Consent, Retention & Transfer of People Data

A candidate finishes an online hiring form at 11:40 p.m. - résumé, PAN, address proof, salary history, assessment score, background-check consent, and maybe disability or medical information. By morning, that data may sit inside an ATS, a cloud HRMS, a background verification vendor, a recruiter spreadsheet and a hiring manager's inbox.

That is where privacy becomes operational. Consent, retention and transfer are not legal fine print - they decide whether people data is collected fairly, stored only as long as needed, and shared without losing control.

Big Picture: People Data Moves Through a Narrowing Trust Funnel

People data starts broad and messy - every form field, document upload and system log. Good privacy governance narrows it into only what is necessary, retained and shared under control.

The core idea: people data should have a purpose, an owner, a time limit and a transfer trail. If any one of these is missing, the organisation cannot confidently answer basic questions such as “Why do we have this?”, “Who has it?”, “Where did it go?” and “When will it be deleted?”

Core Explanation: The Three Controls That Matter

Consent, retention and transfer are three connected controls in the people-data lifecycle.

1. Consent - Permission With Purpose

Consent is the person's informed agreement to a specific processing purpose. In HR, consent may be used for background verification, reference checks, assessment data, optional diversity disclosures, relocation support or sharing a candidate profile with group companies.

Good consent has five qualities:

Important nuance: in employment, consent can be tricky because the employee may feel they cannot refuse. That is why organisations should not rely on consent for every HR process. Some processing may rest on law, contract, payroll, tax compliance, workplace safety or employment-related legitimate uses, depending on the jurisdiction.

2. Retention - A Time Limit for Trust

Retention means defining how long each data category is kept, why it is kept, and what happens after the period ends. A résumé rejected for one role, payroll records, harassment inquiry files and exit documents should not all have the same retention period.

A practical retention schedule usually separates:

3. Transfer - Sharing Without Losing Control

Transfer is any movement of people data to another party or jurisdiction - for example, from the employer to an HRMS vendor, a background verification agency, a payroll processor, a benefits provider, a group company or a cloud data centre outside India.

Transfers are risky because control becomes indirect. The organisation must check whether the recipient is allowed to process the data, whether the purpose is limited, whether security obligations are contractually imposed, and whether cross-border rules apply.

The Operating Framework: Map, Minimise, Control, Delete

Use this six-step framework whenever you are asked to design a privacy-safe HR process.

Definitions You Must Say Cleanly

India Lens: What DPDP Changes for HR and Candidate Data

India's Digital Personal Data Protection Act, 2023 makes privacy a board-level operating issue for HR, recruitment, payroll and employee platforms. In a typical Indian company, the employer is the Data Fiduciary; the ATS, HRMS, payroll platform and background verification vendor are processors working on its behalf.

For people data, the practical implications are:

Metrics: How to Track Whether Privacy Is Working

Privacy governance becomes credible when it is measured. These are the metrics a CHRO, compliance head or HR operations manager should track.

Do not overclaim legal compliance from metrics alone. A dashboard helps detect weak controls; it does not replace legal review, privacy impact assessment or vendor due diligence.

Case Study: Workday and the Privacy Architecture Behind Global HR Cloud

Situation. Large employers use cloud HR systems to manage employee profiles, payroll-related fields, performance, compensation, absence, recruiting and analytics. For a multinational company, the same employee record may need to be accessed by HR teams, managers, payroll providers and support teams across jurisdictions.

The move. Workday's privacy proposition is not simply “secure cloud.” It is an architecture of controls: customer-controlled configuration, role-based access, auditability, data-processing terms, sub-processor transparency, international transfer mechanisms and retention or deletion capabilities that customers can align with their policies.

Outcome or lesson. The primary driver of trust is enterprise-grade privacy governance built into the platform. Supporting drivers include security certifications, customer configuration, legal transfer mechanisms, vendor transparency and the ability to evidence controls during audits. The lesson for interviews: in people-data businesses, privacy is not a back-office policy - it is part of the value proposition.

How AI Changes Consent, Retention & Transfer of People Data

AI makes people-data governance harder because HR data is no longer used only for records - it may be used to infer skills, predict attrition, screen candidates, summarise interviews or recommend internal mobility.

• Consent must become more granular. A candidate may agree to share a résumé for a role, but that does not automatically justify using the résumé to train a model or infer personality traits.
• Retention must cover model inputs and outputs. Organisations need rules not only for raw data, but also for AI scores, transcripts, embeddings, prompts and decision explanations.
• Transfer risk expands to AI vendors. If HR teams paste candidate data into external AI tools, the data may move to a third-party processor or another jurisdiction without a contract or audit trail.

Interview Relevance

Common Mistake