HR PRIVACY COMPLIANCE · DPDP ACT, 2023
Lawful basis, the reliance on Sections 7(a) and 7(i), and role-based controls for potential candidates, employees, interns and trainees.
Prepared by Shubhank Suman· AI, Privacy and IP Counsel
01 Lawful Basis: What HR Relies On — Sections 4 & 7, DPDP Act
§7(i)Purposes of employment
§7(a)Voluntary provision
§4Two lawful routes only
Personal data may be processed only for a lawful purpose, and only on valid consent or a certain legitimate use under Section 7.
Covers processing for the purposes of employment and specified employer-protection purposes. It reads "employment", not "employees only".
No separate consent where a person voluntarily gives data for an exact specified purpose and has not indicated an objection.
Reliance rule: every HR activity must sit under one route or the other, and be recorded.
Reliance rule: use only after the employment relationship begins. Never for a potential candidate.
Reliance rule: do not reuse or retain beyond that exact purpose; test this basis first.
02 Role-Based Consent Map — Who · At What Stage · On What Basis
Person & Stage | Usually not consent-led | Consent required / safest basis | Control |
|---|---|---|---|
Potential candidate Not formally engaged | Not formally engaged, so routine recruitment contact is not consent-led by default. | §7(a) only: data directly and voluntarily submitted by the candidate for the clearly specified live-role purpose, while that exact purpose continues and no objection is indicated. A specific legal requirement may apply where clearly documented. Consent required: KIV and future roles, background verification, extended ATKY use, indirectly sourced candidate data, unrelated reuse, retention beyond schedule, and continued non-joiner records. | A candidate is not an employee. §7(i) must not be used |
Employee Active relationship | Core employment administration; employer safeguarding under §7(i); payroll, tax, audit and statutory records where required by law. | Data voluntarily provided for an exact requested purpose may fall under §7(a). Consent required: optional medical or wellness data, nominee or family data for optional insurance, publicity, unrelated reuse, or unsupported post-employment retention. | Consent for optional or non-core processing only. Keep it separate & unbundled |
Intern / Trainee Fixed engagement | Processing necessary to administer the engagement under the documented basis. A precise §7(a) use may apply to voluntarily provided data. | Consent required: optional medical, insurance, family or nominee, or publicity uses; and reuse or retention beyond the engagement without another basis. | Do not automatically treat an intern as an employee. Separate assessment, notice & form |
Family members & nominees are separate Data Principals Their information does not ride on the employee's record. Minimise the fields collected, explain the purpose and retention, restrict access, and document notice and any required consent. An employee's consent is not automatically the family member's consent.
03 Valid Consent & The Basis-First Discipline — Sections 5 & 6
Valid ConsentSections 5 & 6
Conservative HR Position
Clear standalone notice: data collected, specified purpose, rights and the withdrawal route.
Obtain consent for optional, separate, repurposed or extended processing.
Free, specific, informed, unconditional and unambiguous affirmative action.
Exception only where Legal records another Section 7 use or a statutory basis.
Purpose-specific choices; collect only the data that is necessary.
Never bundle optional processing with recruitment, joining or engagement.
Withdrawal as easy as consent; stop processing unless another basis applies.
Where a specific law applies, record the provision, necessity and retention.
When in doubt, treat processing as consent-led until Legal confirms a Section 7 basis.
Burden of proof rests on the organisation: it must be able to prove notice delivery and consent.
04 The Fast Decision Test Run In Order · Stop At The First That Fits
Basis-first control: identify the person, define the exact purpose, then record the basis. Before any collection, run the five tests below in order and stop at the first that applies.
1 Is there a specific law? If yes, record the provision, the necessary data and the retention period. Do not call mandatory processing "optional consent".
2 Section 7(a) voluntary provision? No separate consent is needed only where the individual voluntarily provided the data for this exact specified purpose and has not objected. Do not reuse it for another purpose.
3 Employee under Section 7(i)? Use §7(i) only after the employment relationship begins, and only for core employment purposes. Never for a potential candidate.
4 Optional, separate or extended? Obtain granular consent before KIV or future roles, optional checks, non-core health or insurance, publicity, unrelated reuse, or retention beyond schedule.
5 Can the person genuinely refuse? If not, consent may not be free or unconditional. Redesign or identify another lawful basis. Never condition recruitment or engagement on unnecessary consent.
05 Right Basis At A Glance — Common HR Activities Mapped To Their Lawful Basis
HR activity | Basis to record |
|---|---|
Collecting a CV or application for a live, specified vacancy | §7(a) voluntary, exact purpose |
Running payroll, tax, provident fund and statutory filings for a hire | §7(i) / Law employment & statutory duty |
Keeping a rejected application for future roles (KIV) | Consent separate, time-bound |
Background or reference verification of a candidate | Consent optional, granular |
Optional group insurance covering an employee's family or nominee | Consent separate data principals |
Statutory audit, retention and record-keeping obligations | Specific law record provision & period |
07Situation Checklists & Controls
BEFORE COLLECTION, REUSE, RETENTION OR DELETION
Potential CandidateEmployeeIntern / Trainee
RECRUITMENT STAGE
ACTIVE RELATIONSHIP
FIXED ENGAGEMENT
State the vacancy and the immediate recruitment purpose.
Map §7(a), core employment, §7(i) and statutory processing separately from consent.
Use a dedicated notice and consent form.
Provide or link the Candidate Privacy Notice at first collection or direct contact.
Document any exact-purpose voluntary provision under §7(a).
Deliver the Employee Privacy Notice at or before onboarding and to existing staff.
Document what is necessary to administer the internship or traineeship.
Use §7(a) only for data directly and voluntarily provided for the exact live-role purpose; never §7(i).
Use separate optional consent for non-mandatory medical, wellness and insurance or family purposes.
Separate optional medical, insurance, family or nominee, publicity and non-core processing.
Take separate consent for KIV, future roles, background verification and extended ATKY use.
Do not treat employee consent automatically as family-member consent.
Do not automatically copy employee retention periods.
KIV consent: 2 years; renew before expiry or delete.
No bundled "all HR purposes" consent; refusal must not cause retaliation.
Delete duplicate recruitment email, ATKY, register and KIV copies.
Unsuccessful-candidate baseline: 12 months, subject to approval.
Record withdrawal and stop processing unless another basis is recorded.
At completion, apply exit deletion and lawful-retention rules.
On joining, remove from KIV and transfer only necessary records.
At exit, use a law, schedule or claim basis; consent only for genuine optional use.
Consent Register · Minimum Evidence
Stop SignsOperational Ownership
Pre-ticked boxes, silence or inactivity treated as consent.
HR LEGAL IT VENDORS
›››
Person & role | Purpose | Data categories | |
|---|---|---|---|
Lawful basis (incl. §7(a)) | Notice / version | ||
Affirmative action | Date, time & channel | ||
Validity / expiry | Objection or withdrawal | ||
Action / deletion | Lawful-retention exception |
HR owns collection and records. Legal validates the basis and wording. IT enforces access, retention and deletion. Vendors process only under approved instructions and contracts.
One consent covering unrelated purposes.
Using §7(a) for a new or expanded purpose.
Indefinite KIV or recruitment retention.
Sensitive data collected "just in case".
Continuing after objection or withdrawal without a recorded basis.
Review consent-based repositories periodically, and at least annually for KIV.
Key Terms
Retention Snapshot
Data Principal The individual to whom the personal data relates, including a candidate, employee, intern, nominee or family member.
KIV / future-role records2 years on consent; renew before expiry or delete.
Data Fiduciary The organisation that determines the purpose and means of processing, and carries the compliance burden.
Unsuccessful candidate baseline
12 months, subject to approval; then delete.
Employee statutory records
Per applicable law; record the provision and period.
Legitimate use A certain use under Section 7 that does not require separate consent, including §7(a) and §7(i).
Intern / trainee recordsDuration of engagement, plus any lawful retention only.
KIV "Keep In View": retaining a candidate record for possible future roles. Consent-led and time-bound.
Optional consent-based data
Until withdrawal or purpose ends, whichever is first.