DPDP Act 2027 India Compliance Deadline: Employee Background Verification Requirements

If you are doing any background verification of the new hires, which is something most organizations in India have to do nowadays, there is one particular date that has to be at the core of your compliance strategy 13 May 2027, which is typically considered as the compliance deadline of the Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025. From the above-mentioned date onwards, the DPDP Act 2027 India compliance deadline for employee background verification requirements will determine everything that needs to be collected, its legal justifications, the vendors dealing with the data and how long it can be retained.

Reality check of the "2027 deadline"

There is no law called the “DPDP Act 2027”. It was made in August 2023 and the DPDP Rules, 2025 came into effect via a notification on 13 November 2025 (G.S.R. 846(E)). Together with the commencement notification (G.S.R. 843(E)), there is a provision for implementation of the Act in three phases:

• 13 November 2025 (immediately): Definitions and machinery of the Data Protection Board.

• 13 November 2026 (1 year): Registration scheme for Consent Managers.

• 18 months from notification, which works out to be 13 May 2027 (normally): All obligations for employers (lawful basis [Sections 4, 7], notice [Section 5], Data Fiduciary obligations [Section 8], children's data [Section 9], rights [Chapter III], exceptions [Section 17], cross-border transfer [Section 16] and penalties [Section 33]).

Precision alert: The 18 month-period (starting from the date of notification) is sometimes misunderstood for a date. Even the Ministry of Electronics & IT (MeitY) has used 13 May 2027 in their communications. Take 13 May 2027 as the relevant date.

Affected Parties

Any person who processes personal data about its employees and prospective candidates in India is a Data Fiduciary. Those organizations that provide your background check services, Human Resource Management System (HRMS), Applicant Tracking Systems (ATS) as well as Payroll Vendors are likely to be Data Processors but they might turn out to be Data Fiduciaries if they themselves have defined the purpose and means of processing the data. There are only two justifications for lawful data processing i.e. consent and specific purposes.

The legal grounds for conducting background checks – this is what you should know about the grey area.

"Processing shall be considered lawful if it is necessary for the purposes of employment or other related matters of preventing loss or liability to the employer, including protection against corporate espionage, confidentiality of trade secrets, intellectual property, classified information or providing any service or benefit sought by a Data Principal who is an employee."

What can we deduce from this phrase immediately?

1. Regarding current employees, the processing can be done according to s. 7(i) without consent of these employees. However, in this clause there are nine specific purposes of processing and no residual purpose related to business interests. Thus, s.7 doesn't mean that any processing is possible within HR needs.

2. As regards future employees prior to employment, the grounds are not included here at all. It says "a Data Principal who is an employee". There are no "recruitment" or "seeking employment" in this clause although the checklists claim the contrary. The specialized literature makes us aware that not every form of pre-employment processing is applicable for s. 7(i) especially when it comes to criminal, financial or medical checks.

Our interpretation (not the law): take the conservative approach and apply the consent mechanism to the BGV check separately from the rest, meaning the consent mechanism for informing about the type of personal information collected, the provider of the service, the purpose and period of storage of personal data, the absence of pre-ticked boxes, and the right to withdraw. Avoid referring to anything regarding the BGV consent mechanism in the offer letter. The latter will function as a conditional offer after the completion of the consent mechanism.

Little hint: the issue of the necessity to give notice when processing data under s.7(i) is debatable because of the connection of the s.5 notice and request for consent.

Data Minimization

Section 8(1) and 6(1) limit the data processing to what is necessary for the said purpose. According to BGV: Map checks to role risk (Credit check when role is financially sensitive; this is market practice; not statutory), do not use any family/marital information and redact any Aadhar/PAN numbers received.

Source of criminal records/other checks

With respect to the practice in this industry in India, a criminal records check usually involves reference to public court records (eCourts, district court records), search of FIRs/eFIRs and Police Clearance Certificates of the individual and international checks. There is no statutory bar on accessing public court records. There is no statute authorizing private employers access to police records. Consider this market practice.

Workers and interns under 18: children’s regime

The employment context does not make the children’s regime inapplicable. Section 9 is relevant to any Data Fiduciary processing “a child’s” data (under 18, with no mature-minor carve-out), and the s.17 exemptions as well as the Rule 12/Fourth Schedule exemptions are silent regarding employment or BGV, such that verifiable parental consent would be required in the case of candidate or intern age under 18. This is consistent with the statute’s silence, and requires confirmation from the legal team.

Vendor management: BGV agency is a Data Processor

Written agreement with the processor is mandatory (s.8(2)) and should include security-safeguards (Rule 6(1)(f)), and liability stays with you regardless of the contract (s.8(1)). Consider the responsibilities of each vendor, in particular some BGV networks are independent fiduciaries for parts of their processing.

Vendor agreement clause checklist (BGV agencies as processors)

• Purpose limitation processing only as per employer’s written instructions.

• Security measures equivalent to Rule 6(1) minimums (encryption/masking/tokenisation, access control, logging and monitoring, backups).

• Faster breach notification to you than your 72-hour Board reporting obligation; market guidelines recommend 24 hours.

• Sub-processor consent and equivalent obligations cascading down the chain.

• Determined retention period followed by deletion on request or termination, including certified deletion of backups.

• Rights to audit, cooperate in fulfilling data-principal rights, and compliance with regulators.

• Contingency provisions for new items being added to the cross-border restricted list.

Security safeguards and access control

Rule 6(1) prescribes seven minimums encryption, obfuscation, masking/virtual tokenization; access control both to your and processors’ systems; logging and logging review and monitoring; backups; retention of the logs and personal data for at least a year security provisions in all processor contracts; and organizational and technological measures. Copying PAN and Aadhaar via emails is completely inconsistent with these, hence switch to secure document intake.

Cross-border transfers

As per s.16 and Rule 15, any transfer is allowed unless there is a restriction by way of negative list by the Central Government. Till October 2026, no country has been restricted yet. Verification of BGV in foreign locations can be done subject to all other duties under the Act with overseas processor agreement falling under Rule 6 security safeguards. Localization requirements which are stricter as compared to the general standard such as RBI norms shall apply wherever applicable.

Retention & Deletion

Statutory provision is s.8(7): delete personal data after achieving its purpose or revoking the consent, except there is any other statutory provision regarding retention. The famous 48 hours notice and delete regime is meant for large platform service providers under Third Schedule, and not for ordinary employers. There is no statutory BGV retention period. Market practice varies from 3-6 months if the candidate does not clear the process up to employment plus 3 years, though this is market practice and not a statutory provision. Ensure you set proper retention regime with reasons and processor delete from backups as well.

Rights of applicants and breach management

The rights of candidates and employees include access, correction, deletion, nomination and grievance redressal rights. The grievance procedures should be publicly disclosed, and the period for responding not to exceed 90 days (Rule 14). Develop the procedure for correction of disputes on BGV assessment results; this will be important. In case of data breach, Rule 7 provides that the affected individual(s) and Data Protection Board should be informed without undue delay, followed by an elaborate report within 72 hours. There is no threshold of severity. Develop the runbook based on this two-step process.

Is DPIA required?

No. DPIAs and annual audit are required of Significant Data Fiduciaries only (s.10, Rule 13), and no SDFs have been notified till October 2026. Risk assessment on a voluntary basis is recommended as a best practice.

Errors to avoid

• Automatically assuming that pre-employment BGV is automatically permissible under section 7(i), which is a grey area that has not been settled yet.

• Making BGV consent a part of the offer letter or doing advance checkmarks.

• Talking about the “fuzzy” “May 2027” timeframe in lieu of the tranche process.

• Avoid making general claims on the compulsory DPIA for all employers, or the processor status of all HR vendors.

• Collecting data "just in case" rather than properly scoping the background check. 

Takeaway

Until 13 May 2027 (calculating), the next steps are definite get your legal basis sorted by activity redo your candidate consent; revise vendor contracts according to Rule 6 and Rule 7 and make arrangements for breach reporting, rights exercise, and retention. Get your BGV flowchart sorted out this year, before you need it in 2027.