By S&S Co. Advocates & Solicitors · Published 18 January 2026 · Informational content, not legal advice. See our disclaimer
Why Background Checks Need a Legal Basis
Employers routinely conduct background checks (verifying prior employment, educational qualifications, criminal antecedents, and references) as part of hiring. Because this process involves collecting and processing an individual's personal data, it is not simply an HR convenience but an activity that now sits within the framework of the Digital Personal Data Protection Act, 2023 (DPDP Act), which governs how personal data of individuals, including prospective and current employees, may be collected, used and stored.
Consent and Notice Obligations
Under the DPDP Act's general framework, processing of personal data ordinarily requires the individual's consent, given after a clear notice explaining what data is being collected and for what purpose: for background checks, this typically means informing the candidate upfront that a background verification will be conducted, what categories of information will be checked, and obtaining their consent before proceeding, rather than treating the check as an unstated or implied part of the hiring process.
Handling Sensitive Categories of Information
Certain categories of background information (criminal record checks in particular) warrant additional care given their sensitivity and potential for discriminatory misuse. Employers should limit the scope of any criminal record inquiry to what is genuinely relevant to the specific role, avoid blanket disqualification policies that do not account for the nature or relevance of a past record, and ensure such information is stored securely and accessed only by those who need it for the hiring decision.
Data Retention and Ongoing Employee Data
The obligations do not end once a candidate is hired: employers continue to hold and process substantial personal data about employees throughout employment, from payroll and health information to performance records, and should apply the same principles of purpose limitation, secure storage, and retention only for as long as necessary, together with appropriate safeguards, consistent with the DPDP Act's broader data-fiduciary obligations.
Frequently Asked Questions
Does an employer need a candidate's consent to run a background check?
Under the general framework of the DPDP Act, processing personal data (including for a background check) is ordinarily grounded in the individual's consent given after clear notice of what will be checked and why, so employers should build this into their hiring process rather than treating it as implied.
Can an employer reject a candidate solely based on an old, unrelated criminal record?
Employers should exercise care here: a blanket policy of automatic disqualification without regard to the nature, age or relevance of the record to the specific role carries both fairness and, increasingly, data-handling risk, and a more individualised assessment is the more defensible practice.
How long can an employer retain background check data?
Data protection principles generally call for retaining personal data only for as long as necessary for the purpose it was collected: employers should have a defined retention policy for background check records rather than an indefinite retention practice.
Do these obligations apply only to new hires, or to existing employees too?
They extend to personal data handling throughout the employment relationship, not just the hiring stage: payroll, health, performance and other employee data collected during employment are also subject to the same broad principles of purpose limitation and secure handling.
References & Further Reading
This article references the following statutory provisions. Readers should always verify current rules, fees and timelines against the applicable statute and rules as amended, since these are revised from time to time.
- Digital Personal Data Protection Act, 2023.
- General industry practice on pre-employment background verification in India.