Updated 2026-09-16
The Digital Personal Data Protection Act, 2023 (DPDP Act) is India's central law governing how organizations collect, use, store, and transfer personal data — including job applicant and employee data — with notice, consent, purpose limitation, and data-principal rights obligations.
Recruiting pipelines are data-intensive: names, phone numbers, government identifiers, voice recordings, video, interview transcripts, assessment scores, background check results, and sometimes health or disability information during accommodations. Each element may be personal data under the DPDP Act when it relates to an identifiable individual.
India's prior patchwork of sector rules and the Information Technology Act's limited privacy provisions gave way to a dedicated framework emphasizing consent (with exceptions for certain legitimate uses), clear notice in English or scheduled languages, data minimisation, retention limits, and rights for data principals — including access, correction, and erasure in defined circumstances.
Multinationals hiring in India and Indian employers hiring at volume — BPOs, staffing agencies, quick-commerce ramps — share the same core obligations even if their tech stacks differ. Cloud-hosted ATS and AI interview vendors become data processors or fiduciaries depending on contract structure.
Voice interviews generate biometric-adjacent data in some interpretations — audio recordings of identifiable individuals. Video adds image data. Automated scoring may profile candidates in ways that trigger additional scrutiny under future rules and sector guidance still being operationalised through DPDP rules and the Data Protection Board.
Employers should know where recordings live geographically, who subprocessors access them, how long they are retained, and how candidates exercise erasure if rejected. AI vendor contracts should specify processing instructions, security measures, and breach notification — not just feature SLAs.
Children's data and certain high-risk categories receive heightened protection. Standard campus fresher hiring usually involves adults, but internship pipelines hiring minors need separate legal review.
The DPDP Act's full operational detail depends on rules, board guidance, and enforcement practice still developing as of this writing. This page is a general explainer for hiring and product teams — not legal advice, not a compliance certification for Intervues or any employer, and not a substitute for qualified counsel in India. Map your actual data flows, notices, and vendor agreements with professional support.
DPDP is central personal-data law. Labour, equal opportunity, and sector regulations may still apply alongside — compliance is cumulative.
Notice and lawful basis for recording and processing voice data should be explicit in application flows. Exact consent mechanics depend on rulemaking and your role as fiduciary or processor — consult counsel.
Retention for talent pools requires a valid basis and clear notice at collection — indefinite retention of all applicants without transparency conflicts with purpose-limitation principles.
GDPR may apply to EU residents or establishments regardless of DPDP. Indian applicants processed in India primarily fall under DPDP — global employers often maintain parallel compliance programs.
Head back to Hiring glossary or start now.
· 3 free credits · pay per interview · nothing recurring