Notice, consent and purpose limits under India's DPDP Act

The Act builds on consent that is free, specific, informed, unconditional and unambiguous, given by clear affirmative action, and limited to the personal data necessary for the stated purpose. Recruitment strains that at every point, because a single candidate record supports several distinct purposes: matching to a live role, submitting to a named client, keeping on file for future roles, and running background verification.

Bundling those into one tick box is the failure mode. Consent to be submitted to one client is not consent to sit in a database for three years, and consent to be considered for a role is not consent to a verification check. The product supports purpose tagging on the consent record so the purposes are held separately rather than merged.

Where consent is withdrawn for one purpose it stays valid for the others, and the record shows which is which. That is more work at capture and considerably less work at the moment somebody asks what exactly they agreed to.

Notice under the Act is itemised: what personal data, for what specified purpose, how to exercise rights, and how to complain to the Board. It must be available in English and in the languages listed in the Eighth Schedule to the Constitution, which for an Indian staffing firm working blue-collar or regional desks is not a formality. A notice nobody can read has not been given.

The product supports attaching notice text to application forms and outreach templates, holding multiple language variants, and recording which version and which language was shown against the consent event. That last field is what turns a claim into a record. Being able to say the person saw this exact wording, on this date, in this language, is the difference between evidence and assertion.

The wording is yours. It names your firm as fiduciary, describes your actual purposes, and gives your grievance route. Copying another firm's notice describes their practice, and if it does not match yours it is worse than a short notice that does.

The Act contemplates consent managers: registered intermediaries through which a person can give, manage, review and withdraw consent, with an interoperable and accessible interface. The ecosystem is still developing, and the honest position is that no product should describe integration with a framework whose operational detail is not finished.

What the product does today is hold consent in a way that fits the concept rather than fighting it: consent as dated events with purpose, wording, language, channel and capturer recorded; withdrawal as its own event; and a candidate-facing view where a person can see what they agreed to and withdraw without emailing a recruiter. Those are the mechanics a consent manager relationship would need on the fiduciary side.

Where registered consent managers become operationally available and integration is expected, that is roadmap work rather than something shipping today, and it is written that way here on purpose. Claiming readiness for a framework that has not settled is exactly the kind of statement that ages into a misrepresentation.

The Act is direct about this: personal data is kept for the specified purpose and erased when the purpose is served and retention is no longer required by law. For a recruitment database that is a sharper instruction than most firms operate under. A candidate submitted to one role two years ago, never placed and never contacted since, is holding data whose purpose expired a long time ago.

Retention windows in the product run from the last meaningful contact rather than from record creation, and expiry raises a review queue rather than deleting on a timer. The queue carries the basis, the last contact and three options: extend with a recorded justification, contact the candidate to refresh consent, or erase. The decision is written with an actor and a date.

Erasure removes the profile, custom fields, notes, messages, the original uploaded document, the extracted text and the search representation together, and keeps a fulfilment record which is the fact of the request rather than the data it concerned. Retention required by law, typically financial records from a completed placement, is separated and kept under a stated reason rather than quietly retained.

Client audits and any future regulatory contact tend to ask the same set of questions, and none of them are about software. Which purposes do you collect for. What notice did this person see, in which language, on what date. What did they consent to and what have they withdrawn. How long do you keep each category and why. How is a grievance received and answered, and within what time.

The product supplies the evidence for most of those: dated consent events with wording and language, purpose tags, retention windows and their decisions, export and erasure with an audit trail, and a searchable identity view so a request about one person resolves across duplicate records. What it cannot supply is the grievance process, the retention policy or the appointment of the people who answer.

There is also a scale consideration worth naming. Firms designated as significant data fiduciaries carry extra obligations, including a data protection officer based in India, independent audits and impact assessments. Whether that designation reaches your firm is not a question a vendor page can answer, and it should be asked before it is answered for you.

Primary processing is in the United States on AWS us-east-1, with encrypted backups. For an Indian firm that is a cross-border transfer, and the Act permits transfer other than to territories restricted by government notification. The restriction list is a moving object rather than a settled one, which is a fact about the regime rather than an evasion.

The practical position is that your assessment has to be current rather than made once at signature. The subprocessor register states where each category processes, which is the field to read when a residency question arises, and the notice and objection route in the addendum is the mechanism for acting on what you find.

Firms with a contractual requirement for Indian residency should raise it during procurement rather than after. It is a real constraint that the primary region does not meet today, and saying so directly is more useful to a buyer than a paragraph implying flexibility that does not exist.