Under the DPDP Act, 2023, consent is no longer a checkbox or a footer line.
For HR teams, consent now needs to be:
• intentional
• traceable
• purpose-specific
• revocable
Most organisations don’t fail DPDP because they didn’t ask for consent.
They fail because their consent flow is broken across hiring, onboarding, and BGV.
This playbook shows you exactly how to design a DPDP-compliant consent flow, step by step with ready-to-use consent templates that you can directly download or copy-paste into your hiring, onboarding, and HR workflows.
What a DPDP-Compliant Consent Flow Actually Means
A valid consent flow under DPDP must ensure that:
✔ consent is taken before data collection
✔ purpose is clearly explained
✔ consent is not bundled
✔ silence or inactivity is not treated as consent
✔ consent can be withdrawn
✔ proof of consent can be shown later
Consent is not one moment.
It is a journey across multiple HR touchpoints.
The Ideal Consent Flow for HR (End-to-End)
Here’s how a DPDP-compliant consent flow should look:
1️⃣ Awareness (JD / Careers page)
2️⃣ Explicit consent (Application stage)
3️⃣ Purpose-specific consent (BGV / onboarding)
4️⃣ Confirmation & record keeping
5️⃣ Retention + deletion alignment
We’ll cover each step with templates you can directly copy.
Step 1: Set Consent Context Early (JD & Careers Page)
Consent should never come as a surprise after documents are shared.
Template 1: Job Description Consent Line
(Copy-paste ready)
Data Notice:
By applying for this role, you acknowledge that your personal data will be processed solely for recruitment and related evaluation purposes, in accordance with applicable data protection laws. Detailed consent will be sought before any background verification or onboarding activities.
Why this works
✔ sets expectation early
✔ does not over-collect
✔ does not assume consent
Step 2: Explicit Consent at Application Stage
This is where most HR teams go wrong by:
❌ using pre-ticked boxes
❌ clubbing consent with T&C
❌ using vague wording
Template 2: Application Form Consent
(Copy-paste ready)
☐ I consent to the collection and processing of my personal data for the purpose of evaluating my application for employment with [Company Name].
I understand that my data will be used only for recruitment purposes and retained as per applicable laws.
Rules to follow
✔ unchecked by default
✔ one purpose only
✔ simple language
Step 3: Purpose-Specific Consent for BGV
BGV always requires a fresh consent.
Earlier hiring consent does not automatically apply.
Template 3: BGV Consent (Standalone)
(Copy-paste ready)
☐ I consent to the collection and verification of my personal data solely for background verification purposes, including identity, employment, and address verification, as required for this role.
I understand that this data will not be used for any other purpose and will be deleted after verification, except where retention is legally required.
Important
✔ do NOT bundle with offer letter
✔ do NOT reuse hiring consent
✔ clearly name verification purpose
Step 4: Consent Email (Traceable Proof)
Consent should be auditable — not verbal or implied.
Template 4: Consent Confirmation Email
(Copy-paste ready)
Subject: Confirmation of Consent for [Purpose]
Hi [Candidate Name],
This email confirms that you have provided consent for the processing of your personal data for the following purpose(s):
• [Purpose – e.g., Recruitment Evaluation / Background Verification]
Your data will be used only for the stated purpose and retained as per applicable legal requirements.
You may withdraw your consent at any time by writing to [email].
Regards,
HR Team
[Company Name]
This email becomes your proof of consent.
Step 5: Consent in Onboarding Forms (Not Blanket)
Onboarding is where consent misuse peaks.
Template 5: Onboarding Consent (Purpose-Mapped)
(Copy-paste ready)
☐ I consent to the processing of my personal data for payroll, statutory compliance, and employment administration purposes.
☐ I consent to the processing of my contact information for official communication purposes.
☐ I consent to the processing of my data for benefits administration (insurance, allowances, etc.).
Why multiple checkboxes matter
✔ prevents bundled consent
✔ aligns with purpose limitation
✔ supports selective withdrawal
Consent Withdrawal (Often Forgotten, Always Required)
DPDP requires that withdrawal be as easy as giving consent.
Template 6: Consent Withdrawal Line
(Can be reused everywhere)
You may withdraw your consent at any time by contacting [email]. Upon withdrawal, your data will be deleted unless retention is required by law.
Internal HR Workflow: Who Does What
To make consent work operationally:
✔ ATS captures hiring consent
✔ HR triggers BGV consent separately
✔ Vendors cannot start verification without consent ID
✔ Consent records stored centrally
✔ Retention clock linked to purpose end
Consent without workflow = compliance theatre.
Common Consent Mistakes to Avoid
❌ “By continuing, you agree…”
❌ One checkbox for all purposes
❌ Consent hidden inside offer letters
❌ Vendor-generated consent without HR review
❌ No deletion trigger after purpose ends
Under DPDP, invalid consent = no consent.
Valid vs Invalid Consent Wording (Quick Reference for HR)
| Scenario | ❌ Invalid Consent | ✅ Valid Consent |
| Job application | “By applying, you agree to all company policies.” | “By applying, you consent to the collection of your resume and contact details for recruitment purposes only.” |
| Background verification | “We may conduct checks as required.” | “I consent to background verification for employment eligibility and criminal record verification.” |
| Future use | “Your data may be used for future roles.” | “Your data will be retained for 6 months for future relevant roles, after which it will be deleted.” |
| Withdrawal | No withdrawal option mentioned | “You may withdraw consent at any time by writing to [email protected].” |
📌 Rule of thumb:
If consent does not clearly mention purpose, scope, and choice, it is not valid under DPDP.
Consent Flow Checklist for HR Teams
✔ Consent before data collection
✔ Clear, specific purpose
✔ Separate consent for BGV
✔ No pre-ticked boxes
✔ Proof stored and retrievable
✔ Withdrawal mechanism visible
✔ Retention aligned with purpose
Final Takeaway
DPDP-compliant consent is not about legal language.
It’s about:
• asking clearly
• collecting minimally
• documenting properly
• deleting on time
HR teams that fix consent flows now will avoid:
• regulatory risk
• vendor blame games
• emergency clean-ups later
