Every resume stored in your ATS or shared folder is personal data under DPDPA. Recruitment agencies handling candidate profiles for multiple clients face layered obligations they may not be aware of.
Recruitment agencies routinely collect, store, and share sensitive candidate data — resumes, identity documents, salary expectations, reference contacts — across multiple clients and platforms. Many of these practices were unregulated. DPDPA changes that fundamentally. Agencies that process personal data as part of their core business model are Data Fiduciaries with significant obligations.
Agencies must implement candidate consent flows at the point of CV submission. Data sharing with clients must be disclosed in the consent notice. Retention policies for rejected candidates must be defined and communicated. Third-party ATS vendors must sign Data Processing Agreements.
A recruitment agency sits at the intersection of multiple data flows: candidate personal data, client confidential requirements, background check documents, reference information, and in some cases, sensitive financial or medical data. Under DPDPA, collecting a resume constitutes collection of personal data. Sharing that resume with a client without specific consent from the candidate could constitute a violation. Retaining rejected candidate data beyond a reasonable period without notice is also a compliance gap. Agencies using third-party ATS platforms must ensure those vendors qualify as Data Processors under compliant agreements.
Map every location where candidate data is stored (ATS, email, cloud drives, spreadsheets)
Define a retention policy for active, passive, and rejected candidates
Add explicit consent language to your candidate submission forms
Update client agreements to specify data sharing scope
Sign Data Processing Agreements with your ATS vendor
Create a process for candidates to request deletion of their data
Train recruiters on what data they can and cannot share without consent
Free — takes 3 minutes
Answer a few simple questions. Get your free Readiness Score — sent to your email or WhatsApp.
Check My Readiness →Take our free 3–5 minute industry assessment to find out your compliance risk level.
Take Free Assessment →मुफ़्त डाउनलोड
संपूर्ण DPDPA अनुपालन गाइड
आसान भाषा में। DPDP Rules 2025 समझने के लिए आपके व्यवसाय को जो कुछ चाहिए — फ़ाउंडर्स के लिए लिखा गया, वकीलों के लिए नहीं। अब 7 भारतीय भाषाओं में।
गाइड डाउनलोड करें →5 तैयार टेम्पलेट
सिर्फ़ पढ़िए नहीं — अनुपालन शुरू कीजिए
प्राइवेसी नोटिस, सहमति की भाषा, डेटा इन्वेंटरी, DSR SOP, वेंडर रजिस्टर। आपके ईमेल पर, मुफ़्त।
2-min reads, plain English, every morning. Free forever.
