At a glance
No — calling a candidate’s previous employer without their consent skips the consent step the DPDP Act expects before that kind of third-party check, even if the practice is common and rarely challenged. The safer sequence: get specific consent naming reference checks, then contact the previous employer. If a third-party background-verification (BGV) agency runs the check instead, that agency is a Data Processor acting on the employer’s instructions — meaning a written contract covering what it can do with candidate data, not a handshake vendor relationship.
Educational resource only. This explains the consent expectation under India’s Digital Personal Data Protection Act, 2023 (DPDP Act) for employer reference checks and the processor relationship with third-party BGV agencies; it is not formal legal advice.
The situation
“We always call the last employer” is close to a universal HR habit, done as due diligence rather than as a data-processing decision. Reframed as a question under the DPDP Act, it’s exactly that: contacting a third party to discuss a named individual’s employment history is processing their personal data, and it needs the same basis — consent, specifically for this step — as any other collection.
Does a reference check need the candidate’s consent?
Yes, as a specific, named part of the background-verification consent — not an assumed extension of applying for the job. A candidate applying for a role hasn’t, by that act alone, agreed to have a named previous manager contacted about their performance or conduct. That consent should be captured explicitly as part of the broader background-check consent (covered in the companion guide), naming reference checks specifically rather than folding them into a vague “verification” line.
What changes when a BGV agency runs the check
A third-party BGV agency doesn’t remove the employer’s responsibility under the DPDP Act — it adds a processor relationship on top of it. When an employer outsources verification to a specialist agency instead of calling references directly, the agency is processing candidate data on the employer’s instructions — making it a Data Processor under the Act, and the employer the Data Fiduciary who remains answerable for how that data is handled. The candidate’s consent still has to cover what the agency will check and who it may contact; the employer can’t point to the agency as if outsourcing the check also outsources the accountability.
What the employer-BGV agreement should cover
A written agreement with the BGV agency is the mechanism that makes the processor relationship real, not just theoretical. At minimum, it should set out:
- What the agency is authorised to check and contact, matching what the candidate actually consented to — not a broader mandate than the consent covers.
- How long the agency retains candidate data, and that it deletes it once the engagement (and any employer-specified retention) ends.
- Security expectations for how the agency stores and transmits the reports it produces.
- What happens on a candidate’s rights request — the employer needs the agency to cooperate if a candidate asks to see or correct what was checked.
Common mistakes in the reference-check process
- Treating “we’re doing a background check” consent as covering reference calls specifically — it should be named, not implied.
- No written contract with the BGV agency — a purchase order or an email thread isn’t the same as a processor agreement.
- The agency checking more than the role or the consent covers — scope creep that’s easy to miss when the check is outsourced.
- No retention or deletion clause with the agency, leaving candidate reports sitting in a third party’s system indefinitely.
When a reference is negative or the candidate disputes it
A reference is someone else’s opinion, not a verifiable fact the way an employment date or degree is — which changes what “correcting” it actually means. Where a background check’s factual findings (dates, qualifications, criminal record) are wrong, the DPDP Act’s correction right has a clear application: the record is either accurate or it isn’t. A negative reference is different — a previous manager’s characterisation of a candidate’s performance or conduct is an opinion, and the candidate disputing it doesn’t automatically mean the employer must “correct” the reference itself, since there’s no single accurate version to correct it to. What the candidate can reasonably expect: knowing that a negative reference was received (in general terms, without necessarily disclosing the referee’s exact wording if that risks the referee’s own confidentiality), and a chance to respond or provide context before it’s treated as decisive. An employer that rejects a candidate solely on one negative reference, with no opportunity for the candidate to address it, is on weaker ground than one that treats the reference as one input among several and gives the candidate a fair hearing.
FAQ
Can a candidate demand a negative reference be changed or removed?
Not in the same way as a factual error — a reference is an opinion, not a verifiable fact, so there’s no single “correct” version to substitute. What the candidate can reasonably expect is to know a negative reference was received and to have a chance to respond before it’s treated as final.
Is it illegal to call a candidate’s previous employer without their consent?
It’s not framed as a specific criminal prohibition, but it skips the consent basis the DPDP Act expects for this kind of third-party contact — a genuine compliance gap, not a technicality.
Does outsourcing background checks to an agency reduce the employer’s responsibility?
No — the agency becomes a Data Processor acting on the employer’s instructions; the employer, as Data Fiduciary, remains responsible for how the candidate’s data is ultimately handled.
What should a candidate’s consent for reference checks actually say?
It should name reference checks specifically — who might be contacted (previous employers) and what will be discussed (employment history, conduct) — rather than a generic “background verification” line that doesn’t spell this out.
Does the BGV agency need its own separate consent from the candidate?
The employer’s consent from the candidate should be broad enough to cover the agency acting on its behalf; what the agency additionally needs is a written agreement with the employer defining the scope of what it’s authorised to do.