All questions

Data protection

i Requirements for registration

There is no requirement for an employer to register with a data protection agency or other government body.

ii Sensitive personal data or information

An employer has an obligation to ensure that any sensitive personal data or information (SPI) that it collects from an employee is kept secure and confidential. From an employer's perspective, employee SPI would include personal details such as financial information (bank account or credit card details), medical records and biometric information. The employer may either contractually provide for safety norms dealing with SPI or would need to follow the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules 2011 in relation to the same. Thus, companies are increasingly contracting out the safety and security measures applicable to an employee's SPI, which is held by the company in accordance with its data protection and privacy policy.

iii Background checks

Background checks are a common feature that employers in India generally follow before hiring anyone, and successful completion of these checks is a precondition to employment (and continuing employment) with the company. Often, employers retain the right to conduct background checks on existing employees in case it is required for business purposes.

There is no prohibition on conducting background checks on employees, including candidates, provided their consent for this has been obtained. Background checks could include verifications on education, criminal history, credit rating, etc. The most common background check is of academic credentials, which is typically outsourced by an employer.

Criminal verifications are becoming somewhat common in India, though it is not an easy process as criminal records are not digitised or consolidated centrally.

Under current Indian credit rating structures, an individual can obtain information on his or her credit rating. An employer can also access this information with the employee's permission and on providing necessary proof of identity. Access to credit rating information is more common in banks and financial institutions.