Every resume in your inbox is now a legal responsibility, not just a hiring asset.
Hospital HR teams hold a lot of personal data long before a nurse or doctor joins the team: registration certificates, ID proofs, addresses, salary history and reference details. The DPDP Act 2023 changes how that data must be collected, used, stored and deleted.
This guide gives you a practical checklist, a sample consent notice and a sample retention policy that you can adapt for your hospital.
What the DPDP Act 2023 Means for Hospital HR
India’s Digital Personal Data Protection Act became enforceable in stages after the DPDP Rules, 2025 were notified on 13 November 2025. Three roles matter for recruitment:
- Data Principal: the candidate whose data you hold.
- Data Fiduciary: the hospital, because it decides why and how candidate data is used.
- Data Processor: anyone who handles data on the hospital’s behalf, such as a staffing partner, a job portal or an applicant-tracking tool.
The law does not create a separate “sensitive data” class. Medical registration numbers, ID copies and fitness records therefore carry no special label. Still, this is the data that does the most harm when it leaks, so it deserves extra care.
Key dates HR should know
- 13 November 2025: Rules notified and the Data Protection Board framework started.
- 13 November 2026: Consent Manager provisions (Rule 4) begin.
- 13 May 2027: Notice, consent, security safeguards, breach reporting and candidate rights begin.
Because the DPDP Act 2023 is being enforced in phases, some hospitals assume they can wait. That is risky. Mapping data, rewriting forms and renegotiating vendor contracts takes months.
MeitY has also proposed shorter timelines for Significant Data Fiduciaries, so check the latest notifications before you finalise your plan.
Why Candidate Data Privacy in India Is Now a Leadership Issue
A single recruitment file can hold a person’s full identity. If it leaks, the hospital faces legal work, candidate notifications, lost trust and possible penalties. IBM’s Cost of a Data Breach Report 2025 found that the average cost of a data breach in India reached ₹22 crore (INR 220 million), about 13% higher than in 2024.
That figure covers organisations of all kinds, not only hospitals, but it shows how quickly the bill grows. The DPDP Act 2023 adds its own financial penalties on top, and the Act’s Schedule places the highest tier on failures to keep reasonable security safeguards.
Hospital HR Privacy Compliance Checklist
Every stage of your hospital recruitment process touches personal data, from the first application to the joining formalities. Use the seven steps below as your working checklist.
1. Map every place candidate data lives
List each location: career-page forms, email inboxes, WhatsApp groups, walk-in drive sheets, vendor portals and spreadsheets. For each one, note what data sits there, who can see it, why you hold it and where it travels next.
You cannot protect or delete what you cannot find, so resume data protection starts with this map. If your team still relies on scattered inboxes, an applicant tracking system makes access control and deletion far easier.
2. Give a clear consent notice
Under Section 5 and Rule 3, the notice must reach the candidate when you ask for consent. It should use plain language and include an itemised list of the data you collect, the specific purpose, how to withdraw consent, how to exercise rights and how to complain to the Data Protection Board.
Candidates should be able to read it in English or any language listed in the Eighth Schedule, which helps when you hire nurses across states.
Good HR data consent in India has these features:
- It is free, specific, informed and unconditional.
- It needs a clear action from the candidate. Pre-ticked boxes do not count.
- It is not bundled. “Apply for this job” and “send me marketing” need separate choices.
- Withdrawing it is as easy as giving it.
One point to take legal advice on: the Act also recognises certain “legitimate uses”, including cases where a person voluntarily shares data for a stated purpose. Some practitioners rely on this for unsolicited CVs. Even so, a short notice is safer and builds candidate trust.
3. Apply purpose limitation and data minimisation
Collect only what the current hiring stage needs:
- Application: name, contact details, qualification, experience and registration number.
- Shortlist: salary history and references.
- Offer: ID and address proofs, plus consent for checks.
Do not ask for a full Aadhaar copy at the application stage. Run employee background verification only after the offer stage and with a separate, specific consent.
Purpose limitation also means you should not reuse a CV collected for one role to promote unrelated services, or pass it to another hospital without permission. If you use AI screening tools, treat them as processors and tell candidates they are in use.
4. Set a retention rule for rejected CVs
Section 8(7) says personal data must be erased once its purpose is served or consent is withdrawn, unless a law requires you to keep it. The DPDP Act 2023 does not give a fixed number of days for rejected CVs, so each hospital must choose a sensible period and document why. A practical approach:
- Delete rejected CVs a short, fixed time after the role closes.
- Offer an optional “keep me in your talent pool” tick box, separate from the application consent.
- Keep selection records only as long as legal or audit needs require. Ask your counsel.
- Delete every copy, including those held by vendors and in backups.
A sample policy appears later in this article.
5. Secure the data
Rule 6 expects reasonable safeguards such as encryption, access control, activity logs and backups. For HR, this means no CVs on personal WhatsApp or Gmail accounts, role-based access, multi-factor login, shredding of printed CVs after walk-in drives and removal of access when staff leave.
6. Prepare for candidate rights and grievances
Candidates can ask for a summary of their data, correct errors, request erasure and raise grievances. Publish a contact point, name an internal owner, set a response workflow and keep a log of every request.
7. Build a breach response plan
If a breach occurs, the hospital must inform the Data Protection Board and each affected candidate. The Rules also require a detailed report to the Board within 72 hours. Decide in advance who leads the response, which messages you will send and how quickly vendors must alert you.
Vendor Obligations When a Staffing Partner Processes Candidate Data
Under Section 8, the hospital stays responsible for compliance even when a processor handles the data, and it may appoint a processor only through a valid contract. For DPDP Act 2023 recruitment workflows, this makes vendor choice a compliance decision, not just a commercial one.
What your contract should cover
- Processing only on the hospital’s written instructions and only for the stated hiring purpose
- Reasonable security safeguards, described in writing
- Prompt breach alerts to the hospital, with a clear time limit
- Approval before any sub-processor is used
- Deletion or return of candidate data when the contract ends
- Help with candidate requests for access, correction or erasure
- Audit or information rights for the hospital
- Rules on storing or sharing data outside India
Questions to ask before you sign
- Where is candidate data stored, and who can access it?
- Do candidates receive a notice before their CV is shared with a hospital?
- How long do you keep CVs for candidates who are not placed?
- What is your breach-reporting process?
A reliable medical staffing agency should answer these without hesitation. If a partner cannot, that is a warning sign.
Where Staffton Health fits
Staffton Health is a specialised healthcare recruitment and medical staffing platform in India. It works on the principles in this guide: a clear notice before data is shared, use of candidate data only for hiring, defined retention and written processor terms with hospital clients.
Under the DPDP Act 2023, hospitals should ask any partner for these documents during onboarding, and Staffton is ready to provide them.
Sample Candidate Data Retention Policy
These periods are examples only. Set yours with legal counsel.
| Data type | Purpose | Suggested retention | End-of-period action |
| Applications not shortlisted | Assess fit for the open role | Up to 6 months after the role closes | Delete from all systems |
| Talent-pool CVs (opt-in) | Match with future roles | 12 months, then re-confirm | Delete if not re-confirmed |
| Interview notes and scorecards | Show fair selection | As counsel advises | Delete or anonymise |
| ID and registration copies of candidates not hired | Verification | Delete once the decision is made | Secure deletion, vendor confirms |
| Candidates who join | Employee record | Follow the employee-record policy | Move to HR file, delete hiring copies |
Conclusion
Candidate data is easy to collect and easy to forget, which is exactly why the DPDP Act 2023 matters for hospital HR.
Start with a data map, add a plain-language notice, collect only what each stage needs, set a written retention rule and put processor terms in writing with every partner. These steps protect candidates and also protect your hospital’s reputation.
Want the consent notice and retention policy in an editable format, or a staffing partner that treats candidate data carefully?
Contact Staffton Health and our team will help you hire with confidence.
FAQs
1. Does the DPDP Act 2023 cover paper CVs?
The Act applies to personal data in digital form and to non-digital data that is later digitised. A paper CV that you scan or key into a system falls under the law from that point.
2. Do hospitals need consent to process every resume?
In most cases, consent through a clear notice is the safest basis. The Act also allows certain legitimate uses, such as data voluntarily provided for a stated purpose. Ask your lawyer how this applies to your hiring channels.
3. How long can we keep rejected candidate CVs?
The Act sets no fixed period for rejected CVs. Data must be erased once the purpose ends or consent is withdrawn, unless a law requires retention. Choose a reasonable period, record your reasoning and apply it everywhere, including vendor systems.
4. Who is responsible if a staffing partner leaks candidate data?
The hospital, as Data Fiduciary, remains responsible for compliance even when a processor handles the data. A written contract and regular checks on the vendor reduce this risk.
5. When do the main obligations start?
The Consent Manager provisions begin on 13 November 2026, and the core obligations on notice, consent, security, breach reporting and candidate rights begin on 13 May 2027. Check for any later government amendments.
