data return or deletion obligation on contract termination

Conduct annual review of BGV vendor's DPDP compliance status

Ensure vendor does not use candidate data for any purpose beyond BGV

Data Minimisation

3 items

Only request data that is strictly necessary for the checks being conducted

Remove unnecessary check types from packages for roles where they're not relevant

Confirm that credit checks are only run for financial responsibility roles

Data Retention

4 items

Define and document retention periods: hired candidates vs. rejected candidates

Implement automated deletion/anonymisation at end of retention period

Notify candidates of retention period in the BGV notice

Ensure BGV vendor's retention policy aligns with your own

Candidate Rights Management

6 items

Designate a Data Protection Officer or equivalent point of contact

Create a documented process for responding to candidate access requests

Create a process for handling correction requests

Create a process for erasure requests (with documented exceptions)

Create a process for consent withdrawal requests

Create a process for grievances (respond within 30 days)

Breach Preparedness

5 items

Document your data breach response procedure

Establish notification protocol to Data Protection Board (within 72 hours of discovery)

Establish notification protocol to affected candidates

Ensure BGV vendor's breach notification obligation is in the DPA

Conduct annual breach preparedness drill

Free Download

Download as PDF

Get the complete guide as a professionally designed PDF — free for HR teams.

Download Free

Frequently Asked Questions

Yes, significantly. DPDP consent must be standalone (not in employment agreements), specific (stating exactly what data and for what purpose), and obtained through a clear affirmative action. Pre-ticked consent boxes, vague language, and bundled consent do not meet DPDP standards. Existing consent forms used by most HR teams pre-2024 likely need updating.

Back to Checklists