Yes, for a stated purpose, but the checks usually belong with the contractor. The Digital Personal Data Protection Act 2023 lets an employer process personal data for employment purposes without consent, and the contractor is the contract worker's employer. A site running its own checks needs consent and a notice, and whoever holds the results must secure them, use them only for that purpose, and erase them when it ends.
On what basis a check can be run
Consent, or a legitimate use the Act names. Section 4 allows personal data to be processed only for a lawful purpose, either with the person's consent or for one of the "certain legitimate uses" in section 7. Section 7(i) covers processing "for the purposes of employment or those related to safeguarding the employer from loss or liability", which is the basis an employer would use for pre-employment and identity checks.
For contract labour, the employer is the contractor. A site that wants to run its own check on a contractor's worker is not obviously the employer that section 7(i) describes, so the safer basis for the site is consent, given after a notice under section 5 that says what data is collected, why, how to withdraw consent and how to complain to the Data Protection Board. Consent must be "free, specific, informed, unconditional and unambiguous" (s.6(1)). Which basis fits a given arrangement is a question for the site's counsel.
When the Act applies, and from when
To personal data collected digitally, or collected on paper and digitised later (s.3(a)). A scanned ID card, a photo of a verification report on a supervisor's phone and an entry in a gate-access system are all in scope. A paper file that is never digitised is not, though few sites keep one for long.
The Digital Personal Data Protection Rules 2025 were notified on 13 November 2025 with staggered commencement, and the main obligations on data fiduciaries apply from 13 May 2027 [VERIFY: commencement notification under s.1(2) and the Rules' commencement clause; dates taken from secondary sources]. A site setting up a screening process now is setting it up for that regime.
What the Act requires of whoever holds the data
| Duty | What it means for screening | Section |
|---|---|---|
| Accuracy | Data used to decide whether someone is deployed must be complete, accurate and consistent | s.8(3) |
| Security | Reasonable safeguards against a breach, including for data held by a processor on the fiduciary's behalf | s.8(5) |
| Breach notice | The Data Protection Board and each affected person told of a breach; the Rules set a 72-hour window for the full report [VERIFY: DPDP Rules 2025, r.7] | s.8(6) |
| Erasure | Data erased once the purpose is served, unless a law requires it to be kept | s.8(7) |
| Processors | Anyone processing on the fiduciary's behalf, such as a verification agency, engaged only under a valid contract | s.8(2) |
| Grievances | A contact who answers questions about the processing, and a way to redress complaints | s.8(9)–(10) |
The erasure duty meets labour law at the records. The OSH (Central) Rules 2026 require registers and records to be kept for five years from the last entry (r.72(1)(vii)), so data the Codes require is retained for that period; a screening result the Codes do not require has no such cover.
Which checks have a reason behind them
The ones the law or the role requires, and the Codes require fewer than most sites assume. Age has to be established before a worker starts, because the OSH Code restricts the work adolescents can do. An Aadhaar-seeded UAN is needed for provident fund, and ESIC registration needs identity details; both are covered in our post on what to verify before a worker starts. Police verification is required by specific rules for specific roles, such as the crèche staff covered in our crèche post, but not by the Codes for a factory or warehouse worker in general [VERIFY: no general requirement under the Labour Codes].
A check that answers no stated purpose is the hardest to defend under the Act, because section 5 makes the purpose part of the notice and section 8(7) ends retention when the purpose is served. Every check on the list should be able to say what it is for.
How to split it between site and contractor
- The contractor collects and holds. Identity documents, verification reports and screening results stay with the employer that has the employment basis to process them.
- The site sees what it needs. Name, photograph, a masked ID number, the role and a verified or not-verified status for gate access, not copies of the documents.
- A written purpose list. Each check named against its reason, agreed between site and contractor before the first deployment.
- A data clause in the contract. Who is the fiduciary for what, security expectations, breach reporting between the two within hours, and erasure when the worker leaves the site.
- No documents on personal phones. ID photos shared on messaging apps are the most common breach on a site and the hardest to erase.
How Velura Services helps
We run identity, age and reference checks at Screening, for a stated purpose and with the worker's consent, and keep the data on our side. Your site sees the outcome it needs to admit a worker, not the full personal file, and the data is used only for the purpose it was collected for.
Sources
- The Digital Personal Data Protection Act, 2023 (Act 22 of 2023), Gazette of India Extraordinary, 11 August 2023, copy hosted by TRAI — s.3 (application to digital and digitised data), s.4 (grounds), s.5 (notice), s.6(1) (consent), s.7(i) (employment as a legitimate use), s.8 (obligations of Data Fiduciary), Schedule (penalties). Opened and read.
- Digital Personal Data Protection Rules, 2025, notified 13 November 2025 — staggered commencement; r.7 (breach intimation within 72 hours). Not opened; dates and the 72-hour figure taken from secondary sources [VERIFY: against the e-Gazette notification].
- Occupational Safety, Health and Working Conditions (Central) Rules, 2026, G.S.R. 345(E) dated 8 May 2026 — r.72(1)(vii) (records preserved for five years). Opened and read from a mirrored copy of the Gazette [VERIFY: against the e-Gazette original].