How to Build a Background Verification Policy for Your Company: A Step by Step Guide for Indian Businesses

Your company runs background checks. Sometimes. On some employees. When someone remembers to do it. The hiring manager in Delhi checks PAN cards. The branch in Bangalore skips it because they are in a hurry. The Mumbai office used a vendor last year but switched to doing it in house when the contract ended. Nobody knows who is responsible for criminal record checks, and nobody is sure whether the contract workers in the warehouse were ever verified at all.

This is how background verification works at most Indian companies. Not through deliberate negligence, but through the absence of a clear, written policy. Without a documented policy, verification becomes inconsistent, incomplete, and ultimately ineffective.

The result? Some employees are thoroughly verified while others slip through entirely. When a fraud or safety incident occurs, the company discovers gaps that could have been prevented. And when regulators ask about your compliance processes, you have nothing to show except a patchwork of informal practices that vary by location, by manager, and by mood.

This guide will walk you through building a background verification policy from scratch. Not a generic template, but a practical, India specific policy that accounts for the DPDP Act, industry regulations, the realities of a mixed workforce (permanent, contract, gig, and temporary), and the digital verification tools available today. Whether you are a startup with 20 employees or a mid size company with 2,000, this guide gives you a framework you can implement immediately.

Why You Need a Written Policy (Not Just a Practice)

Many companies “do” background verification without having a policy. The difference matters.

A Practice Is Inconsistent. A Policy Is Standardized.

When verification is a practice rather than a policy, each hiring manager applies their own judgment. One manager verifies every candidate. Another only verifies for senior roles. A third skips verification when they are under pressure to fill a position quickly. This inconsistency means your company’s risk exposure varies wildly depending on who is doing the hiring.

A written policy standardizes the process. It defines what checks are required for each role, when they must be completed, who is responsible, and what happens when a check reveals a concern.

A Practice Creates No Audit Trail. A Policy Does.

Under the DPDP Act 2023, companies are Data Fiduciaries with legal obligations to protect personal data. If a data breach occurs through an employee who was never verified, regulators will ask what safeguards you had in place. A verbal practice of “we usually check PAN cards” is not a safeguard. A written policy with documented implementation records is.

Similarly, POSH Act compliance, SEBI regulations for financial companies, and industry specific requirements all benefit from documented verification processes.

A Practice Dies When People Leave. A Policy Persists.

If the HR manager who “always ran background checks” leaves the company, the practice leaves with them. A written policy survives personnel changes. New team members inherit a clear process rather than having to figure things out from scratch.

Step 1: Define the Scope of Your Policy

The first decision is who your policy covers. The answer should be everyone, but let us be specific about what “everyone” means.

Permanent Employees

Full time and part time employees on your payroll. This is the obvious starting point, but many companies stop here. Your policy should explicitly include every category below as well.

Contract and Temporary Workers

Workers supplied through staffing agencies or labour contractors. These workers often have the same access to your premises, systems, and data as permanent employees, but receive less scrutiny. Your policy should specify that contract workers must meet the same verification standards as permanent employees.

Interns and Trainees

Interns have access to your office, your systems, and your information. If an intern can sit at a desk with access to your CRM, they should be identity verified.

Consultants and Freelancers

Anyone who will access your premises or systems regularly should be covered. A freelance graphic designer who works from your office two days a week has the same physical access as an employee.

Vendor and Third Party Staff

Security guards, cleaning staff, maintenance workers, and other third party personnel who work at your premises. Your policy should require that their employers verify them, and your company should conduct its own identity checks as an additional layer.

Gig Workers

If your company uses gig workers for deliveries, field visits, or other tasks, include them in the verification scope. They represent your brand to customers and may enter customer homes.

Step 2: Map Roles to Verification Levels

Not every role needs the same level of verification. Create a tiered system that matches the depth of verification to the risk profile of the role.

Tier 1: Basic Identity Verification (All Roles)

Every person associated with your company should have their identity verified against at least one government database. This is the absolute minimum.

Required checks. PAN Card Verification (confirms name and date of birth against Income Tax Department database) or Voter ID Verification (confirms identity and registered address through Election Commission database).

ID Verify by SalaryBox (verify.salarybox.in) runs both checks in minutes. This tier is fast, affordable, and should apply to every single person from the CEO to the newest intern.

Tier 2: Enhanced Verification (Roles with Financial, Data, or Physical Access)

Roles that involve handling money, accessing sensitive data, or entering private spaces need additional checks.

Required checks. Everything in Tier 1, plus UAN Verification (employment history through EPFO records) and Driving Licence Verification (if the role involves driving or vehicle operation).

This tier applies to cashiers, accountants, sales executives, warehouse staff, delivery personnel, facility management teams, and any role with access to financial systems or customer databases.

Tier 3: Comprehensive Verification (Roles with High Trust or Vulnerability)

Roles that involve working with children, patients, or vulnerable populations, handling very large amounts of money, managing teams, or operating in unsupervised environments.

Required checks. Everything in Tier 1 and Tier 2, plus criminal record checks (court records search for relevant offences), address verification, education and certification verification, and reference checks with previous employers.

This tier applies to senior management, anyone working with minors, healthcare roles, financial controllers, property managers, and security personnel.

Step 3: Set the Timing

When verification happens is as important as what verification happens. Your policy should specify timing clearly.

Pre Offer Verification

Run basic identity verification (Tier 1) before extending a formal offer. This catches fake identities at the earliest possible stage, before you invest time in onboarding and training.

Post Offer, Pre Joining Verification

Run enhanced and comprehensive checks (Tier 2 and Tier 3) after the offer is accepted but before the employee’s start date. Make the offer conditional on satisfactory completion of verification.

Your offer letter should include a clause stating: “This offer is conditional upon satisfactory completion of background verification. Any material discrepancy in information provided may result in withdrawal of the offer.”

Day One Verification for Urgent Hires

Sometimes you need someone to start immediately. For urgent hires, verify Tier 1 (identity) before day one access. Start Tier 2 and Tier 3 checks simultaneously. Grant provisional access with a clear timeline for completion of all checks. Define what happens if a check returns a concern after the person has already started (typically a review process with the option to revoke access).

Periodic Re Verification

Your policy should include a schedule for periodic re verification. Annual criminal record checks for high trust roles are a good practice. Re verification when an employee changes roles, especially if moving to a higher trust tier, should be mandatory.

Event Based Verification

Specify events that trigger additional verification. These might include promotion to a managerial role, transfer to a new location, assignment to a client facing project, or any incident that raises questions about an employee’s background.

Step 4: Define the Decision Framework

A verification policy is incomplete without clear guidance on what to do when checks reveal concerns. Without a decision framework, managers make inconsistent judgment calls that expose the company to both hiring risks and discrimination claims.

Green Light: Proceed

All checks completed with matching results. Minor variations in name spelling across documents (transliteration differences). Dates off by a month or two in employment records (normal processing lag). Everything is consistent and explainable.

Yellow Light: Investigate

One check returns a partial match or an unexpected result. An employer listed on the resume does not appear in UAN records. A minor, old, disposed criminal case appears. A qualification could not be verified because the institution did not respond.

For yellow light findings, your policy should specify who investigates (typically the HR head or a designated verification officer), that the candidate must be given an opportunity to explain, that the investigation and its outcome must be documented, and that the decision must be approved by a specified authority level.

Red Light: Likely Rejection

Identity documents show significant mismatches (different names, dates of birth, or the document belongs to another person). Multiple employment claims are fabricated. Recent criminal charges involving fraud, violence, theft, or sexual offences. The candidate becomes evasive or refuses to discuss discrepancies.

For red light findings, your policy should specify that the candidate is informed of the concern (without necessarily disclosing the specific finding, depending on legal advice), that the candidate has an opportunity to respond, that the decision to reject is documented with the rationale, and that rejection records are maintained for a specified period.

Step 5: Address Consent and Data Protection

The DPDP Act 2023 requires that personal data be collected and processed with the individual’s consent, for a lawful purpose. Your verification policy must address consent explicitly.

Obtain Written Consent

Before running any verification check, obtain the candidate’s written consent. The consent form should specify what checks will be conducted (identity, employment history, criminal records, etc.), what data will be collected and from which sources, how the data will be used (exclusively for employment verification), how long the data will be retained, and the candidate’s right to access and correct their verification records.

Data Minimization

Only collect data that is necessary for the verification purpose. If you are running a PAN check, you need the PAN number. You do not need the candidate’s Aadhaar number unless you have a specific legal basis for collecting it.

Retention Policy

Define how long verification records will be maintained. A good standard is: active employment plus three years after departure. After the retention period, verification records should be securely destroyed.

Access Controls

Specify who within the company can access verification records. Typically, this should be limited to HR personnel directly involved in the hiring process and the candidate’s direct management chain for criminal record findings only.

Step 6: Assign Responsibilities

A policy without clear ownership is a policy that does not get followed. Assign specific responsibilities.

HR Head or Chief People Officer

Overall policy ownership. Ensures the policy is updated, communicated, and followed. Reviews escalated cases. Approves exceptions.

Hiring Managers

Initiate verification for all new hires in their team. Do not grant access or start dates before verification clearance. Report any concerns or discrepancies to HR.

Verification Coordinator

Operates the verification platform (such as ID Verify by SalaryBox). Runs checks, collects results, and flags concerns. Maintains verification records. This role can be part of the HR coordinator’s responsibilities in smaller companies.

Vendor and Contractor Management

Ensures that all vendor agreements include verification requirements. Audits contractor compliance with verification standards. Runs supplementary identity checks on vendor staff at your premises.

Legal and Compliance

Provides guidance on consent requirements, data protection obligations, and the legal implications of verification findings. Reviews the policy annually for regulatory compliance.

Step 7: Select Your Verification Tools

Your policy should specify the tools and platforms used for verification. This ensures consistency and makes the policy actionable.

Digital Government Database Verification

ID Verify by SalaryBox (verify.salarybox.in) is designed for the kind of verification your policy requires. It checks PAN, Voter ID, Driving Licence, and UAN against government databases. Results arrive in minutes. Cross record confidence analysis automatically compares details across multiple documents. Pay per check pricing means you pay only for what you verify with no subscriptions.

Specify this (or your chosen platform) in the policy so that every hiring manager and HR coordinator uses the same tool and produces consistent, comparable results.

Criminal Record Checks

Specify how criminal records will be searched. This typically involves eCourts database searches and, for comprehensive checks, physical court record searches in relevant jurisdictions.

Physical Verification

For address verification and other checks that require field visits, specify whether these will be conducted in house or through a physical verification vendor.

Step 8: Communicate and Train

A policy that sits in a folder is a policy that does not exist. Communication and training are essential.

All Employees Briefing

Inform all current employees about the verification policy. Explain what it covers, why it exists, and how it affects them (for example, periodic re verification requirements).

Hiring Manager Training

Train every hiring manager on their responsibilities under the policy. Cover how to initiate verification, how to read verification reports, how to handle discrepancies, and when to escalate.

New Employee Communication

Include the verification policy in your onboarding materials. Every new hire should understand that the company verifies all employees and why.

Vendor Communication

Inform all vendors and contractors about the verification requirements that apply to their staff. Provide them with the relevant policy excerpts and a deadline for compliance.

Step 9: Review and Update Annually

Your verification policy should be a living document. Schedule an annual review to incorporate any new regulatory requirements (DPDP Act rules, industry specific regulations), address any gaps revealed by incidents or near misses during the year, update role mappings if new positions have been created, review and update the decision framework based on practical experience, and ensure the policy reflects any changes in verification tools or processes.

A Sample Policy Outline

Here is what your completed policy document should contain.

Section 1: Purpose and Scope. Why the policy exists and who it covers.

Section 2: Definitions. What constitutes background verification, who is a “covered individual,” what the verification tiers mean.

Section 3: Verification Requirements by Role Tier. The specific checks required for Tier 1, Tier 2, and Tier 3 roles.

Section 4: Timing and Process Flow. When checks are initiated, who runs them, and the timeline for completion.

Section 5: Consent and Data Protection. How consent is obtained, what data is collected, how it is stored and for how long.

Section 6: Decision Framework. Green, yellow, and red light outcomes and the process for each.

Section 7: Responsibilities. Who owns each part of the process.

Section 8: Record Keeping. What records are maintained, where, and for how long.

Section 9: Exceptions. How exceptions are requested, approved, and documented.

Section 10: Review Schedule. When the policy is reviewed and by whom.

Frequently Asked Questions

Do small companies need a verification policy?

Yes. A company with 20 employees needs a written policy just as much as one with 2,000. The policy will be simpler, but the principles are the same. In fact, small companies have less room for error. One bad hire in a 20 person company affects 5 percent of your workforce. One bad hire in a 2,000 person company affects 0.05 percent.

Can we make background verification mandatory for existing employees?

Yes, but handle it carefully. For existing employees, frame periodic verification as a compliance requirement rather than a suspicion driven exercise. Apply it uniformly across the entire organization. Obtain fresh consent for any new checks. The DPDP Act requires a lawful purpose and individual consent for data processing.

What if a candidate refuses to consent to background verification?

Your policy should state that completion of background verification is a condition of employment. A candidate who refuses consent is choosing not to proceed with the employment process. Document the refusal and the outcome.

How do we handle verification for employees in different states?

Digital verification through ID Verify by SalaryBox works nationally. PAN, Voter ID, and Driving Licence checks run against central databases regardless of the state. Criminal record checks may need to cover multiple jurisdictions based on where the employee has lived and worked. Your policy should specify that criminal checks cover the employee’s current state and any states where they have worked in the past five to seven years.

Should the verification policy apply to the founders and board members?

Yes. Senior leaders should be held to the highest verification standard. Including founders, CXOs, and board members in the policy demonstrates that verification is a company wide commitment, not just something applied to junior employees. It also sets the right cultural tone.

How much does implementing a verification policy cost?

Digital identity verification costs a few rupees per check. For a 100 person company verifying everyone at Tier 1 (PAN and Voter ID), the total cost is less than what you spend on a single job posting. Enhanced verification at Tier 2 and Tier 3 adds marginal cost per check. The cost of not having a policy, measured in fraud losses, regulatory penalties, and litigation expenses, is orders of magnitude higher.

The Policy Is the Foundation. The Verification Is the Practice.

A background verification policy does not have to be a 50 page legal document. It needs to be clear, practical, and enforceable. It needs to tell every hiring manager exactly what to do, when to do it, and what to do when something looks wrong.

ID Verify by SalaryBox (verify.salarybox.in) is the execution layer for your policy. Once you define what checks are needed for which roles, the platform runs those checks against government databases in minutes. PAN, Voter ID, Driving Licence, and UAN verification with automatic cross record analysis. Pay per check, no subscriptions, no minimum commitments.

Write the policy. Run the checks. Protect the company.

Visit verify.salarybox.in to start implementing your verification policy today.