India's DPDP Act and Candidate Data: What Agencies Must Change

A candidate database is personal data at scale. Under India's data protection framework, that brings obligations around what you collected it for, how long you keep it, and what happens when somebody asks you to delete it. Most Indian staffing firms hold records going back a decade, gathered through channels nobody documented, and have never had to answer any of those questions.

Last reviewed August 2026. Summary of published framework. Take legal advice before acting.

Why a candidate database is the exposure

India's India's DPDP Act framework treats personal data as something held for a stated purpose, with a lawful basis, for a defensible period.

A staffing database fails all three tests by default. It was collected across years through portals, referrals, uploads and imports. The purpose was whatever role was open at the time. The retention period is forever, because nobody ever deleted anything.

That is not negligence, it is how the industry worked. It is also now a documented position you may be asked to produce.

Purpose limitation, and why it bites agencies hardest

The principle is that data collected for one purpose should not be used indefinitely for unrelated ones.

For an internal talent team that is manageable: they collected applications for their own roles. For a staffing firm, the entire business model is reusing a candidate record across many clients and many years, which is precisely the pattern the principle constrains.

The workable position is that the purpose was recruitment services generally rather than one specific role, stated clearly at collection. That requires the statement to exist at collection, which for most historical records it does not. New records are fixable. The back catalogue is the harder question.

Retention, and the case for deleting junk

Indefinite retention of everything is the weakest position available and it is what most firms currently have.

The useful reframe is that a large part of what you hold has no value anyway. An audit of one firm's 3 million records found roughly 10 percent duplicates and 10 percent with no usable company or role information at all. A record with no reachable contact, no placement history and no recent activity is noise in every search and a liability with no offsetting asset.

Deleting it improves search quality and reduces exposure at the same time, which makes it the rare compliance action with an immediate operational payoff. The mechanics are in duplicate candidate records.

Deletion requests and why duplicates make them dangerous

A candidate asking you to delete their data creates a specific operational problem: you have to find every record of them.

If one person exists three times under different spellings and two email addresses, a firm that deletes one record has not complied and has told the regulator it did. That converts a data hygiene problem into a compliance failure.

This is the practical argument for matching at the point of entry rather than periodic cleanup. It is also why the identity problem in blue collar databases carries more risk than the white collar equivalent, since phone-based identity produces more duplicates.

Where the data lives, and who else has it

Two questions most firms cannot answer quickly.

Where is it hosted? Enterprise and GCC clients ask this before they ask about delivery capability. Data hosted in the client's own country is a straightforward answer; anything else needs explaining.

Which third parties have it? Every integration is a place candidate data leaves your system. Job portals, messaging platforms, assessment tools, background verification providers. You remain responsible for it, which is covered in what integrations actually move.

A practical sequence

Fix collection first. New records get a clear purpose statement and a documented basis. This stops the problem growing while you deal with the rest.

Delete the junk. No contact, no history, no activity. This reduces exposure and improves search in one action.

Deduplicate. So that a deletion request can actually be honoured.

Document retention. A stated period with a rationale beats no position, even if the period is long.

Map your integrations. Know which third parties hold candidate data and on what basis.

Frequently asked questions

The question to answer before a client asks it

If a client's legal team asked today where your candidate data sits, how long you keep it, and which third parties have copies, could somebody answer in the meeting?

On most desks the answer is no, and the gap is documentation rather than practice. That is a week of work and it removes a recurring obstacle in enterprise procurement.