The DPDP Act is Here to Redefine Digital Security in India!

Published – 9th September 2024 – 2 minute read.

Empowering Privacy, Protecting Your Data

As a candidate or HR Leader, have you ever wondered what happens to the personal data you provide for background verification? This newsletter highlights how India’s Personal Data Protection Act safeguards employee privacy.

The Digital Personal Data Protection Act (DPDP Act) of 2023 marks a major shift in data privacy. It aims to reshape how companies handle candidate information during background checks.

In the past, employment screening often operated in a legal grey area. Employers, driven to make informed hiring decisions, would sometimes uncover irrelevant or outdated information without explicit consent. This lack of transparency left candidates feeling like passive participants in their career evaluations. The DPDP Act’s focus on stringent data security is a significant step towards empowering Indian citizens to manage their digital footprint, especially in recruitment.

The DPDP Act: Its Impact on Background Checks in India

The DPDP Act redefines how Indian companies handle personal data, especially during background checks. It classifies personal data as any information that can identify an individual and applies to data collected both digitally and physically within India, as well as digital data stored globally. The only exception is information you make public yourself.

This broad definition means employers manage a significant amount of your data throughout your employment journey—from application details and interview notes to background checks and post-employment records. Under the DPDP Act, all of this is considered personal data.

The legislation creates a clear legal framework that defines roles and responsibilities for protecting data privacy. Employers are now classified as “data fiduciaries,” responsible for safeguarding personal data, while candidates become “data principals,” with more control over their personal information.

Employers must now adhere to the principle of purpose limitation, ensuring that any data collected is relevant and necessary for the specific job role, avoiding unnecessary intrusion into personal lives.

4 Key Principles: DPDP Act’s Impact on Background Checks

1. Informed Consent
Employers must obtain clear and explicit consent before starting any background checks. Candidates are no longer passive participants. The DPDP Act empowers them with the right to choose which aspects of their digital identity are shared and for what reason. This creates trust and fosters a culture of accountability. HR teams need to create transparent and easy-to-understand consent forms that outline:

• • The data being verified
  • The purpose of the verification
  • How the data will be stored and protected

2. Data Collection Limitation
The DPDP Act enforces the principle of data minimization, meaning employers can only collect information necessary for the background check. For example, if you’re applying for a marketing role, your marital status or religious affiliation wouldn’t be relevant and shouldn’t be asked for. Employers must align their data collection with job requirements, protecting candidates’ privacy and ensuring efficiency in the process.

3. Data Accuracy
Employers, as data fiduciaries, are responsible for ensuring the accuracy of the information they collect. Robust verification processes, such as contacting past employers or educational institutions, are critical. Inaccurate information can harm a candidate’s reputation and lead to unfair hiring decisions. Candidates have the right to challenge and correct any incorrect data.

4. Data Security
The DPDP Act requires employers to implement reasonable security measures to protect personal data during employment screening. These measures, which vary based on the sensitivity of the data, may include access controls, data encryption, and regular security audits, all aimed at preventing unauthorized access and data breaches.

Know Your Rights as a Candidate Under the DPDP Act

The DPDP Act strengthens your rights as a candidate, giving you more control over your personal data during background checks.

• Right to Access
  You can request a full report of the information collected during the screening, including the sources of that data. This transparency allows you to spot any potential biases or outdated information. Employers are required to respond within a set timeframe.
• Right to Rectification
  If any part of your background check contains errors, you can request a correction. For example, if a previous employer mistakenly reported an incorrect termination date, you can demand that it be corrected, with proof of the change provided.
• Right to Erasure
  While employers can retain background check data for a reasonable time, you have the right to request deletion under certain circumstances. For example, if your application is rejected, you can ask for the deletion of your background information after a certain period.

Conclusion

The Digital Personal Data Protection Act represents a turning point for data privacy in India, particularly for job seekers. It compels employers to collect only the data that is necessary and relevant to the job, promoting a more ethical and transparent approach to employment screening. With stronger candidate rights and clear principles of consent, minimization, accuracy, and security, the DPDP Act fosters a culture of accountability and trust in the Indian job market, protecting individual privacy like never before.

InteleScreen

In today’s rapidly evolving regulatory landscape, staying compliant with data privacy laws is crucial for protecting your business and maintaining trust with your employees. If you want to ensure you’re on the right side of the law, partner with us. Our expertise in compliance and data security will help you navigate the complexities of regulations like the DPDP Act, giving you peace of mind and a competitive edge. Let us handle your data privacy needs so you can focus on growing your business responsibly and securely.

Disclaimer: The information provided in this article is intended for general informational purposes only and does not constitute legal advice. For the most accurate and up-to-date information regarding the Digital Personal Data Protection Act and its implications, please contact the relevant authorities in India. Always consult with legal professionals or regulatory bodies to ensure compliance with current laws and regulations.