Under the DPDP Act, 2023, consent is valid only if it is free, specific, informed, unambiguous, revocable, and recorded. For HR teams, that means consent must be a genuine active opt-in tied to one clear purpose, given without pressure, easy to withdraw, and backed by a stored audit trail. If even one of these six elements is missing, the consent is invalid — and the organisation is non-compliant, even if the data collection itself was legitimate.
In practice, valid HR consent must:
Consent is also not required where another lawful basis applies, such as statutory obligations (PF, PAN for payroll) or contractual necessity (onboarding documents).
HR teams ask candidates/employees for consent all the time but under the DPDP Act, 2023, casual consent doesn’t count anymore.
No more:
If consent is not taken correctly, the organisation is non-compliant, even if the data collection itself was legitimate.
This guide explains what valid consent means under DPDP, specifically for HR use cases, with real examples you can copy.
Consent must be:
✔ Free – no pressure to accept
✔ Specific – tied to a clear purpose
✔ Informed – the person knows what they’re agreeing to
✔ Unambiguous – an active opt-in
✔ Revocable – person can withdraw easily
✔ Recorded – audit trail/proof maintained
If even one element is missing → consent is invalid.
❌ bundled or blanket consent
❌ unclear purpose (“for company use”)
❌ consent required for employment when not legally needed
❌ consent assumed because candidate submitted documents
❌ auto-opt-ins
❌ difficult withdrawal process
❌ storing consent but not purpose
Most non-compliance happens not because HR misuses data, but because:
Consent should not be used where another lawful basis applies.
| Legal basis | HR use cases |
| Contractual necessity | joining docs for onboarding |
| Legal/statutory obligation | PF, PAN for payroll |
| Employment obligations | access cards, IT system logs |
| Legitimate interest w/ notice | CCTV signage for safety |
| Emergencies | medical emergency data |
Reason: If refusal isn’t truly allowed, consent becomes meaningless.
Below are real situations HR teams face and how to fix consent properly.
❌ invalid phrasing:
By continuing with employment, you consent to all background checks.
✔ valid consent:
We request your consent to collect and verify your employment history and identity documents solely for mandatory background verification.
You may withdraw consent anytime before verification completion.
What HR must store:
DPDP flags Aadhaar as high-risk personal data.
Consent must:
✔ valid consent example:
We require PAN for payroll and taxation compliance. Aadhaar is requested only if required by law for verification. You may provide an alternative ID where permissible.
Consent must specify:
✔ valid consent:
CCTV cameras operate in common spaces for safety and compliance. Footage is retained for 30 days unless required for investigation.
Medical data is highly sensitive.
❌ invalid consent:
We may request medical documents for administrative use.
✔ valid consent:
We request your explicit consent to collect medical fitness documents solely for statutory compliance related to workplace safety.
| Purpose | Invalid wording | Valid wording |
| BGV | “you agree to background checks.” | “verify identity/employment history only for background verification.” |
| Payroll | “bank details for HR use” | “bank details solely for payroll + statutory audit periods” |
| Aadhaar | “submit Aadhaar” | “Aadhaar only if legally required, PAN alternative available.” |
| CCTV | “premises are monitored” | “CCTV in common areas retained 30 days unless investigation.” |
✔ Store versioned consent text
✔ Maintain timestamps for each consent action
✔ Separate consent storage from employee folders
✔ Maintain expiry/duration of consent
✔ Track withdrawal requests
Even digital checkboxes must be linked to audit logs.
Consent applies only for the period necessary.
Suggested retention limits commonly adopted by compliant companies:
| Data | Typical retention |
| BGV docs | until verification completion |
| Candidate CV (rejected) | 3–6 months |
| Payroll records | statutory requirement period |
| CCTV | 30–45 days |
| Access logs | 90 days |
| Medical docs | statutory compliance period |
No purpose = delete.
Step 1: Is it legally required?
→ Yes → no consent required
Step 2: Is it contractually necessary?
→ Yes → no consent required
Step 3: Is it optional?
→ Yes → consent required
Step 4: If neither applies
→ do not collect data
A 500-employee IT firm collected Aadhaar + PAN + voter ID during onboarding using a single blanket consent checkbox.
Later, an employee requested Aadhaar deletion.
The organisation couldn’t track separate consent proof.
An official complaint led to:
The cost of remediation was 6x higher than doing consent versioning properly upfront.
Sample language HR can use:
We request your consent to collect the following personal data for the purposes described below.
• Purpose: payroll processing
• Data: bank account details
• Retention: until statutory payroll audit periods lapse
• Rights: you may withdraw consent or request correction anytime
✔ active opt-in required
☑ Is consent required legally?
☑ Is purpose specific?
☑ Can consent be withdrawn meaningfully?
☑ Is retention defined?
☑ Do we have proof?
Any “no” means consent is invalid.
Employee/Candidate Consent Form – DPDP Compliant
I consent to the collection and processing of the personal data listed below strictly for the stated purposes.
I understand that:
Signature/checkbox: _______
Name/Employee ID: ________
Date/time: ________________
For HR teams under DPDP, valid consent is:
It protects the employee, and protects the organisation from penalties.
Strong consent practices = fewer risks + cleaner documentation habits.
.png)
