Need to verify a candidate before you hire?
Get fast, clear employee background verification reports with digital checks in as little as 12 hours — backed by deeper investigation support when required.
Background verification in India has always been part of hiring. The DPDP Act 2023 has changed how it must be done. Before November 2025, most HR teams ran BGV as a routine step with no data protection framework governing it. That changed when the DPDP Rules were notified. Getting consent is no longer good practice. It is a legal requirement. Working with a BGV vendor without a signed agreement is no longer a risk. It is a compliance gap. This blog breaks down what every employer needs to do before running a background check in 2026.
The Digital Personal Data Protection Act 2023 is India’s first data protection law. It makes every employer who runs a background verification in India legally responsible for how candidate data is collected, used and deleted. The DPDP Rules 2025 came into effect in November 2025 and full enforcement begins May 2027. Every organisation that collects personal data in India is a Data Fiduciary under the Act. Every employer running a background check qualifies. Before the DPDP Act, background verification in India sat in a regulatory grey zone. DPDP Act 2023 BGV compliance closes that permanently.
A standard background verification in India collects a significant amount of personal data. Under the DPDP Act, every piece of it is regulated and must be handled with clear legal obligations.
Type of Check | Data Collected |
Identity Verification | Aadhaar number, PAN card, passport details |
Employment Verification | Previous employer details, job titles, tenure |
Education Verification | Degree certificates, institution name, year of passing |
Criminal Record Check | Court records, police verification data |
Address Verification | Current and permanent address, utility bills |
Reference Check | Contact details of references, feedback on conduct |
None of this data can be collected without explicit candidate data consent for background check and a clearly stated purpose. Collecting more than what the check requires is a violation called overcollection. Data on candidates who are not hired must be deleted within 180 days under the DPDP Rules 2025. No exceptions.
Explicit consent is mandatory before running any background verification in India. The DPDP Act 2023 makes this a legal requirement, not just a best practice. The consent notice must clearly cover all the information about the background verification.
The check stops immediately, collected data is deleted within the retention period, and processing must stop. Running a digital background check in India without valid consent carries penalties from INR 10,000 to INR 250 crore, enforced by the now-operational Data Protection Board of India.
Background checks are legal in India with candidate consent and a legitimate employment purpose. The DPDP Act doesn’t ban specific checks; it sets the conditions for conducting them.
The key principle is data minimisation. Section 6 of the DPDP Act means you may only collect data necessary for the stated purpose; running a criminal check on every employee regardless of role is a common violation, since the check must match the role’s risk level. Employers should maintain a role-risk matrix (mapping job categories to permitted checks) as compliance evidence under Rule 7 of the DPDP Rules 2025, protecting them during audits and inspections.
Picking the right BGV vendor matters because under the DPDP Act, employers remain legally liable even if the vendor mishandles candidate data. Every compliant employee background platform in India should have: a signed Data Processing Agreement, built-in consent management, ISO 27001 certification, data storage within India (or an approved jurisdiction), clear deletion timelines (rejected candidate data deleted within 180 days), timestamped audit trails, and fast turnaround (12 to 48 hours, since anything longer suggests manual processing). A reliable integrity due diligence vendor doesn’t just run checks; it keeps your hiring process legally protected end to end.
Most employers still treat data protection as an afterthought, but the DPDP Act makes that costly. The Data Protection Board of India is operational and already investigating organisations that mishandle candidate data. Running a check without valid consent, failing to delete rejected candidate data, or working with a vendor without a signed Data Processing Agreement are each separate violations with their own penalties.
Violation | Maximum Penalty |
Failure to implement security safeguards | INR 250 crore |
Failure to notify affected individuals of a data breach | INR 200 crore |
Non-compliance with children’s data provisions | INR 200 crore |
Failure to fulfil Significant Data Fiduciary obligations | INR 150 crore |
Breach of Data Principal duties | INR 10,000 |
Beyond fines, a breach becomes public record once reported, candidates can file complaints directly with the Board, and without a signed DPA, the employer absorbs full legal exposure for vendor errors. Full enforcement begins May 2027, so every month without action adds unmanaged legal exposure.
The rules around background verification in India have changed: consent, data minimisation, and a signed vendor agreement are no longer best practices but legal requirements with penalties attached.
Millow’s digital background check platform handles consent, audit trails, data deletion, and source-level verification in one place, delivering compliant background checks in under 12 hours. Get started with Millow today.
Is BGV mandatory in India?
Not for all employers, but banking, insurance, and IT have sector-specific rules that require it. The DPDP Act 2023 governs how it’s run regardless.
Do you need consent before running a BGV?
Yes. The DPDP Act 2023 requires explicit written consent before collecting candidate data; a line in the offer letter doesn’t count.
What do HR teams check in a BGV?
Identity, employment history, education records, criminal records, address, and references.
How long does BGV take to clear in India?
Traditional vendors take 5 to 15 days; But Millow delivers results in under 12 hours.
What data cannot be collected during a BGV?
Health records, social media activity, and financial history for non-finance roles are restricted under the DPDP Act.
How long can a company keep BGV data?
Rejected candidate data must be deleted within 180 days; employee records are kept for the duration of employment.