For years, HR and Background Verification (BGV) teams have followed one silent rule:
Collect more data, just in case.
Most of the time, this data is collected with good intent.
But under the DPDP Act, 2023, intent is no longer enough.
HR teams now need to answer one uncomfortable question for every document they collect:
“Why exactly do we need this data?”
This is where Purpose Limitation comes in.
This guide explains:
- what purpose limitation really means in hiring and BGV
- how much data is actually justified
- how HR teams can apply it without slowing down hiring
What Purpose Limitation Means Under DPDP
Purpose limitation means:
You can collect personal data only for a clearly defined, specific purpose and only use it for that purpose.
In HR terms:
- One document → one purpose
- No vague reasons like “HR use”
- No future or hypothetical needs
If the purpose ends, retention must end. If the purpose is unclear, the collection itself is invalid.
Why Purpose Limitation Matters Most in Hiring & BGV
Hiring and background verification are the highest-risk stages under DPDP because:
- large volumes of personal data are collected quickly
- candidates often feel they cannot refuse
- multiple vendors are involved (ATS, BGV agencies, payroll tools)
- data is frequently stored long after decisions are made
Most DPDP violations in HR happen here – not in payroll or exit processes.
The Purpose Limitation Decision Rule for HR Teams
Before collecting any document, HR must be able to answer all five questions:
- What exact purpose does this document serve?
- Is this purpose legally required or operationally essential?
- Is there a less intrusive document that achieves the same purpose?
- At which stage is this document truly needed?
- When does this purpose end?
If any answer is unclear, do not collect the document.
This single check eliminates most non-compliance.
Purpose-to-Document Mapping (Internal Control Tool)
Before approving any hiring or BGV workflow, map documents like this:
| Stage | Document | Purpose | Justified? | Retention |
| Hiring | Resume | Role evaluation | Yes | Till role closes |
| Hiring | Aadhaar | Identity | No | Do not collect |
| BGV | Address Proof | Address verification | Yes | Till verification |
| Onboarding | PAN | Payroll & tax | Yes | As per law |
If the purpose cannot be written in one sentence, the document must be removed.
What HR Can Justifiably Collect at Each Hiring Stage
Shortlisting Stage
✔ Resume
✔ Role-relevant portfolio
❌ ID proofs
❌ Address documents
❌ Certificates
Why: Evaluation does not require identity verification.
Offer / Pre-Onboarding Stage
✔ Degree certificates (only if role-relevant)
✔ Experience letters (if required)
❌ Aadhaar unless legally mandated
BGV Stage
✔ Documents tied to specific verification checks
✔ One ID per verification purpose
❌ Multiple IDs for the same purpose
❌ Blanket vendor checklists
BGV is where purpose limitation breaks most often.
Where BGV Processes Usually Go Wrong
Common mistakes include:
- vendors asking for “standard” document sets
- HR forwarding documents without questioning purpose
- storing BGV documents indefinitely
- reusing BGV data internally
Purpose Limitation Checklist for BGV
✔ Each document maps to one verification check
✔ No extra IDs “for safety”
✔ Deletion timeline defined upfront
✔ No reuse beyond verification
✔ DPDP clauses included in vendor contracts
Vendor non-compliance is not transferable. HR remains accountable.
Retention and Deletion Must Follow Purpose
Purpose limitation is incomplete without deletion.
| Scenario | Deletion Trigger |
| Candidate rejected | After defined retention window |
| Offer declined | Immediately after closure |
| BGV completed | Post-verification |
| Employment ends | As per statutory retention |
No purpose → no retention → no storage.
Practices That Feel Normal but Violate DPDP
❌ “We might need it later”
❌ “Vendor requires it”
❌ “Company policy says so”
❌ “Everyone collects this”
DPDP recognizes only:
✔ legal necessity
✔ clearly defined purpose
Habit is not justification.
How Purpose Limitation Protects HR Teams
When applied correctly, purpose limitation:
- reduces compliance risk
- minimizes breach exposure
- simplifies audits
- builds candidate trust
- prevents over-collection by vendors
It also makes HR workflows cleaner and defensible.
Purpose Limitation Checklist for Hiring & BGV
✔ One document = one clear purpose
✔ No “just in case” collection
✔ Prefer alternatives to high-risk IDs
✔ Collect documents only at the required stage
✔ Define retention and deletion upfront
✔ Do not reuse BGV data internally
✔ Audit vendor document requests
One Rule Every HR Team Should Remember
If you cannot explain why you need a document in one clear sentence, you should not collect it.
Final Takeaway
Purpose limitation is not about slowing hiring.
It is about:
- collecting fewer documents
- collecting them later
- deleting them faster
Under DPDP, less data is safer data.
HR teams that fix purpose limitation today will avoid panic, penalties and rushed clean-ups tomorrow.
