Quick Answer
The DPDP Act 2023 doesn’t ban background verification in India, but it changes how checks are done. From 13 May 2027, employers, verification firms and detective agencies must give notice, rely on a lawful basis such as consent or employment use, protect the data they collect, and delete it once the purpose is over.
Key Takeaways
- The DPDP Rules were notified on 13 November 2025. Only consent-manager registration starts on 13 November 2026; most duties apply from 13 May 2027.
- Employers can lean on the “employment” legitimate use for existing staff, but candidate checks are safer with clear, specific consent.
- A family making its own inquiries about a match is largely outside the Act. An agency the family hires is not.
- Information a person has made public themselves, such as a matrimonial profile, sits outside the Act.
- The new law doesn’t make phone records, bank statements or Aadhaar data fair game. They never were.
Two calls reached our Dilshad Garden office in the same week (details changed). The first came from an HR head at a mid-sized firm in Sector 62, Noida. Her verification vendor had told her that every candidate now needed a fresh consent form, “or the company gets fined 250 crore.” The second came from a mother in Preet Vihar, who had read that India has a new privacy law and wanted to know whether checking her daughter’s prospective groom was now illegal.
Both had heard half the story. The Digital Personal Data Protection Act, 2023 (the DPDP Act) is real, its Rules are notified, and the penalties are large. But it doesn’t stop anyone from verifying a person. It changes who must do what, when, and with how much paperwork. Here’s what it means for background checks, in plain words.
This is our practical reading as investigators, not legal advice. Where the law is unsettled, we say so.
What is the DPDP Act, in plain words?
The DPDP Act is India’s first general law on personal data. It applies to digital personal data, which includes data collected online and data collected on paper that is digitised later, under Section 3 of the Act. A scanned degree certificate counts.
Four terms do most of the work:
- Data Principal: the person the data is about. In a background check, that is the candidate, tenant or prospective spouse.
- Data Fiduciary: whoever decides why and how the data is processed. Usually the employer, or an agency running its own investigation.
- Data Processor: someone who processes data on a fiduciary’s behalf and on its instructions, like a verification vendor working to an employer’s brief.
- Consent Manager: a registered platform through which people can give, review and withdraw consent.
When does the DPDP Act actually apply? The 2026?27 timeline
The Act only bites once its Rules commence. MeitY notified the DPDP Rules on 13 November 2025 and split them into phases, as summarised in EY’s analysis of the Rules:
| Date | What commences | What it means for background checks |
|---|---|---|
| 13 Nov 2025 | Definitions and Data Protection Board rules | Nothing changes on the ground yet |
| 13 Nov 2026 | Rule 4: registration of Consent Managers | Consent platforms can register. No new duties for ordinary employers or agencies |
| 13 May 2027 | Notice, consent, security, breach reporting, retention, rights | The real deadline. Forms, contracts and deletion policies must be ready |
In January 2026, MeitY floated cutting the 18-month runway to 12 months, but as of an October 2026 review no amending notification had been found, so 13 May 2027 remains the legal date. And the Data Protection Board, which will hear complaints and impose penalties, had invited applications for its Chairperson and Members in May 2026, with no confirmed appointments reported as of early October. If anyone tells you you’ll be fined next month, ask them which Board will fine you.
Does the DPDP Act stop background verification?
No. It asks for a lawful reason to process someone’s data and good behaviour once you have it. Those reasons come in three forms.
1. Consent
Consent under the Act must be free, specific, informed, unconditional and unambiguous, given by a clear affirmative action. A tick-box buried on page nine of an offer letter is a weak foundation. A short, separate form that names each check is a strong one.
2. Legitimate uses (no consent needed)
Section 7 lists situations where consent isn’t required. Two matter here. Section 7(a) covers data a person has voluntarily provided for a specified purpose, as long as they haven’t said they object. Section 7(i) covers processing “for the purposes of employment or those related to safeguarding the employer from loss or liability,” with examples such as preventing corporate espionage and protecting trade secrets.
3. Exemptions
Section 17(1) switches off most obligations where processing is “necessary for enforcing any legal right or claim,” or is in the interest of preventing, detecting or investigating an offence. That covers much litigation work, though security duties still apply.
From the field“People hear ‘privacy law’ and assume verification is finished. It isn’t. What the law punishes is sloppiness: collecting more than you need, keeping it forever, and leaving it in an inbox anyone can open. Good investigators were never doing that anyway.”
Gaurav Aggarwal, Founder & Lead Investigator
What changes for employers in Delhi NCR?
Firms in Noida, Gurugram and Okhla collect Aadhaar copies, salary slips and address proofs for nearly every hire. That is where most of the DPDP noise comes from.
Candidates are not employees yet
Section 7(i) speaks of employment and of a Data Principal “who is an employee.” Lawyers at King Stubb & Kasiva point out that the basis is clear for existing staff but less certain for job candidates, and warn against assuming it covers checks unrelated to the role. Our advice is boring and safe: for candidates, take specific consent anyway.
Your verification vendor is probably your data processor
If a vendor works only on your instructions, it is likely a Data Processor, and you remain answerable for what it does. A note by S&R Associates on investigations makes the same point and recommends contracts that limit purpose and include audit and indemnity terms. A one-line “vendor shall maintain confidentiality” clause won’t carry that weight.
A DPDP-ready verification process in 7 steps
- Write down the purpose. “Verify identity, education and last two employers for a finance role” beats “background check.”
- Match checks to the role. A delivery executive and a treasury manager don’t need the same depth.
- Give a plain-language notice. List what you’ll collect, why, and how the person can raise a concern.
- Take separate, specific consent for candidates, and keep a record of it.
- Sign a proper processor contract with your vendor covering security, sub-contractors, deletion and breach reporting.
- Set a deletion date. Reports on rejected candidates shouldn’t live in a shared drive forever.
- Prepare for a breach. Under the Rules, a detailed report to the Board is due within 72 hours of becoming aware of a breach.
Our background check services are built around written scope and fixed deletion timelines, and our team in Noida handles most of the corporate work across the Sector 62 and Sector 125 belt.
From the field“The best HR teams I work with already ask for less. They don’t want the candidate’s whole life. They want to know the degree is real and the last employer exists. That instinct is exactly what this law rewards.”
Gaurav Aggarwal
Need background checks done the DPDP-ready way?
Verification that respects the law and your privacy, from Delhi NCR’s investigators.
? 100% confidential · ? Legally compliant · ? 20+ years’ experience · ? Delhi NCR & NRI cases
Can families still check a match before marriage?
Yes. This is where the mother in Preet Vihar could breathe again.
Section 3(c)(i) says the Act does not apply to personal data processed by an individual “for any personal or domestic purpose.” Asking relatives about a family, visiting a groom’s stated office or calling a reference is ordinary family diligence. Section 3(c)(ii) also excludes data a person has made public themselves. A matrimonial profile, a public LinkedIn page or an Instagram account set to public is not protected by the Act in that sense.
Things change when the family hires a professional. An agency running pre-matrimonial investigation in Delhi is a business processing data, so once the 2027 obligations commence it has to behave like a responsible fiduciary: collect only what the brief needs, secure it, and delete it when the case closes. The Act doesn’t mention private detectives by name, and there is no ruling yet on exactly which lawful basis applies to a matrimonial inquiry.
Employer confirmation, address and family standing, marital history, court cases and community reputation are what our groom background verification guide covers, and none of them requires anything the law forbids. For a match settled abroad, the NRI groom verification process adds checks in the other country, where its own privacy laws apply too.
From the field“Families sometimes ask whether we’ll ‘pull his records.’ I tell them the truth: the records worth having are court files, office receptions and neighbours who’ve known him for ten years. You don’t need anything illegal to find a lie. You need patience and shoe leather.”
Gaurav Aggarwal
What the DPDP Act does not change
Call detail records, bank statements, Aadhaar records and private chats were off-limits to private investigators before the DPDP Act, and they still are. Unauthorised access to a computer or phone remains an offence under the IT Act, 2000, and your right to privacy has been a fundamental right under Article 21 since the Supreme Court’s 2017 decision in the Puttaswamy case.
It also doesn’t create a licence for detectives. India still has no licensing law for private investigators. On 31 July 2026, the Supreme Court noted that the Private Detective Agencies (Regulation) Bill, 2007 was never enacted and sent its judgment to the Law Ministry and the Law Commission to consider regulation. Our guide on whether it is legal to hire a private detective in India covers that side of the question in full.
Who needs what? A quick comparison
| Who is checking | Likely legal footing | What to have ready by 13 May 2027 |
|---|---|---|
| Employer, existing staff | Employment legitimate use, Section 7(i) | Notice, purpose limits, vendor contract, deletion schedule |
| Employer, job candidates | Specific consent (safest) | Separate consent form and records of it |
| Family, own inquiries | Personal or domestic purpose, outside the Act | Nothing new, but other laws still apply |
| Detective agency on a matrimonial case | Not settled by the Act or courts yet | Minimal collection, security, deletion on closure |
| Lawyer or litigant building a case | Legal right or claim exemption, Section 17(1)(a) | Security safeguards, lawful sources only |
How we handle data at Alliance
We’ve run verification across Delhi NCR for more than 20 years, so we didn’t need a new law to tell us to be careful. Every engagement starts with a written scope. We collect only what the brief needs. Reports go to the client and nobody else. Working notes are deleted when the case closes, unless the client needs the evidence for court, where our litigation support team keeps a proper chain of custody.
As a rough guide, a focused pre-marriage check within Delhi NCR usually takes 7 to 12 working days and typically starts around ?15,000 to ?25,000. Employee checks are priced per candidate according to the checks chosen. Both figures are indicative and depend on the case.
Legal & ethical note
Alliance Detective Agency works only within Indian law, including Article 21 of the Constitution, the IT Act 2000, the DPDP Act 2023, the Bharatiya Nyaya Sanhita 2023 and the Bharatiya Sakshya Adhiniyam 2023. We never tap phones, install spyware on another person’s device, hack accounts, or obtain call records, bank details, Aadhaar data or telecom data. If an agency offers any of these, walk away.
Frequently asked questions
Is the DPDP Act in force now?
Partly. The Act was passed in 2023 and its Rules were notified on 13 November 2025. Definitions and Board rules applied at once, consent-manager registration starts on 13 November 2026, and most obligations, including notice, consent, security and data rights, start on 13 May 2027. MeitY has floated an earlier date, but no amendment had been notified as of October 2026.
Does the DPDP Act apply to background verification?
Yes, wherever a business processes digital personal data, including paper records that are later scanned or typed up. Employers, verification firms and detective agencies will need a lawful basis, a clear notice, reasonable security and a deletion plan. The Act doesn’t ban background checks. It regulates how they are run.
Is candidate consent required for background verification under the DPDP Act?
For existing employees, employers can often rely on the employment legitimate use in Section 7(i). For job candidates the position is less certain, so specific consent is the safer route. Use a short, separate form that names each check, explains why it’s needed and tells the candidate how to raise a concern.
Can families still do a pre-matrimonial check under the DPDP Act?
Yes. A family’s own inquiries for a personal or domestic purpose fall outside the Act, and information a person has made public, such as a matrimonial profile, isn’t covered either. An agency the family hires must still handle data responsibly and use only lawful sources, which is how a reputable agency already works.
What is a consent manager under the DPDP Act?
A consent manager is a platform registered with the Data Protection Board that lets people give, manage, review and withdraw consent across different organisations in one place. Registration of consent managers is the only part of the DPDP Rules that commences on 13 November 2026. Ordinary businesses don’t have to use one.
What is the penalty under the DPDP Act?
The Schedule to the Act sets maximum penalties. Failing to take reasonable security safeguards can attract up to ?250 crore, and failing to report a breach or meet children’s-data duties up to ?200 crore. Penalties will be imposed by the Data Protection Board after an inquiry, not automatically.
Can a detective agency share my report with anyone else?
A reputable agency shouldn’t. Your report belongs to your case and should go only to you, or to your lawyer if you ask. Once the DPDP obligations commence, careless sharing or weak security will also expose the agency to penalties. Ask any agency, in writing, who sees the report and when it is deleted.
Privacy law is arriving. Careful verification was ready for it.
The DPDP Act will make sloppy verification expensive, and that’s a good thing. For the HR head in Noida, it means tighter forms and a better vendor contract. For the mother in Preet Vihar, it means nothing has to stop, as long as whoever she hires keeps the inquiry narrow, lawful and discreet. If you’d like a check done properly from day one, talk to us in confidence.
Verify first, the lawful way. Talk to us in confidence.
Verification that respects the law and your privacy, from Delhi NCR’s investigators.
? 100% confidential · ? Legally compliant · ? 20+ years’ experience · ? Delhi NCR & NRI cases
