What is the DPDP Act?

LiveRec EditorialUpdated

The DPDP Act is the Digital Personal Data Protection Act, 2023, India's law on handling personal data in digital form. It calls the person the data relates to the Data Principal and the organization deciding how data is used the Data Fiduciary. For job seekers, it covers how employers and recruiters use your data.

Key terms

The Act defines a Data Principal as the individual to whom the personal data relates, and a Data Fiduciary as any person who alone or with others decides the purpose and means of processing personal data. A notice must state the purpose, and the Act also provides for consent and for consent managers. Processing for purposes of employment is one of the "certain legitimate uses" listed in the Act.

What applicants can do

Ask a recruiter or employer which personal data they collect, why, and how long they keep it. Read consent forms for background verification before signing. Phased rules and the data protection board arrangements are published by the Ministry, so check its page for what is currently in force.

Example

A candidate receives a request to upload identity documents for verification. Before agreeing, she asks the employer what the documents are used for and how long they are kept.

Sources

This is general information, not legal, tax or immigration advice. Rules change and your situation may differ. Consult a licensed attorney or qualified adviser.