# Candidate data and consent (DPDP-aware)

*Practical guidance, not legal advice. Check the current law and rules for your situation.*

## The law in brief
- The **Digital Personal Data Protection Act, 2023** (Act No. 22 of 2023, 11 Aug 2023)
  governs digital personal data in India
  ([MeitY PDF](https://www.meity.gov.in/static/uploads/2024/02/Digital-Personal-Data-Protection-Act-2023.pdf);
  [India Code](https://www.indiacode.nic.in/handle/123456789/22037?locale=en)).
- The **DPDP Rules, 2025** were notified in November 2025, with an **18-month
  phased compliance timeline**. PIB lists the core principles as consent and
  transparency, purpose limitation, data minimisation, accuracy, storage
  limitation, security safeguards and accountability
  ([PIB](https://www.pib.gov.in/PressReleasePage.aspx?PRID=2190014);
  [MeitY: DPDP Rules 2025](https://www.meity.gov.in/documents/act-and-policies/digital-personal-data-protection-rules-2025-gDOxUjMtQWa?pageTitle=Digital-Personal-Data-Protection-Rules-2025.pdf)).
- Under Rule 3, a consent notice must stand on its own and, in clear and plain
  language, give at least an itemised description of the personal data and the
  specified purpose. It must give a link and other means to **withdraw consent as
  easily as it was given**, exercise rights under the Act, and complain to the Data
  Protection Board ([MeitY explanatory note](https://www.meity.gov.in/writereaddata/files/Explanatory-Note-DPDP-Rules-2025.pdf)).
- **Section 5 (notice)** of the Act: every request for consent must be accompanied
  or preceded by a notice that tells the person (i) the personal data and the
  purpose it will be processed for, (ii) how to exercise the rights under
  section 6(4) (withdrawal) and section 13 (grievance redressal), and (iii) how to
  complain to the Data Protection Board. Section 5(3) requires the option to read
  the notice in English or a language in the Eighth Schedule to the Constitution
  ([MeitY PDF](https://www.meity.gov.in/static/uploads/2024/02/Digital-Personal-Data-Protection-Act-2023.pdf);
  [India Code](https://www.indiacode.nic.in/handle/123456789/22037?locale=en)).
- **Section 6 (consent)**: consent must be free, specific, informed, unconditional
  and unambiguous, with a clear affirmative action, and limited to the personal
  data necessary for the specified purpose (s.6(1)). The request must be in clear
  and plain language, with the English / Eighth Schedule language option and the
  contact details of a person who responds on the person's rights (s.6(3)).
  Consent can be withdrawn at any time, as easily as it was given (s.6(4)).
- **NEST recommendation (R7):** use an unticked consent box after the notice,
  keep optional follow-up consent separate, and map each notice element to the
  section it meets. `templates/consent-notice.md` does this.
- Even where a provision has not yet come into force for you, follow these
  practices now. They are what candidates expect.

## Rules for a job fair
1. **Collect only what the jobs need.** Name, phone, optional email, district or
   locality, highest qualification, trade or stream, years of experience,
   preferred zones or job families, location limits, and accessibility needs
   (optional). That's usually enough.
2. **Do not collect** Aadhaar numbers or copies at registration, caste, religion,
   political affiliation, voter ID or constituency, family income, or photos,
   unless a specific employer role legally requires something. Even then, collect
   it at the employer's stage, with separate consent.
3. **No political questions, ever.** Not on forms, at desks or in follow-up calls.
4. **Purpose-bound sharing.** Share a candidate's details only with the
   employers or zones that candidate chose. Never sell or give the full list to
   anyone.
5. **Retention.** State a deletion or anonymisation date in the notice (for
   example "90 days after the fair, or 30 days after your last follow-up call").
   Keep to it and log it.
6. **Children.** Job fairs are normally for adults. Admit people under 18 only if
   the roles are lawful for them *and* you have a process for verifiable parental
   consent as the Act requires.
7. **Security.** Restrict access to the registration sheet, use strong
   passwords and two-factor login, don't paste data into public groups, and keep
   a record of who accessed or exported it.
8. **Grievances.** Name a contact for data questions and withdrawals in the
   notice, and answer within a stated time.

Template: `templates/consent-notice.md`.