Background Verification Checklist for HR Teams in India

Q: On this page

How to use this checklist1. Before the offer: notice, consent and scope2. Identity3. Education4. Employment5. Court records6. Address7. References8. Professional licence, where the role needs one9. Credit report, where relevant10. Decision and adverse findings11. Record keeping and retentionWhere TheRollNumber fits

A background verification checklist for HR teams in India starts with notice and consent, then covers identity, education, employment, court records and address. References, a professional licence and the candidate's own credit report are added where the role needs them. It ends with fair handling of adverse findings and a retention rule. For each check, this page lists what to collect, where to confirm it and what to file. It prints cleanly from any browser.

How to use this checklist

Work through the sections in order. Tick an item when you hold a confirmation from the source, not a copy from the candidate. A copy shows what the candidate handed over. A confirmation shows what the issuer, employer or register says.

The Digital Personal Data Protection Rules, 2025 were notified in November 2025 with an eighteen-month phased compliance period (PIB, November 2025). The Act's notice, consent and erasure duties and the Rules on notice, security and retention start eighteen months after publication, which is May 2027 (G.S.R. 843(E); DPDP Rules, rule 1).

Fix the checks for each role before you hire for it. Consent must be limited to the personal data necessary for the stated purpose (DPDP Act, section 6(1)). Drop any check you cannot tie to the job.
Write a standalone notice. Rule 3 asks for an itemised description of the data, the purpose, and how the candidate can withdraw consent, use their rights and complain to the Data Protection Board.
Offer the notice in English or a language in the Eighth Schedule to the Constitution (section 5(3)).
Take consent per check with a clear action, such as a tick or an approval in an app, and keep a time-stamped record. Keep it out of the offer-letter terms.
Say when checks run: before the offer, after it or after joining, and what happens if a check fails.
Put any vendor under a valid contract. You stay responsible for processing done on your behalf (section 8(1) and 8(2)).

Role	Core checks	Add where the role needs it
Every hire	Identity, the qualification the role requires, court records	Address
Experienced hires	Employment with recent employers	References
Finance, treasury and cash roles	Credit report shared by the candidate	Database and watchlist
Regulated professions	Professional licence	References
Field, security, driving and home-visit roles	Address	Police verification, drug and medical

Treat the table as a starting point. Your sector regulator or client contracts may require more.

CheckkboxEvery hiring check in one caseIdentity, education, employment and court records, run with the candidate’s consent. You receive results, not document copies.See Checkkbox →

2. Identity

Collect the candidate's name as on their ID, date of birth, a photo ID and PAN.
Match name, date of birth and photo across every document. Ask for proof of any change of name.
Do not accept an Aadhaar number or photocopy at face value. Regulation 16C of the Aadhaar (Authentication and Offline Verification) Regulations, 2021 bars accepting an Aadhaar number as proof of identity without first verifying UIDAI's digital signature in the Aadhaar secure QR code. Electronic authentication needs a lawful purpose and the holder's informed consent (UIDAI regulations, as on 15 December 2025).
If you need a copy, ask for a masked Aadhaar, which shows the last 4 digits (UIDAI). Never store a full Aadhaar number.

3. Education

Collect the degree or provisional certificate, the final marksheet, the enrolment or registration number, the year of passing, the college and the awarding university, and a signed authorisation that names the university.
Confirm with the body that awarded the degree. For an affiliated college, that is the university. Under section 22 of the UGC Act, 1956, degrees can be conferred by universities set up by a Central, Provincial or State Act, deemed universities, and institutions an Act of Parliament has specially authorised to grant them.
Take the verification contact from the university's own website, usually the Controller of Examinations or the Registrar. Never use an email address, phone number or portal link the candidate supplies.
Check the institution against UGC's list of fake universities, which names 32 institutions as on February 2026. Absence from the list proves nothing by itself.
For a distance or online degree, check the UGC Distance Education Bureau's recognition status for the session the candidate enrolled in. UGC publishes it year-wise and session-wise (UGC public notice, September 2025).
If the certificate was issued on Dygital.degree, scan its QR code: it checks the certificate against the issuer's own record at once, and the result is what you file. For any other QR code, check that it opens a domain the university controls and that every field matches the paper.
File the university's written reply, from an official domain or portal, with its date.

4. Employment

Collect the employers and dates on the CV, offer and relieving letters, and the candidate's UAN.
Ask the candidate to share their EPFO service history. The Unified Member Portal shows the employers linked to a UAN, with dates of joining and exit (Business Today, August 2026).
Ask for the candidate's Annual Information Statement from the income tax e-filing portal. Part B shows tax deducted at source (Income Tax Department). It helps with employers that are not on EPFO.
Neither record shows designation or reason for leaving. Ask the past employer's HR to confirm designation, dates and exit.
Send the request to an address on the employer's own domain, and accept the reply from that domain.
Ask about gaps and overlapping dates before drawing a conclusion, and agree with the candidate before you contact a current employer.
File each confirmation with the sender's name, email address and date.

5. Court records

Collect the full name, father's name, date of birth and each address in the period you check.
Search the eCourts services portal by party name in the districts where the candidate lived and worked. It also searches by case number and CNR.
Match each hit on father's name, address or age before you treat it as the candidate's. Common names return other people's cases.
Record the case type, stage and outcome. A pending case is an allegation, not a finding.

6. Address

Collect current and permanent addresses, the period of stay at each and one proof of address.
Confirm by a digital check, a document match or a visit, depending on the role.
For a visit, record the date and who confirmed the address.
Where the role calls for police verification, it can be done online where the state police offer it, or offline. Don't promise the hiring manager a date for it.

7. References

Ask for two referees, at least one a former manager, with work email addresses.
Confirm each referee worked where they say, through an official email domain.
Ask every referee the same factual questions: role, time worked together, reporting line and whether they would work with the candidate again. Note the answers, the name and the date.

8. Professional licence, where the role needs one

Collect the registration number, the council and the state of registration.
Check the number on the council's own register and match the name and qualification:
- doctors: the Indian Medical Register on the National Medical Commission's website, and the state medical council;
- nurses: the Indian Nursing Council's Nurses Registration and Tracking System, which it describes as a live register of nurses;
- chartered accountants: the ICAI members database, searchable by membership number.
Note whether the registration is current, and recheck it at renewal.

9. Credit report, where relevant

Ask for it in roles that handle money, credit decisions or financial risk, and in no others.
The candidate downloads their own report and shares it with you. The Reserve Bank of India requires credit information companies to give individuals one free full credit report, with credit score, once every calendar year on request (RBI, September 2016).
Never request a candidate's report from a credit bureau yourself.

10. Decision and adverse findings

Before you act on a finding, make sure it is complete, accurate and consistent. The DPDP Act requires this when data is used to make a decision about the person (section 8(3)).
Tell the candidate what you found and where it came from.
Give them a fixed, reasonable period to explain or correct it in writing. They have a right to have inaccurate or incomplete data corrected (section 12).
If they dispute it, go back to the source.
Decide on relevance to the role, not on the hit alone. Record the reason and who decided, and tell the candidate the outcome.

11. Record keeping and retention

Record	What to keep	Rule to apply
Notice and consent	The notice version shown, the consent and its time stamp	Keep with the check file
Results and confirmations	Each result, its source and date	Erase once the purpose is served, unless a law requires you to keep it (section 8(7))
Processing and access logs	Who accessed which record, and when	Keep for at least a year (rules 6(1)(e) and 8(3))
Document copies	As few as possible; results instead	Same rules as the data they contain

Rule 8(3) also asks you to keep personal data and processing logs for at least one year from the date of processing, then erase them unless another law needs longer. Set your retention period with your legal team.
Make your vendor erase what you shared with it when you erase your own copy (section 8(7)(b)).
Limit access to the people who make the hiring decision.
Publish how long you take to answer candidates' grievances. The Rules cap it at ninety days (rule 14(3)).

Where TheRollNumber fits

On Checkkbox, employers and verification agencies run checks including identity, education, employment, court records, address, references, professional licence and the credit report shared by the candidate, with database and watchlist, drug and medical, and digital footprint checks through partners. The candidate approves each share from ADi Wallet, and you receive results, not document copies.

Identity, education and EPFO/TDS employment checks close in under 15 minutes when the candidate's records are on the network. Past-employer confirmation takes as long as their HR takes to reply. Each response is time-stamped and logged. Court record checks are digital and usually return within 15 minutes. Our security page explains how data is encrypted in transit and at rest.

Degrees issued on Dygital.degree are in the NAD standard format, signed by the Registrar, Controller of Examinations and Vice-Chancellor, and anchored on Hyperledger, so the education line of this checklist can close the moment the candidate shares the certificate. More than 20 universities and colleges issue on Dygital.degree, and more than 150 verification agencies verify academic records on Checkkbox (Company data, Oct 2026).

To see this checklist run as one flow, from notice and consent to the final report, book a demo and we will walk your team through it.

Background verification checklist for HR teams in India: what to check for every hire