Hiring & Verification
DPDP Rules for HR Teams: What Applies Now, Nov 2026 and May 2027
The DPDP Rules, 2025 phase in over 18 months. What HR teams handling candidate and employee data must do now, from 13 November 2026 and from May 2027.
myutils.me9 min read
The Digital Personal Data Protection Rules, 2025 were published in the Gazette on 13 November 2025 (G.S.R. 846(E)), and the Press Information Bureau announced them on 14 November. They do not all apply at once. Rule 1 of the Rules sets three dates: the Board-related rules applied immediately, the Consent Manager rule applies one year later, and the duties that matter most to HR teams apply eighteen months after publication, around 13 May 2027.
So in August 2026, most of what an HR team will have to do under the Digital Personal Data Protection Act, 2023 (DPDP Act) is not yet in force. The work to get ready, though, sits almost entirely with HR: candidate notices, background-check vendors, retention of rejected applications and breach handling.
This is a summary of the law to help you plan. It is not legal advice. Have your own counsel review how it applies to your organisation.
The three dates
| From | What comes into force | What it means for HR |
|---|---|---|
| 13 November 2025 (publication) | Rules 1, 2 and 17 to 21: the Data Protection Board of India, its members, functioning and appeals | Little day to day. The regulator is being set up. |
| One year after publication, about 13 November 2026 | Rule 4: registration and obligations of Consent Managers | Consent Managers can register with the Board. Optional for employers to use. |
| Eighteen months after publication, about 13 May 2027 | Rules 3, 5 to 16, 22 and 23: notice, security safeguards, breach intimation, erasure and retention, contact person, children's data, rights requests, transfers abroad | The core duties for every employer processing candidate or employee data digitally. |
The Gazette is dated 13 November 2025 and PIB's announcement is dated 14 November, so you will see both dates used. The Rules count from "the date of publication" in the Gazette. Plan for the earlier date.
What applies to HR now
The Act's own sections are also being brought into force in phases, by a separate notification, along the same lines as the Rules. Check the commencement notification on MeitY's site for the exact sections in force on any date. In practice, the notice, consent, security, breach and erasure duties below are tied to Rules that start in May 2027. The Information Technology Act, 2000 still applies, including its section 43A on compensation for negligent handling of sensitive personal data by companies. Section 44 of the DPDP Act omits section 43A, but only once that provision of the DPDP Act comes into force. Treat today as the preparation window, not a gap in the law.
What changes in May 2027
A notice before you collect
Section 5 of the Act and rule 3 require a notice with, or before, every request for consent. Under rule 3 it must:
- stand on its own, separate from other terms
- itemise the personal data you collect
- state the specific purpose, such as "assessing your application for the role of Accounts Executive and checking your employment history"
- give a link or other way to withdraw consent as easily as it was given, to exercise rights, and to complain to the Board
For hiring, this usually means a candidate privacy notice shown on your careers page or application form, and a separate one when you start a background check.
Consent that is limited to what you need
Section 6(1) says consent must be "free, specific, informed, unconditional and unambiguous" and limited to the personal data "necessary for such specified purpose". Asking for a candidate's last three years of salary when assessing them for a role may be defensible. Collecting their family members' details at the application stage is harder to justify. The candidate can also withdraw consent under section 6(4).
Security safeguards and processor contracts
Rule 6 lists minimum safeguards: encryption, masking or tokenisation, access control, logs and monitoring, backups, and keeping logs for one year. It also requires "appropriate provision in the contract" with any Data Processor. Your background-verification agency, applicant tracking system and payroll provider are Data Processors. Section 8(1) keeps you, the employer, responsible for what they do on your behalf.
Breach intimation within 72 hours
Under rule 7, on becoming aware of a personal data breach you must tell each affected person "without delay", in plain language. You must also tell the Board without delay and send a detailed report within 72 hours.
Erasure and retention
Section 8(7) says personal data must be erased once the purpose is no longer served or consent is withdrawn, unless another law requires you to keep it. The fixed erasure periods in the Third Schedule apply to large e-commerce, online gaming and social media platforms, not to employers. Separately, rule 8(3) requires every Data Fiduciary to keep personal data and processing logs for at least one year from processing, for the purposes listed in the Seventh Schedule.
| Data | Practical handling under the Act |
|---|---|
| Application from a candidate you rejected | Erase when the hiring purpose ends, subject to the one-year minimum under rule 8(3) and any other law |
| Background-check report on a new joiner | Keep only what the employment purpose needs; ask the vendor to erase its copy as section 8(7)(b) requires |
| Payroll, PF and tax records of employees | Retain as labour and tax laws require; the DPDP Act defers to those laws |
A contact person and rights requests
Rule 9 requires you to publish the contact details of a person who can answer questions about processing. Under rule 14 you must respond to access, correction and erasure requests within a period not exceeding 90 days.
The open question: "legitimate use" for candidates
Section 4 allows processing either with consent or for a "certain legitimate use" under section 7. Clause (i) of section 7 covers processing:
for the purposes of employment or those related to safeguarding the employer from loss or liability, such as prevention of corporate espionage, maintenance of confidentiality of trade secrets, intellectual property, classified information or provision of any service or benefit sought by a Data Principal who is an employee.
For existing employees, this gives employers a route to process data without separate consent for many routine purposes. Whether "purposes of employment" also covers job candidates, who are not yet employees, is unsettled. The Act does not define it, the Rules do not address it, and the Board has not ruled on it. Until it is settled, the cautious route is to treat recruitment and pre-joining background checks as consent-based: give the rule 3 notice, ask for consent, and limit the data to what the role needs.
Penalties
The Schedule to the Act sets maximum penalties per breach, imposed by the Board:
| Breach | Penalty up to |
|---|---|
| Failing to take reasonable security safeguards | ₹250 crore |
| Failing to notify the Board or people of a breach | ₹200 crore |
| Breach of other provisions of the Act or Rules | ₹50 crore |
A checklist to work through before May 2027
- List every place candidate and employee data enters: careers page, job portals, referrals, assessments, background checks, onboarding forms.
- Write a candidate notice that itemises the data and purposes, and a separate one for background verification.
- Remove fields you cannot tie to a purpose.
- Review contracts with your applicant tracking system, background-check vendor and payroll provider for security and erasure terms.
- Set retention periods for rejected applications and verification reports, and a way to erase them.
- Name a contact person for data questions and publish their details.
- Write a breach procedure that can reach the Board within 72 hours.
For income checks, a consent-based method avoids collecting more than you need. With Greenflag by myutils.me, the employer sends a request and the candidate signs in with the invited email. The candidate syncs their own PAN, previews the figures and chooses what to share. The employer receives a read-only copy of the candidate's own AIS, TIS and ITR figures for the categories shared. You remain responsible for your own notice and retention. Our employer guide walks through the steps, and how employers verify past salary compares the other methods.
FAQ
When do the DPDP Rules apply to employers?
The duties most relevant to employers (notice, security safeguards, breach intimation, retention and rights requests) apply eighteen months after the Rules were published on 13 November 2025, so from about 13 May 2027.
Do we need a Consent Manager?
No. Consent Managers are optional intermediaries that let people give and withdraw consent across organisations. Their rule applies from about 13 November 2026, but employers can collect consent directly.
Can we rely on legitimate use instead of consent for candidates?
That is unsettled. Section 7(i) covers "purposes of employment", and its wording refers to employees. Until the Board or courts clarify, many employers plan to take consent from candidates.
Is a background-check vendor responsible, or are we?
You are. Section 8(1) makes the Data Fiduciary responsible for processing done on its behalf by a Data Processor, and rule 6 requires security terms in that contract.
How long can we keep a rejected candidate's CV?
Only until the hiring purpose is served, unless another law requires longer. Rule 8(3) separately requires a minimum of one year for personal data and logs for the purposes it lists. Set a written retention period and follow it.
Sources
myutils.me
Written by the team behind myutils.me, a free, independent app that brings ITR status, refunds and AIS/TIS for each PAN into one dashboard. Check anything important against the Income Tax portal before you act on it.
