From documents to credentials: Rebuilding trust in hiring under DPDP

Hiring has become faster almost everywhere except one place: verification. Organisations can screen thousands of résumés using technology, conduct interviews virtually, generate offers digitally and onboard employees through integrated platforms. Yet confirming whether someone worked at an organisation several years ago can still involve emails, PDFs, payslips, phone calls and repeated follow-ups.

That contradiction set the context for a recent roundtable, held in partnership with OnGrid, on “Hiring in the Age of DPDP: The Employment Credential Imperative.”

Bringing together senior HR and talent leaders, the discussion examined how data protection is forcing organisations to rethink not only compliance, but the architecture of employment verification itself.

Rethinking employment verification

Setting the context, Manav Jain, Chief Business Officer, OnGrid, argued that employment verification remains one of the most fragmented parts of hiring. While identity and, increasingly, education verification can draw on digital infrastructure, employment records remain spread across individual employers, HR systems, emails and verification agencies.

A new employer may have to identify the right contact at a previous organisation, send information over email, follow up repeatedly and wait days or weeks for a response. Even then, information may arrive in different formats or from people who are not necessarily authorised to respond. The challenge, Jain argued, is therefore not simply one of speed, but of trust, traceability and control.

OnGrid’s proposition is to move towards verified digital employment credentials: records issued by the organisation that owns the employment data and later verified by another authorised organisation with the individual’s consent.

Jain positioned employment as one of the weaker links in the verification ecosystem. While identity and educational credentials are becoming increasingly digitised, employment continues to depend heavily on organisation-to-organisation verification.

He also stressed that consent must be purpose-specific. If consent is taken for employment verification, information should be processed for that purpose rather than treated as an unrestricted approval.

Digitising Trust

Taking over the moderated discussion, Devi Prasad Dash, CHRO, Apollo Health and Lifestyle Limited, widened the frame beyond privacy regulation.

At first glance, he noted, DPDP appears to be a conversation about data privacy. But beneath it sits a larger issue: trust in what candidates declare, what employers verify and the systems through which that information moves.

Dash contrasted modern hiring technology with traditional verification practices. Organisations can transfer money instantly, sign documents digitally and screen thousands of résumés using technology. Yet verifying whether someone worked somewhere three years ago can still take repeated reminders.

“We have digitised hiring faster, but we have to digitise the trust,” he observed. That framing shaped the discussion around three issues: why employment verification remains difficult, what DPDP changes about candidate data, and whether employers can eventually create shared trust infrastructure.

Under the Digital Personal Data Protection Act, those roles are clearer than hiring practice often makes them. Candidates and employees are Data Principals: the individuals to whom the personal data relates. Employers are Data Fiduciaries: they decide why and how that data is processed across hiring, employment and verification. 

HR-tech vendors such as HRMS platforms, payroll providers, applicant tracking systems and background-verification (BGV) firms typically act as Data Processors, handling personal data on the employer’s behalf. That distinction matters for consent, purpose limitation and vendor contracts: the employer remains accountable for what is collected and shared, while processors may only process what they are authorised to, for the purpose agreed.

Why employment remains difficult to verify

The first challenge is structural. Participants pointed out that employment information is highly distributed. Different organisations hold different data points, in different systems and formats. Historical records are even harder to standardise.

This creates both friction and mistrust. Leaders questioned who receives candidate information, whether they are authorised to access it and how securely that information moves between organisations.

Participants also cautioned that models designed around corporate employment may not work equally well for shop-floor, field or sales workforces.

A verified credential may establish tenure or employment history, but it cannot automatically answer every qualitative question an employer may have around exits, employment gaps, performance or misconduct.

The takeaway was clear: digital credentials can remove friction from factual verification, but they cannot replace organisational judgment.

From collecting data to questioning why it is needed

One of the strongest parts of the discussion concerned candidates who are never hired. Large organisations can receive thousands of applications each day, leaving enormous volumes of candidate information sitting inside recruitment systems even when those people never become employees.

A participant questioned what happens when hundreds of thousands of historical profiles remain across internal systems and external partners, particularly if candidates later ask for their information to be removed.

Leaders shared approaches involving defined retention periods, automated deletion and clearer agreements with vendors around how long candidate information should remain in their systems.

But the discussion moved further upstream: why collect some of this information at all? Participants pointed to legacy application forms that continue to seek information designed into processes decades ago, even when it has little relevance to hiring.

That brought data minimisation to the centre of the conversation. If a data point is not required for a hiring decision, organisations should question why they collect it. If a verification provider does not require certain information, it should not automatically be transmitted.

As the discussion put it: what is not required should not be collected, and what is not needed should not be passed on.

Can HR build a shared trust network?

The discussion then turned towards a more ambitious possibility: could employers create common infrastructure for employment trust? Participants compared the idea with the ecosystem created around NPCI and UPI, where common standards and infrastructure allow multiple institutions to transact securely.

Could employment verification evolve similarly, with verified credentials moving between systems rather than HR teams repeatedly requesting the same information?

Leaders argued that any shared network would need strong governance, controls over what information is visible and clarity on who can issue and consume credentials. One participant suggested that such infrastructure should be largely “faceless”, exposing only the specific information required rather than entire employee records.

Others stressed that employers may need an authoritative industry or regulatory framework before they are comfortable contributing employment information to a wider ecosystem.

The NPCI analogy therefore offered a broader lesson: shared infrastructure succeeds only when technology, participation and governance evolve together.

More trust with less data

The session closed with a larger shift in perspective. For years, organisations have tried to reduce hiring risk by collecting more: more documents, more data points, more copies and more checks.

The emerging model could move in the opposite direction. Verified credentials can reduce repeated collection. Better consent design can give individuals more visibility into how information is used. Data minimisation can reduce the amount organisations need to protect. Shared standards can make verification faster without allowing personal information to circulate indiscriminately.

Dash described the journey as one from documents to credentials, from data collection to data minimisation, and from employer-controlled records towards greater individual visibility and control.

The future of verification may therefore be defined less by how much information organisations can collect about candidates, and more by whether they can create more trust with less data.