For years, HR teams have followed an unspoken rule:
Collect more data, just in case.
The intent was good – smoother onboarding, fewer follow-ups, faster payroll.
But under the DPDP Act, 2023, this habit is no longer safe.
Today, HR teams must be able to justify every data field they collect.
If you can’t clearly explain why a piece of data is needed, you probably shouldn’t be collecting it at all.
That’s what data minimisation is really about.
Data minimisation means:
✔ collect only what is necessary
✔ collect it only when it is required
✔ keep it only for as long as the purpose exists
Under DPDP:
If the purpose is unclear, the collection itself becomes non-compliant.
Most DPDP violations in HR don’t come from intent – they come from legacy forms.
Typical reasons:
High-risk areas include:
👉 Redesigning forms is the fastest way to reduce DPDP risk.
Problem: None of this is required to evaluate a candidate.
Everything else is deferred to later stages with a clear purpose.
Impact:
Before keeping any field in an HR form, ask:
✔ Does this field support a real decision at this stage?
✔ Can the same outcome be achieved with less personal data?
✔ Can we clearly defend this field to an auditor or employee?
If the answer to any one is “no” → remove the field or move it to a later stage.
This test alone eliminates most over-collection.
Redesigning for DPDP does not mean rebuilding everything from scratch.
It means cleaning, splitting and sequencing what already exists.
Use this simple 4-step approach:
1️⃣ Audit every field and document collected
Review all application forms, onboarding forms and BGV checklists using the 3-question field test:
Any field without a clear answer must be removed or deferred.
2️⃣ Split single large forms into stage-based forms
Instead of one long form, redesign into:
This prevents premature and unnecessary data collection.
3️⃣ Defer high-risk data to purpose-specific steps
High-risk data like Aadhaar, address proof or ID documents should:
Deferral is a core DPDP-safe design principle.
4️⃣ Attach retention and deletion triggers to each workflow
Every redesigned form or workflow must clearly define:
No retention rule = incomplete workflow.
Redesigning forms and workflows this way ensures HR collects less data, later and for shorter durations – exactly what DPDP expects.
✔ Resume
✔ Contact details
✔ Role-relevant portfolio
❌ ID proofs
❌ Address documents
❌ Certificates
Reason: Evaluation ≠ identity verification.
✔ Role-relevant certificates
✔ Experience letters (if required)
❌ Aadhaar unless legally mandated
Reason: Verification should follow intent, not precede it.
✔ Documents mapped to specific checks
✔ One ID per verification purpose
❌ Blanket vendor checklists
❌ Multiple IDs “just in case”
📌 BGV is where data minimisation fails most often.
During a DPDP readiness review, HR was asked:
“Why do you collect Aadhaar at the application stage?”
Answer:
“This has always been our form.”
There was:
Outcome:
The fix took one week – but only after the risk surfaced.
Collection is only step one.
Every data point must also have:
✔ a retention period
✔ a deletion trigger
| Scenario | Deletion Trigger |
| Candidate rejected | After defined retention window |
| Offer declined | Immediately |
| BGV completed | Post-verification |
| Employment ends | As per statutory retention |
No purpose → no retention → no storage.
❌ “We might need it later”
❌ “Vendor requires it”
❌ “Company policy says so”
❌ “Everyone collects this”
DPDP recognises only:
✔ legal necessity
✔ clearly defined purpose
Habit is not compliance.
Done right, data minimisation:
Less data = less risk.
✔ Every field has a purpose
✔ Fields are stage-appropriate
✔ High-risk IDs are deferred
✔ Vendor requests are reviewed
✔ Retention & deletion defined
✔ Forms audited annually
Data minimisation is not about slowing hiring.
It’s about:
Under DPDP, less data is safer data.
HR teams that redesign forms and workflows now will avoid panic, penalties and rushed clean-ups later.
.png)
