Candidates, interns / trainees and employees under Sections 6, 7(a) and 7(i) of the DPDP Act, 2023

- Prepared by Shubhank Suman, AI, Privacy, and IP Counsel

Why This Note

HR and talent teams often treat “consent” and “legitimate use” as interchangeable, and often treat employees, interns and candidates as one class of workforce data. Sections 5 and 7 of the DPDP Act draw a sharper line between the two grounds, and that line runs differently depending on whether an employment relationship already exists. This note sets out the distinction for practical use.

Basic Rule: First test Section 7(a) where the individual voluntarily provided personal data for a specified purpose. For employees, test Section 7(i) where processing is genuinely connected with employment, employer protection, or an employee-requested service or benefit. If neither basis, nor another Section 7 ground, covers the activity, obtain valid consent under Section 6 before processing.

Category

Applicable legal basis

When the basis may be relied upon

When Section 6 consent should ordinarily be obtained (examples)

Candidate / Job Applicant

  • Section 7(a): voluntarily provided personal data. This is ordinarily the principal legitimate use for the recruitment process.
  • Section 7(i) should not ordinarily be used because the candidate is not yet an employee.
  • If Section 7(a) does not cover the activity, obtain Section 6 consent or identify another applicable Section 7 ground.

Section 7(a) may be relied upon where: The candidate voluntarily sends a CV or applies for a particular vacancy. The data is used only to assess and process that application.

Recruitment activities may include:

  • Reviewing the CV and application.
  • Assessing qualifications and experience.
  • Shortlisting the candidate.
  • Scheduling and conducting interviews.
  • Communicating about the role applied for.
  • Making the selection decision.
  • Retaining the CV after the recruitment process for future vacancies.
  • Considering the candidate for unrelated or materially different roles.
  • Sharing the CV with placement partners or recruitment agencies for other opportunities.

Intern / Trainee

  • Section 7(a): voluntarily provided personal data.
  • Section 7(a) may cover the specified internship or training purpose for which the individual submitted the data.
  • Section 7(i) should not automatically be used merely because the person works at the organisation. An intern or trainee is not ordinarily treated as an employee.

If Section 7(a) does not cover the activity, obtain Section 6 consent or identify another applicable Section 7 ground.

Section 7(a) may be relied upon where: A student voluntarily applies for a specified internship or training programme. The individual provides contact, academic or application details for selection.

  • Adding the intern to a talent pool after the programme.
  • Allocating a supervisor or department.
  • Recording attendance needed to administer the programme.
  • Assigning work and training activities.
  • Using the data for a purpose outside the stated internship or training programme
  • Sharing information with unrelated third parties or for promotional purposes.

Employee

  • Section 7(i): employment and employer-protection purposes. It may support processing genuinely necessary for employment.

It may also cover safeguarding the employer from loss or liability, preventing corporate espionage, and protecting trade secrets, intellectual property, classified or confidential information.

It may cover processing necessary to provide a service or benefit sought by the employee.

  • Processing outside these purposes requires Section 6 consent or another applicable Section 7 ground.

Core employment purposes may include:

  • Employee onboarding and personnel records
  • Payroll, salary and bank details for payment.
  • Attendance, shifts and leave management.
  • Performance management and appraisal.
  • Disciplinary and grievance processes.
  • Exit formalities and final settlement.

Employer-protection activities may include:

  • Access controls and properly scoped security monitoring.
  • Investigating theft, fraud, misconduct or suspected data leakage.
  • Protecting trade secrets, intellectual property and confidential information.
  • Optional wellness programmes involving additional personal information.
  • Using employee photographs or videos on public websites.
  • Publishing testimonials on social media.
  • Featuring employees in advertisements, brochures or promotional campaigns.
  • External publicity not necessary for the employee’s role.
  • Retaining or using information for an unrelated purpose after employment ends.
  • Any optional, promotional or insufficiently employment-related activity.

The Basic Architecture

Section 4 permits processing of personal data on only two footings: consent taken under Section 6, or one of the nine “certain legitimate uses” listed in Section 7. Unlike the GDPR, there is no open “legitimate interest” test that a fiduciary may invoke through its own balancing exercise; Section 7 is a closed and exhaustive list.

Section 5 is not a free standing transparency duty attached to all processing. Its own language ties it to Section 6: every request made to a Data Principal under Section 6 for consent must be accompanied or preceded by a notice. Where personal data is processed under a Section 7 ground, without any request for consent, Section 5 is not textually engaged. This distinction sits at the centre of how notice and consent apply across the workforce.

Section 7(I), The Employment Ground: Employees Only

Section 7(i) lets an employer process personal data without consent for the purposes of employment, and for purposes connected with safeguarding the employer from loss or liability, illustrated in the Act as preventing corporate espionage, protecting trade secrets, intellectual property or classified information, and delivering any service or benefit the employee has herself sought.

The ground is anchored to the words “who is an employee.” An employment relationship must already exist before it can be invoked. The Act uses no comparable language for a prospective employee, a candidate or an intern, and current commentary reads Section 7(i) the same way. Payroll, statutory registers, access cards, attendance and appraisal records, and monitoring genuinely tied to one of the four defensive purposes, sit comfortably within 7(i). Open ended surveillance dressed up as “employment purposes” does not; every use should trace back to employment itself or to one of the four listed defensive purposes.

Because 7(i) needs no consent, it does not, on the text of Section 5, trigger a notice obligation. Employers should still issue a clear HR privacy notice as a matter of transparency and general fair processing practice, but this is good governance rather than a literal Section 5 requirement for processing that rests purely on 7(i).

Section 7(A), Voluntary Provision: The Ground For Interns And Candidates

Section 7(a) permits processing, without consent, of personal data that a Data Principal has voluntarily provided for a specified purpose, provided she has not indicated that she does not consent to that use.

Section 7(a) is not “consent” in the Section 6 sense. It rests on voluntary handover and the absence of a stated objection, closer to an opt out than a considered opt in, and it is tightly purpose bound. The Act's own illustration, a real estate broker who must stop processing once the individual says she no longer needs help, shows that the ground lapses the moment the stated purpose is served or the individual objects.

Since interns and candidates are, by definition, not yet employees, 7(i) is not open to them, and 7(a) is the ground that actually fits. A candidate who submits a CV for a named vacancy has volunteered data for a specified purpose, evaluating that application, and 7(a) covers processing tied to it. It does not, on its own, stretch to keeping the CV in a talent pool for unrelated future roles, running third party background checks, or sharing the profile with group companies; each goes beyond the specified purpose and calls for a freshly disclosed 7(a) purpose or, more safely, Section 6 consent.

The same reasoning applies to interns. Data volunteered for the internship application, such as a resume, college details or identity proof, sits under 7(a) for that narrow purpose. Wider use, such as stipend, banking or PAN data, performance evaluation, certificate issuance, or sharing marks and attendance with the college, goes beyond the original purpose, and since 7(i) is unavailable to a non employee, is better anchored in Section 6 consent.

DPDPA Compared With The GDPR

The GDPR does not treat consent as the natural basis for the employment relationship at all. Recital 43 and the European Data Protection Board's guidance on consent caution that consent from an employee is rarely “freely given,” given the inherent imbalance of power, so EU employers generally rely on Article 6(1)(b), necessity for the contract, or Article 6(1)(f), legitimate interests, with Article 88 letting member states write more specific employment data rules of their own.

Recruitment, too, has its own express footing under the GDPR: Article 6(1)(b) covers steps taken at a data subject's request before a contract is entered into, so ordinary candidate processing needs no consent at all.

The DPDPA is built on a different design. It has no open legitimate interest test and no equivalent of Article 88, and Section 7(a) is considerably narrower than Article 6(1)(b): it is opt out rather than a settled legal basis, and it lapses once the specified purpose is spent. In practical terms, an Indian employer reaches the point of needing genuine Section 6 consent, and the Section 5 notice that comes with it, sooner and more often than an EU counterpart would, particularly once candidate or intern data is used beyond the original application.

Practical Takeaways

  • Maintain three distinct notices: candidate and application, internship, and employee.
  • Do not stretch Section 7(i) to candidates or interns; on its text, it is employee only.
  • Record the specified purpose disclosed under Section 7(a) at the point of collection; that purpose is the ceiling on later use.
  • Where use of the data outgrows the 7(a) or 7(i) purpose, obtain Section 6 consent and issue the accompanying Section 5 notice before the wider processing begins, not after