India’s Digital Personal Data Protection Act, 2023 (DPDP Act) establishes a framework for processing digital personal data and defines rights for individuals whose personal data is processed. For employers, these requirements come into play when candidate and employee data is collected, processed and managed throughout the employment lifecycle.
Understanding candidates’ and employees’ rights under the DPDP Act is essential to build data practices that can help support transparency, responsible data governance, and workforce trust.
In this article, we explore:
- What a Data Principal is under the DPDP Act
- The rights available to Data Principals
- How these rights relate to workforce screening
- Employer responsibilities when processing candidate and employee data
- Practical approaches to responsible workforce data governance
What is a Data Principal under the DPDP Act?
Understanding the definition of a Data Principal
Central to the DPDP framework is the concept of the Data Principal: an individual to whom personal data relates. In an employment context, this can include a candidate or employee whose personal data is being processed by an organisation.
Understanding Data Principals’ rights is particularly relevant to workforce screening, during which organisations may process personal data for background verification, identity checks, and other employment-related activities.
Workforce data may move through several stages, from recruitment and background verification to onboarding and employment administration. Identifying why data is being processed, who is responsible for processing and protecting it, and how individuals can exercise applicable rights can support more transparent data governance.
Employee and candidate data within the DPDP framework
The DPDP Act establishes different roles within the personal data processing relationship:
- Data Principal: The individual to whom the personal data relates.
- Data Fiduciary: The organisation that determines the purpose and means of processing personal data.
- Data Processor: An entity that processes personal data on behalf of a Data Fiduciary.
For example, an employer may act as the Data Fiduciary when determining why candidate information is processed, while a third-party screening provider who uses the candidate’s information to complete a background check on the employer’s behalf is acting as a Data Processor.
Understanding these roles can help organisations establish clearer responsibilities throughout the workforce screening process.
What rights do data principals have?
The DPDP Act provides Data Principals with specific rights relating to their personal data, including rights concerning access to information, correction and completion of personal data, erasure of personal data, grievance redressal, nomination of another individual to exercise these rights, and, where applicable, withdrawal of consent.
Whether a specific right applies, and how it may be exercised, depends on the relevant processing circumstances and applicable provisions.
Right to access information
The DPDP framework provides Data Principals with the right to obtain information about their personal data and certain aspects of its processing.
In workforce screening, this may be relevant when a candidate or employee wants to understand what personal data an organisation holds or how information has been shared in connection with a screening process.
Right to correct personal data
Data Principals have a right to request the correction and completion of personal data that is inaccurate or incomplete, subject to applicable provisions. A candidate may, for example, identify an incorrect employment date, job title, or other personal detail.
Accuracy is particularly important during workforce screening, since employment decisions may rely on the information gathered through this process.
Clear processes for addressing inaccuracies can help support accurate workforce records.
Right to request erasure of personal data
The DPDP framework provides a right relating to erasure of personal data, subject to applicable requirements and exceptions. Employers should therefore consider implementing data retention and disposal practices that align with the purpose for which personal data is processed and any applicable legal or regulatory retention requirements.
An erasure request does not necessarily mean that all information must be deleted immediately. Organisations should assess requests against applicable requirements.
Right to grievance redressal
Data Principals have a right to access grievance redressal mechanisms, which should be provided by the Data Fiduciary.
To help address this requirement, employers may set up clear channels through which candidates and employees can raise questions or complaints about the processing of their personal data.
HR, privacy and compliance teams should understand their respective responsibilities for handling grievances.
Right to nominate
The DPDP Act allows a Data Principal to nominate another individual to exercise their rights on their behalf in the event of their death or incapacity.
In an employment context, this right may be relevant where a candidate or employee wishes to designate someone who can act on their behalf in relation to their personal data, such as exercising access, correction or erasure rights, should they become unable to do so themselves.
Withdrawal of consent
Where consent is the basis for processing personal data, the Data Principal has the right to withdraw that consent. The DPDP Act provides that withdrawing consent should be as easy as giving consent.
However, consent is not always the sole legitimate basis for processing. In some cases, data processing may be permitted under the DPDP Act, the Digital Personal Data Protection Rules, 2025, or another applicable law, even when consent has been withdrawn. This distinction is particularly relevant when considering employment-related processing. When in doubt, employers should consult their legal counsel for advice tailored to their requirements and circumstances.
How do Data Principals’ rights affect workforce screening?
Candidate consent and notice during background checks
Workforce screening can involve processing personal data for activities such as employment history verification, education verification, and identity checks.
Where consent is the applicable basis for processing, the DPDP Act requires it to be free, specific, informed, unconditional, and unambiguous, with a clear affirmative action, such as actively selecting a checkbox or button, rather than relying on pre-ticked boxes, inactivity, or silence. Consent requests must also be presented in clear and plain language. The 2025 DPDP Rules also establish requirements concerning notices and the information provided to Data Principals.
Employers should distinguish between processing that relies on consent, processing permitted under another provision of the DPDP framework, and organisational practices adopted to promote transparency.
Transparency in verification processes
Clear communication can help candidates understand what information is being processed and why.
Where appropriate, employers can explain the nature and scope of verification activities, how relevant information will be handled, and where candidates can find information about their applicable rights.
A transparent process can also help candidates identify inaccuracies and understand how to raise questions about their information.
Third-party screening providers and data processing
Employers may use third-party screening providers to support background verification and identity verification. Where a provider processes personal data on behalf of an employer, the relationship should be considered within the Data Fiduciary and Data Processor framework established by the DPDP Act. Employers should assess contractual arrangements, security measures, processing responsibilities, and data-handling practices when selecting and managing third-party screening providers.
For a broader discussion of employer responsibilities, see our DPDP Act for Employers guide.
What are employers’ responsibilities under the DPDP framework?
Data Fiduciary responsibilities
An employer who determines the purpose and means of processing personal data may be acting as the Data Fiduciary. As such, they may have responsibilities relating to the processing and protection of personal data under the DPDP framework. Employers should therefore establish appropriate governance processes that cover candidate and employee information.
Transparent data governance
Organisations should consider data governance across the employment lifecycle, from recruitment and screening through onboarding and employment.
Relevant practices may include:
- Clear privacy notices
- Documented processing purposes
- Appropriate data access controls
- Defined responsibilities
- Retention and disposal processes
- Mechanisms for handling Data Principal requests
Protecting candidate information
Data security is an important part of responsible personal data management. Depending on the organisation and processing activity, safeguards may include access controls, secure systems, encryption, and appropriate controls for data transfers.
The DPDP Rules 2025 also establish requirements relating to reasonable security safeguards for protecting personal data.
Coordinating HR, legal and compliance teams
Data Principal requests can involve several functions within an organisation. HR and Talent Acquisition teams may manage candidate interactions, while Legal, Compliance, Privacy or Information Security teams may provide additional oversight. Clear internal responsibilities can help organisations respond consistently to data-related requests and review workforce screening processes as the regulatory framework develops.
For broader guidance, see our DPDP Compliance in India resource.
What are practical ways to manage candidate and employee data?
Establish clear data-handling processes
By mapping how candidate and employee information moves through recruitment, screening and HR systems, organisations can better understand where personal data originates, why it is processed and which parties are responsible for it. This can make it easier to identify appropriate governance controls.
Review internal data governance policies
Organisations should periodically review their privacy notices, data-handling procedures, retention practices, and candidate communications to reflect their actual processing activities and applicable regulatory requirements.
Communicate clearly with candidates
Organisations should use clear, accessible language when communicating with candidates about data processing.
Where consent is requested, the applicable requirements for clear and plain language should be followed. Candidates should also be able to understand how they can exercise applicable rights and raise questions or grievances.
Work with appropriate third-party screening providers
When selecting a third-party screening provider, organisations should consider relevant data protection, security, processing, and governance practices.
Learn more about First Advantage’s background verification services and identity checks.
Key takeaways
- Data Principal: A Data Principal is the individual to whom personal data relates. In employment, this can include candidates and employees whose personal data is being processed.
- Individual rights: The DPDP framework provides Data Principals with rights relating to their personal data, including access to information, correction, erasure, grievance redressal, and nomination of another individual to exercise these rights, subject to applicable provisions.
- Consent: Where consent is the basis for processing, Data Principals can withdraw it. Employment-related processing may also involve other provisions of the DPDP framework.
- Workforce screening: Employers should consider transparency, data governance, security, and appropriate processing arrangements when conducting background verification and identity checks.
- Third-party providers: Organisations should understand the respective responsibilities of Data Fiduciaries and Data Processors when working with external third-party screening providers.
Support your India workforce screening strategy
Responsible workforce screening combines appropriate verification with clear data governance and candidate communication.
Learn how First Advantage can support workforce screening and identity verification in India.
Frequently asked questions
What is a Data Principal under India’s DPDP Act?
A Data Principal is the individual to whom personal data relates. In an employment context, this can include candidates and employees whose personal data is being processed by an organisation.
Do job candidates have data privacy rights during background checks?
The DPDP framework provides Data Principals with specific rights relating to their personal data. The rights and obligations that apply to a particular background screening activity depend on the relevant processing circumstances and applicable provisions.
Can an employee or candidate request deletion of their background check data?
The DPDP framework provides a right relating to erasure of personal data, subject to applicable provisions and retention requirements. Organisations should assess erasure requests against the relevant circumstances before determining the appropriate response.
How does consent withdrawal affect the hiring process?
Where consent is the basis for processing, a Data Principal can withdraw consent. Processing may continue where it is otherwise permitted or required under the DPDP Act, the Digital Personal Data Protection Rules, 2025, or another applicable law.
What is the role of a third-party screening provider under the DPDP Act?
A third-party screening provider may act as a Data Processor where it processes personal data on behalf of an employer acting as the Data Fiduciary. The specific roles and responsibilities should be assessed based on the actual processing arrangement.
Sources
Digital Personal Data Protection Act, 2023: Ministry of Electronics and Information Technology (MeitY), Government of India | Digital Personal Data Protection Rules, 2025: Ministry of Electronics and Information Technology (MeitY), Government of India | Digital Personal Data Protection Rules, 2025: Gazette of India | Ministry of Electronics and Information Technology (MeitY): Acts and Policies
