India's DPDP Act for recruiters: consent, notices and candidate data

The timeline

Does the Act cover candidate data?

In almost every hiring process, yes. The Act applies to digital personal data processed in India, including data collected on paper and digitized later (Section 3). "Personal data" means any data about an individual who is identifiable by or in relation to it. A résumé, an application form, an interview recording, a transcript and a scorecard all qualify.

One limit matters for sourcing. The Act does not apply to personal data that the person has made, or caused to be made, publicly available. Whether a given public profile falls under that limit is a question for counsel, not a default.

Consent, or a legitimate use?

Section 4 allows processing for a lawful purpose on one of two grounds: the person's consent, or a "legitimate use" listed in Section 7. Two clauses of Section 7 come up in hiring. The first is the employment clause:

The clause names employment and employees. It does not mention candidates or recruitment, and commentators read that gap differently. NovoJuris Legal, writing in Bar & Bench, says the Act is silent on pre-employment steps such as shortlisting, interviews and background checks, so it is unclear whether they fall under "purposes of employment". Fisher Phillips takes the broader view that employers generally will not need explicit consent for standard HR activities, recruitment included.

The second is Section 7(a). It covers data a person "has voluntarily provided" for a specified purpose, where she has not indicated that she does not consent. The Act's illustrations involve a pharmacy and a property broker, not an employer, and we found no official guidance applying it to job applications.

Until the Data Protection Board or the courts say more, the cautious path is simple. Give every candidate a notice. Get consent for anything a candidate would not expect from applying, such as recording an interview, AI analysis or keeping a profile for future roles.

What the notice and consent must look like

Under Section 5, every request for consent must come with, or after, a notice that tells the person:

• the personal data and the purpose for which it will be processed;
• how to withdraw consent and how to use your grievance route (the rights in Sections 6(4) and 13);
• how to complain to the Data Protection Board.

Under the Rules, Hogan Lovells notes, the notice must be presented independently of other information, in clear and plain language, with "an itemized description of the personal data to be processed". The Act also requires you to give the person the option to read the notice in English or any language listed in the Eighth Schedule to the Constitution.

Consent itself must be "free, specific, informed, unconditional and unambiguous with a clear affirmative action", and limited to the data needed for the purpose (Section 6(1)). Withdrawing it must be as easy as giving it. A pre-ticked box on a careers form is hard to square with "clear affirmative action".

Your duties once you hold candidate data

• Accuracy for decisions. Where data is likely to be used to make a decision that affects the person, you must ensure it is complete, accurate and consistent (Section 8(3)). A hiring decision is such a decision.
• Vendors under contract. A data processor, such as an ATS or interview vendor, may process data for you only under a valid contract (Section 8(2)). You remain responsible for what it does on your behalf (Section 8(1)).
• Security. Take reasonable security safeguards to prevent a personal data breach (Section 8(5)).
• Breach reporting. Tell the Board and each affected person (Section 8(6)). Under the Rules, affected people must be told without delay, in plain language, what happened and what they can do (PIB), and the Board must get a detailed report within 72 hours (Hogan Lovells).
• Erasure. Erase data when consent is withdrawn or the purpose is no longer served, unless a law requires you to keep it, and make your processors erase it too (Section 8(7)). The Rules also require personal data, traffic data and certain logs to be kept for at least one year (Hogan Lovells).
• A named contact. Publish the business contact of a Data Protection Officer, or of a person who can answer questions about the processing (Section 8(9)).
• Grievances and rights. Run an effective grievance mechanism (Section 8(10)). Requests to access, correct, update or erase data must be answered within 90 days (PIB).

Hiring under-18s

Under the Act, a child is anyone under 18. Before processing a child's personal data you need verifiable consent from a parent or lawful guardian. You may not process it in a way likely to harm the child's well-being, and you may not track or behaviorally monitor children (Section 9). Plan for this before you open apprenticeships, internships or part-time roles to applicants under 18.

Significant Data Fiduciaries

The government can notify some organizations as Significant Data Fiduciaries, based on factors such as the volume and sensitivity of the data and the risk to people's rights (Section 10). They must appoint a Data Protection Officer based in India, engage an independent data auditor, and run periodic impact assessments and audits. Under the Rules, Hogan Lovells adds, they "must ensure that technical and algorithmic systems do not harm data principals' rights". The label applies only to organizations the government notifies.

Penalties

A recruiter's checklist

1. Map candidate data. List what you collect at each stage, from application to offer, where it is stored and which vendors touch it.
2. Write one standalone candidate notice. Itemize the data, state each purpose, and explain how to withdraw consent, raise a grievance and complain to the Board.
3. Ask for consent for anything beyond the application, such as recording, AI analysis or a talent pool, and make withdrawing as easy as agreeing.
4. Set retention periods. Decide how long you keep rejected candidates' data, and delete on schedule.
5. Sign contracts with every processor: ATS, assessment, interview and background-check vendors.
6. Rehearse a breach. Know who tells candidates and who sends the Board its 72-hour report.
7. Name a contact and set up a grievance route that answers within 90 days.
8. Check ages for roles open to under-18s, and plan for verifiable parental consent.

Itya captures consent before an interview is recorded, publishes a DPA and subprocessor list, and offers a DPDP grievance route; see our trust page. Features like these help you meet specific duties, such as keeping consent records and giving candidates a contact for grievances. The choices above, from your lawful basis to your retention periods, stay with you. For rules outside India, see AI interview laws by jurisdiction.