{"id":318,"date":"2026-11-04T07:48:58","date_gmt":"2026-11-04T07:48:58","guid":{"rendered":"https:\/\/stafftonhealth.com\/blog\/?p=318"},"modified":"2026-11-04T07:48:58","modified_gmt":"2026-11-04T07:48:58","slug":"dpdp-act-2023","status":"publish","type":"post","link":"https:\/\/stafftonhealth.com\/blog\/dpdp-act-2023\/","title":{"rendered":"DPDP Act 2023 and Candidate Data: A Compliance Checklist for Hospital HR"},"content":{"rendered":"<p><span style=\"font-weight: 400;\">Every resume in your inbox is now a legal responsibility, not just a hiring asset.<\/span><\/p>\n<p><span style=\"font-weight: 400;\">Hospital HR teams hold a lot of personal data long before a nurse or doctor joins the team: registration certificates, ID proofs, addresses, salary history and reference details. The <\/span><a href=\"https:\/\/www.meity.gov.in\/static\/uploads\/2024\/06\/2bf1f0e9f04e6fb4f8fef35e82c42aa5.pdf\" target=\"_blank\" rel=\"noopener\"><b>DPDP Act 2023<\/b><\/a><span style=\"font-weight: 400;\"> changes how that data must be collected, used, stored and deleted. <\/span><\/p>\n<p><span style=\"font-weight: 400;\">This guide gives you a practical checklist, a sample consent notice and a sample retention policy that you can adapt for your hospital.<\/span><\/p>\n<h2><b>What the DPDP Act 2023 Means for Hospital HR<\/b><\/h2>\n<p><span style=\"font-weight: 400;\">India&#8217;s Digital Personal Data Protection Act became enforceable in stages after the DPDP Rules, 2025 were notified on 13 November 2025. Three roles matter for recruitment:<\/span><\/p>\n<ul>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><b>Data Principal:<\/b><span style=\"font-weight: 400;\"> the candidate whose data you hold.<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><b>Data Fiduciary:<\/b><span style=\"font-weight: 400;\"> the hospital, because it decides why and how candidate data is used.<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><b>Data Processor:<\/b><span style=\"font-weight: 400;\"> anyone who handles data on the hospital&#8217;s behalf, such as a staffing partner, a job portal or an applicant-tracking tool.<\/span><\/li>\n<\/ul>\n<p><span style=\"font-weight: 400;\">The law does not create a separate &#8220;sensitive data&#8221; class. Medical registration numbers, ID copies and fitness records therefore carry no special label. Still, this is the data that does the most harm when it leaks, so it deserves extra care.<\/span><\/p>\n<h3><b>Key dates HR should know<\/b><\/h3>\n<ul>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><b>13 November 2025:<\/b><span style=\"font-weight: 400;\"> Rules notified and the Data Protection Board framework started.<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><b>13 November 2026:<\/b><span style=\"font-weight: 400;\"> Consent Manager provisions (Rule 4) begin.<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><b>13 May 2027:<\/b><span style=\"font-weight: 400;\"> Notice, consent, security safeguards, breach reporting and candidate rights begin.<\/span><\/li>\n<\/ul>\n<p><span style=\"font-weight: 400;\">Because the DPDP Act 2023 is being enforced in phases, some hospitals assume they can wait. That is risky. Mapping data, rewriting forms and renegotiating vendor contracts takes months. <\/span><\/p>\n<p><span style=\"font-weight: 400;\">MeitY has also proposed shorter timelines for Significant Data Fiduciaries, so check the latest notifications before you finalise your plan.<\/span><\/p>\n<h2><b>Why Candidate Data Privacy in India Is Now a Leadership Issue<\/b><\/h2>\n<p><span style=\"font-weight: 400;\">A single recruitment file can hold a person&#8217;s full identity. If it leaks, the hospital faces legal work, candidate notifications, lost trust and possible penalties. IBM&#8217;s<\/span> <a href=\"https:\/\/in.newsroom.ibm.com\/2025-08-07-India-Records-Highest-Average-Cost-of-a-Data-Breach-IBM\" target=\"_blank\" rel=\"noopener\"><b>Cost of a Data Breach Report 2025<\/b><\/a><span style=\"font-weight: 400;\"> found that the average cost of a data breach in India reached \u20b922 crore (INR 220 million), about 13% higher than in 2024. <\/span><\/p>\n<p><span style=\"font-weight: 400;\">That figure covers organisations of all kinds, not only hospitals, but it shows how quickly the bill grows. The DPDP Act 2023 adds its own financial penalties on top, and the Act&#8217;s Schedule places the highest tier on failures to keep reasonable security safeguards.<\/span><\/p>\n<h2><b>Hospital HR Privacy Compliance Checklist<\/b><\/h2>\n<p><span style=\"font-weight: 400;\">Every stage of your<\/span> <a href=\"https:\/\/stafftonhealth.com\/blog\/hospital-recruitment-process\/\"><b>hospital recruitment process<\/b><\/a><span style=\"font-weight: 400;\"> touches personal data, from the first application to the joining formalities. Use the seven steps below as your working checklist.<\/span><\/p>\n<h3><b>1. Map every place candidate data lives<\/b><\/h3>\n<p><span style=\"font-weight: 400;\">List each location: career-page forms, email inboxes, WhatsApp groups, walk-in drive sheets, vendor portals and spreadsheets. For each one, note what data sits there, who can see it, why you hold it and where it travels next. <\/span><\/p>\n<p><span style=\"font-weight: 400;\">You cannot protect or delete what you cannot find, so resume data protection starts with this map. If your team still relies on scattered inboxes, an<\/span> <a href=\"https:\/\/stafftonhealth.com\/blog\/applicant-tracking-system\/\"><b>applicant tracking system<\/b><\/a><span style=\"font-weight: 400;\"> makes access control and deletion far easier.<\/span><\/p>\n<h3><b>2. Give a clear consent notice<\/b><\/h3>\n<p><span style=\"font-weight: 400;\">Under Section 5 and Rule 3, the notice must reach the candidate when you ask for consent. It should use plain language and include an itemised list of the data you collect, the specific purpose, how to withdraw consent, how to exercise rights and how to complain to the Data Protection Board.\u00a0<\/span><\/p>\n<p><span style=\"font-weight: 400;\">Candidates should be able to read it in English or any language listed in the Eighth Schedule, which helps when you hire nurses across states.<\/span><\/p>\n<p><span style=\"font-weight: 400;\">Good HR data consent in India has these features:<\/span><\/p>\n<ul>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">It is free, specific, informed and unconditional.<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">It needs a clear action from the candidate. Pre-ticked boxes do not count.<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">It is not bundled. &#8220;Apply for this job&#8221; and &#8220;send me marketing&#8221; need separate choices.<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Withdrawing it is as easy as giving it.<\/span><\/li>\n<\/ul>\n<p><span style=\"font-weight: 400;\">One point to take legal advice on: the Act also recognises certain &#8220;legitimate uses&#8221;, including cases where a person voluntarily shares data for a stated purpose. Some practitioners rely on this for unsolicited CVs. Even so, a short notice is safer and builds candidate trust.<\/span><\/p>\n<h3><b>3. Apply purpose limitation and data minimisation<\/b><\/h3>\n<p><span style=\"font-weight: 400;\">Collect only what the current hiring stage needs:<\/span><\/p>\n<ul>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><b>Application:<\/b><span style=\"font-weight: 400;\"> name, contact details, qualification, experience and registration number.<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><b>Shortlist:<\/b><span style=\"font-weight: 400;\"> salary history and references.<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><b>Offer:<\/b><span style=\"font-weight: 400;\"> ID and address proofs, plus consent for checks.<\/span><\/li>\n<\/ul>\n<p><span style=\"font-weight: 400;\">Do not ask for a full Aadhaar copy at the application stage. Run<\/span> <a href=\"https:\/\/stafftonhealth.com\/blog\/employee-background-verification-for-hospital\/\"><b>employee background verification<\/b><\/a><span style=\"font-weight: 400;\"> only after the offer stage and with a separate, specific consent. <\/span><\/p>\n<p><span style=\"font-weight: 400;\">Purpose limitation also means you should not reuse a CV collected for one role to promote unrelated services, or pass it to another hospital without permission. If you use AI screening tools, treat them as processors and tell candidates they are in use.<\/span><\/p>\n<h3><b>4. Set a retention rule for rejected CVs<\/b><\/h3>\n<p><span style=\"font-weight: 400;\">Section 8(7) says personal data must be erased once its purpose is served or consent is withdrawn, unless a law requires you to keep it. The DPDP Act 2023 does not give a fixed number of days for rejected CVs, so each hospital must choose a sensible period and document why. A practical approach:<\/span><\/p>\n<ul>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Delete rejected CVs a short, fixed time after the role closes.<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Offer an optional &#8220;keep me in your talent pool&#8221; tick box, separate from the application consent.<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Keep selection records only as long as legal or audit needs require. Ask your counsel.<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Delete every copy, including those held by vendors and in backups.<\/span><\/li>\n<\/ul>\n<p><span style=\"font-weight: 400;\">A sample policy appears later in this article.<\/span><\/p>\n<h3><b>5. Secure the data<\/b><\/h3>\n<p><span style=\"font-weight: 400;\">Rule 6 expects reasonable safeguards such as encryption, access control, activity logs and backups. For HR, this means no CVs on personal WhatsApp or Gmail accounts, role-based access, multi-factor login, shredding of printed CVs after walk-in drives and removal of access when staff leave.<\/span><\/p>\n<h3><b>6. Prepare for candidate rights and grievances<\/b><\/h3>\n<p><span style=\"font-weight: 400;\">Candidates can ask for a summary of their data, correct errors, request erasure and raise grievances. Publish a contact point, name an internal owner, set a response workflow and keep a log of every request.<\/span><\/p>\n<h3><b>7. Build a breach response plan<\/b><\/h3>\n<p><span style=\"font-weight: 400;\">If a breach occurs, the hospital must inform the Data Protection Board and each affected candidate. The Rules also require a detailed report to the Board within 72 hours. Decide in advance who leads the response, which messages you will send and how quickly vendors must alert you.<\/span><\/p>\n<h2><b>Vendor Obligations When a Staffing Partner Processes Candidate Data<\/b><\/h2>\n<p><span style=\"font-weight: 400;\">Under Section 8, the hospital stays responsible for compliance even when a processor handles the data, and it may appoint a processor only through a valid contract. For DPDP Act 2023 recruitment workflows, this makes vendor choice a compliance decision, not just a commercial one.<\/span><\/p>\n<h3><b>What your contract should cover<\/b><\/h3>\n<ul>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Processing only on the hospital&#8217;s written instructions and only for the stated hiring purpose<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Reasonable security safeguards, described in writing<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Prompt breach alerts to the hospital, with a clear time limit<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Approval before any sub-processor is used<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Deletion or return of candidate data when the contract ends<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Help with candidate requests for access, correction or erasure<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Audit or information rights for the hospital<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Rules on storing or sharing data outside India<\/span><\/li>\n<\/ul>\n<h3><b>Questions to ask before you sign<\/b><\/h3>\n<ul>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Where is candidate data stored, and who can access it?<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Do candidates receive a notice before their CV is shared with a hospital?<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">How long do you keep CVs for candidates who are not placed?<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">What is your breach-reporting process?<\/span><\/li>\n<\/ul>\n<p><span style=\"font-weight: 400;\">A reliable<\/span> <a href=\"https:\/\/stafftonhealth.com\/blog\/medical-staffing-agency\/\"><b>medical staffing agency<\/b><\/a><span style=\"font-weight: 400;\"> should answer these without hesitation. If a partner cannot, that is a warning sign.<\/span><\/p>\n<h2><b>Where Staffton Health fits<\/b><\/h2>\n<p><a href=\"https:\/\/stafftonhealth.com\/\"><b>Staffton Health<\/b><\/a><span style=\"font-weight: 400;\"> is a specialised healthcare recruitment and medical staffing platform in India. It works on the principles in this guide: a clear notice before data is shared, use of candidate data only for hiring, defined retention and written processor terms with hospital clients.\u00a0<\/span><\/p>\n<p><span style=\"font-weight: 400;\">Under the DPDP Act 2023, hospitals should ask any partner for these documents during onboarding, and Staffton is ready to provide them.<\/span><\/p>\n<h2><b>Sample Candidate Data Retention Policy<\/b><\/h2>\n<p><span style=\"font-weight: 400;\">These periods are examples only. Set yours with legal counsel.<\/span><\/p>\n<table>\n<tbody>\n<tr>\n<td><b>Data type<\/b><\/td>\n<td><b>Purpose<\/b><\/td>\n<td><b>Suggested retention<\/b><\/td>\n<td><b>End-of-period action<\/b><\/td>\n<\/tr>\n<tr>\n<td><span style=\"font-weight: 400;\">Applications not shortlisted<\/span><\/td>\n<td><span style=\"font-weight: 400;\">Assess fit for the open role<\/span><\/td>\n<td><span style=\"font-weight: 400;\">Up to 6 months after the role closes<\/span><\/td>\n<td><span style=\"font-weight: 400;\">Delete from all systems<\/span><\/td>\n<\/tr>\n<tr>\n<td><span style=\"font-weight: 400;\">Talent-pool CVs (opt-in)<\/span><\/td>\n<td><span style=\"font-weight: 400;\">Match with future roles<\/span><\/td>\n<td><span style=\"font-weight: 400;\">12 months, then re-confirm<\/span><\/td>\n<td><span style=\"font-weight: 400;\">Delete if not re-confirmed<\/span><\/td>\n<\/tr>\n<tr>\n<td><span style=\"font-weight: 400;\">Interview notes and scorecards<\/span><\/td>\n<td><span style=\"font-weight: 400;\">Show fair selection<\/span><\/td>\n<td><span style=\"font-weight: 400;\">As counsel advises<\/span><\/td>\n<td><span style=\"font-weight: 400;\">Delete or anonymise<\/span><\/td>\n<\/tr>\n<tr>\n<td><span style=\"font-weight: 400;\">ID and registration copies of candidates not hired<\/span><\/td>\n<td><span style=\"font-weight: 400;\">Verification<\/span><\/td>\n<td><span style=\"font-weight: 400;\">Delete once the decision is made<\/span><\/td>\n<td><span style=\"font-weight: 400;\">Secure deletion, vendor confirms<\/span><\/td>\n<\/tr>\n<tr>\n<td><span style=\"font-weight: 400;\">Candidates who join<\/span><\/td>\n<td><span style=\"font-weight: 400;\">Employee record<\/span><\/td>\n<td><span style=\"font-weight: 400;\">Follow the employee-record policy<\/span><\/td>\n<td><span style=\"font-weight: 400;\">Move to HR file, delete hiring copies<\/span><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<h2><b>Conclusion<\/b><\/h2>\n<p><span style=\"font-weight: 400;\">Candidate data is easy to collect and easy to forget, which is exactly why the DPDP Act 2023 matters for hospital HR.\u00a0<\/span><\/p>\n<p><span style=\"font-weight: 400;\">Start with a data map, add a plain-language notice, collect only what each stage needs, set a written retention rule and put processor terms in writing with every partner. These steps protect candidates and also protect your hospital&#8217;s reputation.<\/span><\/p>\n<p><span style=\"font-weight: 400;\">Want the consent notice and retention policy in an editable format, or a staffing partner that treats candidate data carefully?\u00a0<\/span><\/p>\n<p><a href=\"https:\/\/stafftonhealth.com\/contact-us\/\"><b>Contact Staffton Health<\/b><\/a><span style=\"font-weight: 400;\"> and our team will help you hire with confidence.<\/span><\/p>\n<h2><b>FAQs<\/b><\/h2>\n<h3><b>1. Does the DPDP Act 2023 cover paper CVs?<\/b><\/h3>\n<p><span style=\"font-weight: 400;\">The Act applies to personal data in digital form and to non-digital data that is later digitised. A paper CV that you scan or key into a system falls under the law from that point.<\/span><\/p>\n<h3><b>2. Do hospitals need consent to process every resume?<\/b><\/h3>\n<p><span style=\"font-weight: 400;\">In most cases, consent through a clear notice is the safest basis. The Act also allows certain legitimate uses, such as data voluntarily provided for a stated purpose. Ask your lawyer how this applies to your hiring channels.<\/span><\/p>\n<h3><b>3. How long can we keep rejected candidate CVs?<\/b><\/h3>\n<p><span style=\"font-weight: 400;\">The Act sets no fixed period for rejected CVs. Data must be erased once the purpose ends or consent is withdrawn, unless a law requires retention. Choose a reasonable period, record your reasoning and apply it everywhere, including vendor systems.<\/span><\/p>\n<h3><b>4. Who is responsible if a staffing partner leaks candidate data?<\/b><\/h3>\n<p><span style=\"font-weight: 400;\">The hospital, as Data Fiduciary, remains responsible for compliance even when a processor handles the data. A written contract and regular checks on the vendor reduce this risk.<\/span><\/p>\n<h3><b>5. When do the main obligations start?<\/b><\/h3>\n<p><span style=\"font-weight: 400;\">The Consent Manager provisions begin on 13 November 2026, and the core obligations on notice, consent, security, breach reporting and candidate rights begin on 13 May 2027. Check for any later government amendments.<\/span><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Every resume in your inbox is now a legal responsibility, not just a hiring asset. Hospital HR teams hold a lot of personal data long before a nurse or doctor joins the team: registration certificates, ID proofs, addresses, salary history and reference details. The DPDP Act 2023 changes how that data must be collected, used, [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":320,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[],"class_list":["post-318","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-industry-news"],"_links":{"self":[{"href":"https:\/\/stafftonhealth.com\/blog\/wp-json\/wp\/v2\/posts\/318","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/stafftonhealth.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/stafftonhealth.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/stafftonhealth.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/stafftonhealth.com\/blog\/wp-json\/wp\/v2\/comments?post=318"}],"version-history":[{"count":1,"href":"https:\/\/stafftonhealth.com\/blog\/wp-json\/wp\/v2\/posts\/318\/revisions"}],"predecessor-version":[{"id":321,"href":"https:\/\/stafftonhealth.com\/blog\/wp-json\/wp\/v2\/posts\/318\/revisions\/321"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/stafftonhealth.com\/blog\/wp-json\/wp\/v2\/media\/320"}],"wp:attachment":[{"href":"https:\/\/stafftonhealth.com\/blog\/wp-json\/wp\/v2\/media?parent=318"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/stafftonhealth.com\/blog\/wp-json\/wp\/v2\/categories?post=318"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/stafftonhealth.com\/blog\/wp-json\/wp\/v2\/tags?post=318"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}