---
title: "Employers, job portals and job offers: your rights and how to complain"
description: "What your employer can collect, fake job offers, and job portal data. Plain steps, helplines and templates."
url: "https://dpdpr.in/rights/employers-jobs/"
canonical: "https://dpdpr.in/rights/employers-jobs/"
site: "dpdpr.in"
updated: "2026-11-02"
disclaimer: "Independent reference, not legal advice. Not affiliated with the Government of India or MeitY."
---

# Employers, job portals and job offers: your rights and how to complain

Plain-language help for ordinary people. General information, not legal advice. Helplines, portals and screen names were checked against official Government and regulator pages on 1 November 2026. Portals change: if a screen looks different, follow the words on the screen and the official guide linked in each step.

## What data they hold

- Your CV, ID, address, bank and tax details.
- Background check results, attendance and sometimes device or location logs.
- On job portals: your profile, CV, salary and contact details, which recruiters can see.

## Your rights under current law

- Until 13 May 2027, a company that collects sensitive data (bank details, medical records, biometrics) must take your written consent first (SPDI Rules, rule 5) and must not share it with others without permission (rule 6).
- Job portals are intermediaries under the IT Rules, 2021. Their grievance officer must acknowledge within 24 hours and resolve within 7 days.
- Fake job offers that ask for fees are fraud. Report them on Chakshu (category: online job, lottery, gifts, loan offers) and, if money was paid, on 1930.
- For jobs abroad, only registered recruiting agents may recruit. Check them on eMigrate.

## Your DPDP rights once in force

Sections 11 to 14 of the DPDP Act (your rights) and the duties of companies in sections 4 to 10 start on **13 May 2027** (G.S.R. 843(E)). Until then, use the sector rules on this page. After that date you can use both.

Section 7(i) lets an employer use your data without fresh consent for employment purposes and to protect itself from loss or liability. So the access and correction rights in sections 11 and 12 may not reach all of this data. But the employer must still keep it accurate, protect it and report breaches (section 8). Job portals rely on your consent, so from 13 May 2027 you can ask them what they hold, who saw it, and to erase it.

- Access: a summary of your data and who it was shared with ([section 11](https://dpdpr.in/act/section-11/)).
- Correction, completion, updating and erasure ([section 12](https://dpdpr.in/act/section-12/)).
- Grievance redressal by the company, before going to the Board ([section 13](https://dpdpr.in/act/section-13/)).
- Nominate someone to act after your death or incapacity ([section 14](https://dpdpr.in/act/section-14/)).
- Withdraw consent, as easily as you gave it ([section 6(4)](https://dpdpr.in/act/section-6/)).

## Common problems

- An employer asks for far more than the job needs, such as family medical history or social media passwords.
- Your CV is shared with companies you never applied to.
- Calls offering jobs for a 'registration fee'.
- Fake overseas job offers.

## Evidence to keep

- The form or email asking for the data.
- Offer letters and the agent's licence number.
- Payment receipts for any fee paid.
- Your complaint to the portal and its ticket number.

See the full [evidence checklist](https://dpdpr.in/rights/evidence-checklist/).

## How to approach, step by step

Go in this order. Start with the company. Move to the next step only when the time limit has passed or the reply is not good enough. If money was lost or you were threatened, go to 1930 or the police first.

### Write to the company's grievance officer

Most apps and websites must name a grievance officer. E-commerce sites, ride apps and platforms such as job portals, dating and matrimony apps all have one under the rules that apply to them.

**Keep this ready before you start:**

- Your account ID, registered mobile or email, and order or booking number.
- Screenshots and dates.
- What you want: delete my data, stop calls, refund, remove a profile.

1. Open the app or website. Look for **Grievance Officer**, **Contact us** or **Privacy policy**. The officer's name and contact must be shown there.
2. Write a short complaint. Use the template on this page.
3. Attach screenshots.
4. Send it. Save the acknowledgement or ticket number and the date.
5. Wait for the time limit for that kind of company (shown in the time limits on this page).
6. If there is no reply, send one reminder with your ticket number.
7. Then go to the next step on this page.

Checked on 1 November 2026 against: [National Consumer Helpline FAQ: Consumer Protection (E-Commerce) Rules, 2020](https://consumerhelpline.gov.in/faq-details.php?fid=E-Commerce), [IT (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, as amended up to 10 February 2026](https://www.meity.gov.in/documents/act-and-policies/information-technology-intermediary-guidelines-and-digital-media-ethics-code-rules-2021-it-rules-2021-IjM5QjMtQWa).

### Complain to the app or platform, then the Grievance Appellate Committee

Social media and other online platforms must publish the name and contact of a Grievance Officer. The IT Rules, 2021 (as amended on 10 February 2026) set short time limits.

**Keep this ready before you start:**

- Links (URLs) to the post, profile or account.
- Screenshots with date and time.
- Your own account name, and the complaint number from the platform.

1. Find the platform's Grievance Officer. The rules require the name, contact and complaint method to be shown on the website or app, usually under Help, Legal or Grievance.
2. Send your complaint there. Attach links and screenshots.
3. The Grievance Officer must acknowledge it within 24 hours and resolve it within 7 days.
4. For a request to remove content such as impersonation, privacy invasion or harassment, the limit is 36 hours.
5. For content that shows your private body parts, nudity, sexual acts, or impersonates you (including morphed images), the platform must act within 2 hours of your complaint.
6. If you are not satisfied, or get no reply within 30 days, appeal to the Grievance Appellate Committee within 30 days.
7. Open [gac.gov.in](https://gac.gov.in). Click **Appellant Login (File appeal / View status)**.
8. Agree to the privacy policy, enter your mobile number and the captcha, then click **Send OTP**.
9. Fill the appeal and upload the Grievance Officer's reply or your complaint proof.
10. The GAC order is uploaded on the site. You get an SMS and email. The platform must publish a compliance report.
11. The GAC does not handle money fraud or cybercrime. For those use 1930 or cybercrime.gov.in.

Checked on 1 November 2026 against: [IT (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, as amended up to 10 February 2026](https://www.meity.gov.in/documents/act-and-policies/information-technology-intermediary-guidelines-and-digital-media-ethics-code-rules-2021-it-rules-2021-IjM5QjMtQWa), [Grievance Appellate Committee (IT Rules, 2021): FAQ](https://gac.gov.in/CMSData/FAQs).

### Check a job abroad offer and complain about a recruiting agent

Fake overseas job offers are common. Only Government registered recruiting agents may recruit for jobs abroad. The Ministry of External Affairs lets you check an agent and complain.

**Keep this ready before you start:**

- The agent's name, licence number and address.
- Offer letter, messages and payment receipts.
- Your passport details, if the agent has them.

1. Ask the agent for its licence number. Write it down.
2. Check it on [emigrate.gov.in](https://emigrate.gov.in/). MEA also publishes a list of registered recruiting agents.
3. Do not pay an unregistered agent. MEA's guidance says a registered agent's service charge cannot be more than Rs 20,000 per worker.
4. If an agent cheated you, lodge a complaint on eMigrate, or write to the Protector General of Emigrants.
5. For help any time, call the Overseas Workers Resource Centre on **1800 11 3090** (24x7, 11 languages).
6. If money was taken by fraud, also call 1930 and file on cybercrime.gov.in.

Checked on 1 November 2026 against: [Ministry of External Affairs: complaints against recruiting agents](https://www.mea.gov.in/complaints-against-recruiting-agents), [Ministry of External Affairs: FAQ for people going abroad for work (eMigrate, OWRC 1800 11 3090)](https://fsi.mea.gov.in/issues-of-intending-emigrants.htm), [eMigrate portal (Ministry of External Affairs)](https://emigrate.gov.in/).

### Report a fraud call, SMS or WhatsApp on Chakshu (Sanchar Saathi)

Chakshu is run by the Department of Telecommunications. Use it for calls or messages that try to cheat you, such as fake KYC, fake police, fake customer care, job or loan offers and sextortion. It is for numbers that tried to cheat you. If you already lost money, call 1930 first.

**Keep this ready before you start:**

- A screenshot of the call log or message. The form asks for one.
- The number or SMS header that contacted you.
- Date and time (within the last 30 days).
- Any phone numbers or links mentioned in the message.
- Your own mobile number, to get an OTP.

1. Open [sancharsaathi.gov.in/sfc](https://sancharsaathi.gov.in/sfc/), or open the **Sanchar Saathi** app (Google Play or App Store).
2. On the website, under **Citizen Centric Services**, choose **Chakshu - Report Suspected Fraud Communication**.
3. Under **Report Suspected Fraud**, click **Proceed**.
4. Choose how it came: call, SMS or WhatsApp.
5. Choose the category. The list includes: KYC and Payment related to Bank / Electricity / Gas / Insurance; Impersonation as Police, CBI, Customs, Aadhaar, RBI; Fake Customer Care Helpline; Online job / lottery / gifts / loan offers; Sextortion; IVR / Robo Calls; Malicious link / website; Investment, Stock Market and Trading; Impersonation as DoT / TRAI; Impersonation as a relative / friend; Any Other Suspected Fraud.
6. Attach the screenshot. The portal may fill some details from the image. Check them.
7. Type the number it came from. For an SMS with a name instead of a number, choose **With header** and type the header.
8. Enter the date and the time in HH:MM AM/PM format.
9. In **complaint details**, write at least 30 characters. Say what they asked for and what they claimed.
10. Add any phone numbers and links that were in the message.
11. Enter the mobile number on which you got the call or message.
12. Type the captcha. Click **Verify Mobile via OTP**. Enter the OTP. Click **Verify OTP**.
13. Tick the declaration. Click **Preview**. Check it. Click **Submit**.
14. Take a screenshot of the thank you message. The Department says it will not send you individual results, for privacy reasons.
15. If it came on WhatsApp, also report the chat inside WhatsApp. The portal asks you to do this.

Checked on 1 November 2026 against: [Chakshu: report suspected fraud or spam (Sanchar Saathi)](https://sancharsaathi.gov.in/sfc/), [Sanchar Saathi portal and FAQ (Department of Telecommunications)](https://sancharsaathi.gov.in/).

### Use your DPDP rights (from 13 May 2027)

The rights in sections 11 to 14 of the DPDP Act, and the duties of companies that go with them, start on 13 May 2027 (G.S.R. 843(E)). Until then you can still write to a company and ask. Many will answer. But they are not yet bound by these sections.

**Keep this ready before you start:**

- The company's published method for rights requests. Rule 14 says companies must show it on their website or app.
- The identifier they ask for, such as your username, customer ID or registered mobile number.

1. Find the company's rights or grievance page, or its Data Protection Officer contact.
2. Send a written request using the method they publish. Use our [request letter template](https://dpdpr.in/rights/rights-request-letter/).
3. Ask for what you need: a summary of your data and how it is used, and the names of everyone it was shared with (section 11); correction, completion, updating or erasure (section 12); or a fix for a grievance (section 13). You can also nominate someone to act for you after death or incapacity (section 14), and withdraw consent (section 6(4)).
4. Save the acknowledgement or ticket number.
5. Wait for the time they publish. Rule 14(3) says it cannot be more than 90 days.
6. If they refuse or do not answer, you can complain to the Data Protection Board of India. You must use the company's grievance route first (section 13(3)).
7. The Board works as a digital office. Use the method it publishes on its website and app (rule 19). We will add the link when the Board publishes it.

Checked on 1 November 2026 against: [Digital Personal Data Protection Act, 2023 (MeitY copy of the Gazette)](https://www.meity.gov.in/static/uploads/2024/02/Digital-Personal-Data-Protection-Act-2023.pdf), [Digital Personal Data Protection Rules, 2025 (G.S.R. 846(E))](https://www.meity.gov.in/static/uploads/2025/11/53450e6e5dc0bfa85ebd78686cadad39.pdf), [G.S.R. 843(E): start dates for the Act](https://www.meity.gov.in/static/uploads/2025/11/c56ceae6c383460ca69577428d36828b.pdf).

## Ready-to-use complaint

Copy, fill the brackets, and send it through the company's official channel. Keep a copy.

To: Grievance Officer, \[job portal or employer\] Subject: Use of my personal data, profile / employee ID \[ID\] Please tell me what personal data you hold about me, who you shared my CV or details with, and why. Please delete \[data\] which is not needed for \[the job / my employment\]. Please reply within \[7 days for a portal / a reasonable time\]. \[Name\], \[mobile\], \[date\]

## Time limits

- Job portal grievance: 24 hours to acknowledge, 7 days to resolve. Then GAC within 30 days.
- Fraud: call 1930 as soon as possible.
- DPDP rights: from 13 May 2027 (limited for employment data under section 7(i)).

## If this happened to you

- [\*\*My employer shared my personal data with others\*\*Your employer or its vendor shared your salary, bank, medical or ID details.](https://dpdpr.in/rights/scenarios/employer-excess-data/)
- [\*\*Someone called with personal details I never shared with them\*\*A caller knew your name, address, purchases or family details, and named a company.](https://dpdpr.in/rights/scenarios/caller-knew-my-details/)
- [\*\*Someone made a fake profile using my name or photos\*\*An account impersonates you or uses your photos.](https://dpdpr.in/rights/scenarios/fake-social-account/)
- [\*\*My bank shared my account details or statement with my employer\*\*Your salary bank or loan bank gave your employer details or a statement you did not authorise.](https://dpdpr.in/rights/scenarios/bank-shared-with-employer/)
- [\*\*Recovery agents called my office, HR or colleagues\*\*Agents contacted your workplace about your loan.](https://dpdpr.in/rights/scenarios/recovery-agents-called-office/)
- [\*\*Can my employer see my health claims through the group policy?\*\*You are worried HR can see your diagnosis through the company health cover.](https://dpdpr.in/rights/scenarios/employer-sees-health-claims/)
- [\*\*A travel or visa agent kept my passport or misused my documents\*\*An agent will not return your passport, or used your documents for something else.](https://dpdpr.in/rights/scenarios/travel-agent-kept-passport/)
- [\*\*A fake recruiter had my CV from a job portal and asked for a fee\*\*A 'recruiter' knew your CV details and asked for registration, training or interview fees.](https://dpdpr.in/rights/scenarios/fake-recruiter-had-my-cv/)
- [\*\*A job app 'HR' asked for a deposit or my documents\*\*Someone claiming to be HR asked for a security deposit, bank details or ID copies before joining.](https://dpdpr.in/rights/scenarios/job-app-hr-deposit/)
- [\*\*I paid for a premium job portal plan and got scam calls instead of jobs\*\*A paid profile boost brought fake recruiters.](https://dpdpr.in/rights/scenarios/premium-job-plan-scam/)
- [\*\*The background check company wants my PF or tax login\*\*A verification firm asked for your EPFO or income tax password.](https://dpdpr.in/rights/scenarios/background-check-login/)
- [\*\*HR revealed employees' personal details, or my ex employer threatens me using my details\*\*HR shared personal data with others, or a former employer uses your details to threaten action.](https://dpdpr.in/rights/scenarios/employer-shared-or-threatens/)
- [\*\*My company wants to install tracking on my personal phone\*\*Your employer asks you to install device management or location tracking on your own phone.](https://dpdpr.in/rights/scenarios/tracking-on-personal-phone/)

## Official sources

- [IT (Reasonable Security Practices and Sensitive Personal Data) Rules, 2011 (India Code)](https://upload.indiacode.nic.in/showfile?actid=AC_CEN_45_76_00001_200021_1517807324077&filename=GSR313E_10511%281%29_0.pdf&type=rule)
- [IT (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, as amended up to 10 February 2026](https://www.meity.gov.in/documents/act-and-policies/information-technology-intermediary-guidelines-and-digital-media-ethics-code-rules-2021-it-rules-2021-IjM5QjMtQWa)
- [Ministry of External Affairs: complaints against recruiting agents](https://www.mea.gov.in/complaints-against-recruiting-agents)
- [Digital Personal Data Protection Act, 2023 (MeitY copy of the Gazette)](https://www.meity.gov.in/static/uploads/2024/02/Digital-Personal-Data-Protection-Act-2023.pdf)
- [Digital Personal Data Protection Act, 2023 (MeitY copy of the Gazette)](https://www.meity.gov.in/static/uploads/2024/02/Digital-Personal-Data-Protection-Act-2023.pdf)
- [G.S.R. 843(E): start dates for the Act](https://www.meity.gov.in/static/uploads/2025/11/c56ceae6c383460ca69577428d36828b.pdf)