Brands you trust, trust us

What will the DPDP Act require of your background checks?

From 13 May 2027, the Digital Personal Data Protection Act, 2023 applies its notice, consent, employer duties, candidate rights and penalties to every background check you run. The DPDP Rules, 2025 were notified on 13 November 2025 with 18 months to prepare. Three duties matter most for HR:

  • Prove consent. Where consent is your basis, Section 6(10) puts the burden of proving notice and consent on you. SpringVerify logs and archives every consent.
  • Get the facts right before you decide. Section 8(3) requires complete, accurate and consistent data for any decision about the person. SpringVerify's court record check grades matches against father's name and address, so a namesake's case does not land on your candidate.
  • Keep the logs. Rule 8(3) requires processing logs to be kept for at least one year. Set your SpringVerify retention policy no shorter.

Who is responsible for compliance: you or SpringVerify?

You are. The employer decides why and how candidate data is processed, which usually makes it the Data Fiduciary; a provider running checks on its instructions acts as its Data Processor. Section 8(1) keeps the employer responsible for what its processor does.

SpringVerify gives you a compliant process and the records to prove it, on ISO/IEC 27001:2022 and SOC 2 Type II certified infrastructure. It cannot make your company compliant on its own: your notice, purpose, retention period and hiring decisions stay yours.

For a specific case, take legal advice.

What happens when a candidate disputes a finding?

You correct what is wrong, record the change, and decide on the corrected facts. Section 12 gives candidates the right to correct inaccurate or incomplete data, and Rule 14 caps your grievance response at 90 days.

Example: a court record match

A court search returns a case under the candidate's name, but the father's name and address do not clearly match. SpringVerify grades it Inconclusive instead of guessing. The candidate is asked for a Police Clearance Certificate; SpringVerify validates it and re-grades the case to a final status without re-running the search. The review and final grade stay on the candidate's record, so your decision can be explained.

What does audit evidence from SpringVerify look like?

Hypersonix works with large clients' data, where compliance is essential to the business. "We go through internal & external audits every year. And the verification reports are convenient when the auditing team raises questions," says Manu Panwar, HR Business Partner. "Even the details about the red flags are mentioned in the report."

Wizr AI moved to SpringVerify after ISO 27001 and SOC 2 auditors flagged its manual, email-based checks. With audit-ready reports, its verification time fell from weeks to days.

Loved by HR Teams Across India

AI-driven BGV trusted across India
Will recommend SpringVerify for authentic and faster background checks.
Asmita P.
Senior HR Generalist, HackerEarth
"SpringVerify gave us what we were missing - the ability to actually see court case risks clearly. It has meaningfully reduced our BGV delays and given our HR team the visibility to move faster with confidence."
Ritika Raj
Senior Manager I - HR Shared Services, LoadShare Networks
We've been using SpringVerify since March 2025 and the experience has been smooth so far. What we appreciate most is how proactive and solution oriented they are.
Govindprasad Goankar
Executive VP & HR Head, Kotak Mahindra Asset Management
Ready to Hire With Confidence?
See how candidate data flows seamlessly and verification starts instantly with SpringVerify.
Schedule a demo

Frequently Asked Questions

What about DPDP compliance?
ExpandCollapse
DPDP built into the platform: Explicit consent collected for specific hiring purpose. Data used only for that purpose. Data minimization—collect only role-required information. Purpose limitation enforced. Retention policies defined and auto-enforced. Deletion requests processed within 30 days. Breach notification (72 hours) available. Audit trails show access and usage. Compliant by design, not by manual effort.
How do you prevent hiring bias?
ExpandCollapse
Standardized verification criteria applied uniformly to all candidates for the same role. Same checks, same order, same standards across all locations. No subjective judgment in the verification process. Hiring managers cannot override standards. Decision documentation shows criteria applied consistently. Fair hiring process documented at every step. Defensible decisions in any legal challenge.
How long do you retain verification records?
ExpandCollapse
You define retention policy (typically 3-7 years per industry standard). SpringVerify auto-retains records per your policy. After retention period, secure deletion includes deletion certificates. GDPR and DPDP compliant data management. No manual tracking of retention timelines.
What if a candidate disputes a verification finding?
ExpandCollapse
Candidate has 30 days to dispute. Dispute submitted through portal. You investigate with additional documentation from candidate. Findings updated if corrected. Re-export updated report. All dispute resolution logged and traceable. Complete documentation for compliance audits.
How do you handle regulatory changes?
ExpandCollapse
We monitor regulatory changes and notify you. You define location-specific compliance rules. When regulations change, we help you update rules. New hires automatically get new requirements. Historical hires protected under rules in effect at time of hire. Compliance stays current without audit gaps.
Can we customize verification checks per role or location?
ExpandCollapse
Absolutely. Define tiered verification profiles: full for permanent hires, lighter for interns, specific checks for sensitive roles (finance, compliance, healthcare). Apply profiles per location, role, or hire type. Automate which profile triggers based on role level. Customize without compromising compliance.
Can we run re-verification on existing employees?
ExpandCollapse
Yes. Periodic re-screening or re-verification for promotions, internal transfers, or routine audits. Trigger re-verification automatically on role change. Manual re-verification on request. Same DPDP compliance applies. Internal mobility stays compliant.
What does weak security at a verification provider risk for us?
ExpandCollapse
Up to ₹250 crore. That is the maximum DPDP penalty for a Data Fiduciary that fails to take reasonable security safeguards, and the duty covers data your processor holds for you. SpringVerify is ISO/IEC 27001:2022 and SOC 2 Type II certified.
Can a candidate ask what data we hold about them?
ExpandCollapse
Yes. Section 11 lets them ask for a summary of their data, how it was processed and which fiduciaries and processors received it. SpringVerify keeps each candidate's checks, results and access history in one record, ready to share.
Do we need a contract with our verification provider?
ExpandCollapse
Yes. Section 8(2) allows a Data Processor only under a valid contract, and Rule 6 expects it to cover security safeguards. Ask for both in your SpringVerify agreement.