Background Verification in India: Checks and Consent

An employee background check in India usually covers identity, education, past employment, court records and address, with references, licences and other checks added for some roles. The notice and consent duties of the Digital Personal Data Protection Act, 2023 come into force in May 2027, so now is the time to fix how you ask for consent. Checks that depend on post, email and follow-up calls take weeks. Checks on records the candidate already holds, verified at the source, close much faster.

The common checks and what each one confirms

The right package depends on the role: a finance head may need a credit report and references that a campus hire does not. Run only the checks you can tie to the job. The DPDP Act limits consent to the personal data that is necessary for the purpose you state (section 6(1)).

Check	What it confirms	Where the answer comes from
Identity	The candidate is who they say they are	An Aadhaar OTP check, PAN and other identity documents
Education	The degree, institution, year and result are genuine	The university or college that issued it
Employment	Past employers, dates, designation and exit	EPFO service history, TDS records and the past employer's HR
Court records	Whether cases are recorded against the candidate's name	Court case records, searched digitally
Address	The candidate lives where they say they do	Documents, a digital check or a visit
References	How former managers describe the candidate's work	Referees the candidate names
Professional licence	A registration is valid and current	The council or body that grants it
Credit report	Credit history, for roles that handle money	The candidate's own report, which they download and share
Database and watchlist	The name does not appear on regulatory, sanctions or fraud lists	Specialist partners
Drug and medical	Fitness for roles that require it	Labs and clinics, through partners
Digital footprint	Public online conduct that matters for the role	Partners who review public sources

Employment: three sources, three different answers

Each source answers a different question. The EPFO member portal shows a candidate's service history against their UAN: previous employers and the dates of joining and exit (Business Today, August 2026). It only covers employers registered with EPFO. TDS entries in the candidate's annual tax statement fill part of that gap, because they show which employers deducted tax on salary.

Neither record states designation, role or reason for leaving. Only the past employer's HR can confirm those. So a complete employment check matches EPFO and TDS records first, then asks the past employer to confirm the rest.

Credit: the candidate's own report, never a bureau pull

An employer should not pull a candidate's credit report. The candidate can get it directly. Since January 2017, the Reserve Bank of India has required every credit information company to give each individual one free full credit report a calendar year, on request (RBI, September 2016). The candidate downloads it and shares it with you.

Court records: digital, but names need care

The national eCourts service lets anyone look up case status by party name, case number or CNR (eCourts Services). Matching is the hard part: common names return other people's cases, so every hit needs checking against father's name, address or date of birth.

Consent under the DPDP Act and Rules

The Digital Personal Data Protection Act, 2023 (No. 22 of 2023) received the President's assent on 11 August 2023 (Gazette of India). It is coming into force in stages. A notification of 13 November 2025, G.S.R. 843(E), brought the definitions and the Data Protection Board provisions into force at once, and set sections 3 to 5, most of section 6, sections 7 to 17 and the penalty provisions to start eighteen months after publication, which is May 2027 (G.S.R. 843(E)). The Digital Personal Data Protection Rules, 2025 (G.S.R. 846(E)), notified the same day, follow suit: the rules on notice, security, breach intimation and retention also apply after eighteen months (DPDP Rules, 2025, rule 1). Check the Gazette for any later change before you fix internal deadlines.

The Act also covers paper data that is digitised later (section 3), so a scanned marksheet counts. Here is what it asks of an employer running checks:

Notice first. Every request for consent must come with, or after, a notice that says what data you will process, why, how the candidate can withdraw consent and how they can complain to the Board (section 5). The Rules add that the notice must stand on its own and give an itemised description of the data in clear, plain language (rule 3).
Valid consent. Consent must be "free, specific, informed, unconditional and unambiguous", given by a clear affirmative action and limited to the data needed for the stated purpose (section 6(1)).
Easy withdrawal. Withdrawing consent must be as easy as giving it (section 6(4)).
The employment ground is unclear for candidates. Section 7(i) allows some processing without consent "for the purposes of employment". The Act does not say whether this covers a candidate who has not yet joined. Consent with a proper notice is the safer route for pre-hire checks.
You stay responsible for your vendor. The employer is the Data Fiduciary and remains responsible for processing done on its behalf. A Data Processor can only be engaged under a valid contract (section 8(1) and 8(2)).
Accuracy before decisions. Data used to make a decision about the person must be complete, accurate and consistent (section 8(3)).
Security, breaches and erasure. You must take reasonable security safeguards (section 8(5)), tell the Board and each affected person about a breach (section 8(6)), and erase data once the purpose is served unless a law requires you to keep it (section 8(7)). The Rules set a 72-hour window for the detailed breach report to the Board (rule 7) and ask for processing logs to be kept for at least a year (rule 8).

Failing to take reasonable security safeguards can attract a penalty of up to Rs 250 crore. Failing to report a breach can attract up to Rs 200 crore, and other breaches of the Act or Rules up to Rs 50 crore (PIB, November 2025).

Why traditional checks take weeks

A background check closes only when its slowest component does, and in a manual process each component waits on someone outside your company.

Education. Some universities still verify degrees on written request, by post. Pondicherry University says its genuineness verification "may take 15 working days". It asks for a request letter from the organisation and a stamped, self-addressed envelope (Pondicherry University). HNB Garhwal University says the process takes a minimum of three weeks from receipt of a complete application (HNB Garhwal University, 2025). SNDT Women's University states a usual processing time of 15 working days (SNDT Women's University). If papers or fees are incomplete, the clock starts only once they are complete.

Employment. Past-employer checks run on email. The request lands in a shared HR inbox and often needs reminders. If the HR contact has moved on or the company has closed, the case stalls.

Court records and address. Name searches throw up namesakes that someone must review by hand. Physical address visits depend on someone being at home.

Meanwhile the candidate has often joined, and a discrepancy found in week four is harder to act on.

How candidate-held, source-verified records shorten this

The fix is to verify each record once, at its source, and let the person hold it. In ADi Wallet, candidates fetch their records from the source with their consent: identity through an Aadhaar OTP, and EPFO and TDS records. Universities and colleges issue degrees into the wallet in the NAD standard format. Employers issue offer, experience and relieving letters the same way. Issued records are anchored on Hyperledger and are tamper-evident: any change to an issued certificate makes its QR check fail.

When you start a check on Checkkbox, the candidate approves the share from their phone, and you receive results, not document copies. Identity, education and EPFO/TDS employment checks close in under 15 minutes when the candidate's records are on the network. Past-employer confirmation takes as long as their HR takes to reply. That HR team confirms designation, dates and exit on a secure link and signs by typing their name. The confirmation is accepted only when the signer's email domain matches the employer's domain, and the response is time-stamped and logged. Court record checks are digital and usually return within 15 minutes.

This model also fits the DPDP Act. Each share is a specific consent for a stated purpose, recorded with its date, and the candidate can see and withdraw it. For Aadhaar, only the last 4 digits, the verified name, and the date and result of each verification are kept, and Aadhaar is re-validated with a fresh OTP the candidate enters on each request. Our security page sets out how data is encrypted in transit and at rest.

A practical checklist for HR and TA teams

Map checks to roles. Drop any check you cannot justify for the role.
Write a standalone notice. List each data item, the purpose of each check, who will see the results, and how to withdraw consent or complain to the Board. Offer it in English or a language in the Eighth Schedule of the Constitution (section 5(3)).
Take consent per check. Use a clear action, such as a tick or an approval in an app, and keep a time-stamped record. Do not bundle it into offer-letter terms.
Ask for candidate-held records first. EPFO and TDS records, degrees in the NAD standard format and the candidate's own credit report reduce the number of outside requests.
Tell candidates when checks run. State whether checks happen before the offer, after it or after joining, and what happens if a check fails.
Review vendor contracts. Cover security, sub-processors, deletion, and breach reporting fast enough for you to meet the 72-hour Board report.
Handle discrepancies fairly. Confirm court-record hits against more than a name, and give the candidate a chance to explain before you decide.
Set retention rules. Erase check data once the purpose is served, keep processing logs for a year, and record any legal reason to keep more.
Limit access to the people who make the hiring decision, and never store full Aadhaar numbers.
Track turnaround by check type, so you can fix the slowest step first.
Put May 2027 on the compliance calendar, and recheck the Gazette before then.

If you want to see a check run on records that are already verified, book a demo and we will walk your team through the full flow.

Employee background verification in India: checks, consent and timelines

The common checks and what each one confirms

Employment: three sources, three different answers

Credit: the candidate's own report, never a bureau pull

Court records: digital, but names need care

Consent under the DPDP Act and Rules

Why traditional checks take weeks

How candidate-held, source-verified records shorten this

A practical checklist for HR and TA teams

Sources

More guides

Fake degrees in India: how universities can issue tamper-evident certificates

How to verify a degree certificate in India