What is the DPDP Act (DPDPA) in India?

The DPDP Act is India’s first proper data protection law, the Digital Personal Data Protection Act, 2023. It sets the rules for how companies collect, use, store, and delete people’s digital personal data. Individuals get rights over that data, businesses get duties, and the new Data Protection Board can fine companies up to ₹250 crore for getting it wrong.

From when is the DPDP Act applicable?

Parliament passed it in August 2023, and the DPDP Rules that switch it on were notified on 14 November 2025. The Data Protection Board started work that day, and consent manager rules start on 14 November 2026. The part that matters most for employers comes on 14 May 2027: that’s when notice, consent, security, breach reporting, retention and candidate rights all become enforceable.

Do recruiters need consent to screen resumes with AI under DPDP act?

In most cases, yes, or at least a clearly notified voluntary-provision basis tied to that role. The employment legitimate use in Section 7(i) is written for employees, so many legal teams avoid relying on it for applicants. Tell candidates that AI screening is used, what it does and how they can raise concerns.

Is there a right against automated decisions under the DPDP Act?

No, not explicitly. Unlike GDPR Article 22, the DPDP Act does not give a specific right to avoid solely automated decisions. However, Section 8(3) requires data used to make decisions about a person to be accurate, complete and consistent, so unreviewed AI rejections remain risky.

Who is liable if the ATS or AI hiring vendor leaks candidate data?

The employer, as Data Fiduciary, is responsible for compliance, including processing done by its vendors. It must notify the Board and affected candidates and may face penalties of up to ₹250 crore for inadequate safeguards. Contracts can allocate costs to the vendor but not the legal duty.

What are the penalties for violating the DPDP Act?

Fines can reach up to ₹250 crore for weak security that leads to a breach, and up to ₹200 crore for not reporting a breach or for mishandling children’s data. Other violations, such as a missing notice or keeping data too long, can cost up to ₹50 crore. The Board weighs how serious the violation was and how quickly you acted, so good records and a fast response can bring the amount down.

DPDP Act for Recruiters: AI Hiring Compliance Checklist

Quick Overview

What it is: The Digital Personal Data Protection Act, 2023 governs how organisations collect and use digital personal data in India. The DPDP Rules, notified on 14 November 2025, set the operating details.
Deadline: Core duties (notice, consent, security, breach reporting, candidate rights) apply from 14 May 2027. Consent manager rules start 14 November 2026.
Why recruiters care: Resumes, interview recordings, assessment scores, and background checks are all personal data. Your company is the Data Fiduciary; your ATS and AI vendors are Data Processors acting for you.
Why it is important in AI hiring: If data feeds a decision about a candidate, Section 8(3) requires it to be accurate, complete, and consistent. That puts AI screening scores and parsed resume fields directly in scope.
Penalties: Up to ₹250 crore for failing to secure data, up to ₹200 crore for not reporting a breach, up to ₹50 crore for other violations.
First move: Map every place candidate data lives, then fix notices, consent, retention, and vendor contracts.

Introduction

A single job post in India can pull in hundreds of resumes in a weekend. LinkedIn data released in January 2026 shows applications per opening in India have more than doubled since early 2022. This is exactly why so many TA teams now let AI parse, score, schedule, and even interview.¹

Every one of those steps touches personal data. Name, phone number, salary history, a recorded video answer, a coding test score, a background check report. Under the Digital Personal Data Protection Act, 2023, each of these is regulated, and from 14 May 2027 the core duties become enforceable.

Most companies are not there yet. In an EY India Survey, about 71% of enterprises said they had a limited understanding of the Act, and roughly 80% had not updated their privacy policies.²

This guide helps recruiters, TA leaders, and HR ops teams who use AI somewhere in the hiring funnel to navigate this Act better in the age of AI-powered hiring. It covers what the law says, rules you must adhere to, the penalties, what changes in practice, and a checklist you can work through with your legal and IT teams.

What is the DPDP Act?

The Digital Personal Data Protection Act, 2023 (DPDP Act) is India's first general data protection law. It applies to digital personal data processed in India, including paper records that are later digitized, and to processing outside India when it involves offering goods or services to people in India. The DPDP Rules, notified by MeitY, provide the operating details: notice format, breach timelines, security safeguards, and rights handling.³

In hiring terms, the employer is the Data Fiduciary (it decides why and how candidate data is used). The candidate is the Data Principal. Your applicant tracking software, assessment platform, AI video interview tool, and BGV agency are Data Processors, and the law holds you responsible for what they do on your behalf.

What are the Key Provisions of the DPDP Act?

The Act rests on a short list of duties. Here is each one, translated into what it means for a recruiting team.

Provision	What the law says	What it means in hiring
Lawful grounds (Sections 4, 6, 7)	Process data only with consent or for a listed "legitimate use"	You need a clear basis for every use of candidate data, not just the first one
Notice (Section 5, Rule 3)	Plain-language notice listing the data collected, the specific purpose, and how to withdraw consent or complain; available in English or any of 22 scheduled languages	Your careers page, application form and chatbot need an itemised notice, not a link to a generic policy
Consent (Section 6)	Free, specific, informed, unconditional and unambiguous, given by a clear affirmative action; as easy to withdraw as to give	No pre-ticked boxes; separate consent for talent-pool reuse or AI training
Accuracy for decisions (Section 8(3))	Data used to make a decision about a person must be complete, accurate and consistent	Applies directly to AI resume scores, parsed fields and interview ratings
Security safeguards (Section 8(5), Rule 6)	Reasonable safeguards to prevent a breach, including measures such as encryption or masking, access control and logging	Role-based ATS access, encrypted storage, access logs for recordings and BGV reports
Breach notification (Section 8(6), Rule 7)	Inform the Data Protection Board and every affected person without delay; detailed report to the Board within 72 hours	A resume database leak means telling each candidate, not just IT
Erasure (Section 8(7))	Delete data once consent is withdrawn or the purpose is served, unless law requires retention	Rejected-candidate resumes cannot sit in the ATS indefinitely
Processors (Section 8(2))	Engage processors only under a valid contract	Every AI and BGV vendor needs a DPDP-aligned data processing agreement
Grievance contact (Sections 8(9)–8(10))	Publish a contact for data questions and run a grievance process	Candidates need a named route to ask what you hold and why; Rules expect grievances resolved within 90 days
Candidate rights (Sections 11–14)	Access a summary of data, correct, complete, update, erase, nominate, and seek grievance redress	Build a request workflow before the first email arrives
Children (Section 9)	Verifiable parental consent for anyone under 18; no tracking or behavioural monitoring	Matters for apprenticeships, internships and campus drives with under-18 applicants
Significant Data Fiduciaries (Section 10)	Notified large processors must appoint an India-based DPO, an independent auditor, and run DPIAs	Large banks, insurers and IT services firms may be designated
Cross-border transfer (Section 16)	Transfers allowed except to countries the government restricts	Check where your AI vendor hosts and processes data
Data Principal duties (Section 15)	Individuals must not give false information or impersonate others; penalty up to ₹10,000	Gives employers a legal footing against candidate fraud

DPDP Rules 2025: the Compliance Timeline for HR Teams

The Rules were notified on 14 November 2025 and switch on in three phases:

Date	What switches on	What HR should have done by then
14 November 2025	Data Protection Board of India set up; definitions and Board procedures in force	Started data mapping
14 November 2026	Consent Manager registration framework	Consent and notice redesign drafted
14 May 2027	Core duties: notice, consent, security, breach reporting, rights, children's data, retention	Live, tested, documented

In January 2026, MeitY discussed shortening the window from 18 to 12 months for Significant Data Fiduciaries such as large banks, insurers, and big tech. Industry commentary through mid-2026 still works to the May 2027 date, but if you are a large BFSI employer, check the latest notification before you plan backwards.

How Does the DPDP Act Apply to Job Candidates?

A resume submitted online is digital personal data, and so is everything derived from it. The harder question is which legal ground covers it.

The employment "legitimate use" is narrower than many assume. Section 7(i) lets employers process data without consent for the purposes of employment and for protecting the employer from loss or liability. The text speaks about employment and employees. It does not name applicants. Some commentators read recruitment into it; many practitioners advise against relying on that for candidates who are not yet employees.
Voluntary sharing helps, but only for that one purpose. Section 7(a) covers data a person voluntarily provides for a specified purpose when they have not objected. A candidate who applies for a Senior Analyst role has shared their CV for that role. It does not extend to adding them to a talent pool for two years, enriching their profile from other sites, or using their interview video to train a model.
Publicly available data is a partial exemption. Under Section 3(c)(ii), the Act does not apply to personal data the person made public themselves. Sourcing from a public profile is therefore lower risk. Once you copy that data into your ATS, combine it with other information and run it through an AI scorer, treat it as regulated data.

The practical answer most legal teams land on: rely on clear, purpose-specific consent for candidates, and keep the employment ground for people after they join. Confirm the approach with your counsel.

How Does the DPDP Act Affect AI Hiring Tools?

The Act says nothing explicit about AI. What it does is attach duties to data, and AI hiring tools run on data at every stage. The table maps the stages most Indian TA teams now automate.

Hiring stage	Typical AI use	DPDP duty in play	What to change
Sourcing	Profile search, enrichment from public sites	Section 3(c)(ii) limits; notice once data enters your systems	Send a notice at first contact; log the source of each profile
Application	Resume parsing, chatbot Q&A	Notice, consent, data minimization	Drop fields you don't need (date of birth, marital status, photo)
Screening	Match scores, ranking, knock-out questions	Section 8(3) accuracy for decisions	Human review of rejections; test parser accuracy; keep score rationale, explainable
Assessment	Coding tests, psychometrics, AI technical evaluation	Purpose limitation, security	State what is assessed and who sees results with complete transparency
AI interview	Video/voice recording, transcription, scoring	Specific consent, security, retention	Separate consent screen; fixed deletion date for recordings
Scheduling	Calendar access, reminders	Minimal data, processor contract	Limit calendar scopes
Model training	Vendor improves its model on your candidate data	New purpose; consent; processor contract	Contractually bar training on your data unless candidates opted in

IBM's 2025 Cost of a Data Breach report found only 37% of Indian organizations had AI access controls in place, and unsanctioned "shadow AI" added about ₹1.79 crore to the average breach. A recruiter pasting resumes into a public chatbot is exactly that risk.

Where Talentpool Fits

Talentpool's AI-powered recruitment software is built for enterprise-grade security and compliance. Its AI Resume Scoring, AI Technical Evaluator, and AI Interviewer show recruiters why a candidate scored the way they did, not just the number. So, every shortlist and rejection has a reason a human can review and a candidate can ask about.

The platform comes with:

SOC 2 Type II and ISO 27001 certified.
Role-based access control (RBAC), so hiring managers see only their own roles; recordings and assessment results stay locked to the people who need them.
Data encryption, so candidate data stays secure in transit and at rest.
Data residency, as data is hosted on AWS in Mumbai and Singapore.

See how Talentpool handles candidate data and security →

Want to see what compliant AI hiring software looks like in action? Book a demo now!

If your company already complies with GDPR, perhaps because you hire in Europe or run a GCC for a European parent, you have a head start on security, vendor contracts, and rights handling. The legal reasoning does not carry over as neatly.

Area	DPDP Act (India)	GDPR (EU)	Why it matters in hiring
Scope	Digital personal data only, plus digitised paper	All personal data, including structured paper files	Paper application forms are outside DPDP until scanned
Lawful grounds	Consent or a closed list of legitimate uses	Six bases, including legitimate interests	No "legitimate interests" route for talent-pool reuse in India
Employment	Listed legitimate use (Section 7(i))	No dedicated basis; usually contract, legal obligation or legitimate interests	Different paperwork for the same activity
Sensitive data	No separate category	Special categories with stricter rules (health, ethnicity and more)	DPDP treats a CV's contents uniformly
Automated decisions	No specific right	Article 22 right not to be subject to solely automated decisions with legal or similar effect	DPDP is lighter, but Section 8(3) accuracy still bites
Data portability	Not provided	Provided	Fewer request types to build in India
Children	Under 18	Under 16 (states can lower to 13)	Campus and apprentice drives need age checks
Breach reporting	Every breach, to the Board and each affected person; detailed report in 72 hours	To the authority within 72 hours if risk exists; to individuals if high risk	No materiality filter in India
DPO	Mandatory only for Significant Data Fiduciaries	Mandatory for many organisations	Most mid-size Indian employers need a contact person, not a DPO
Penalties	Fixed caps, up to ₹250 crore per instance	Up to €20 million or 4% of global turnover	DPDP caps do not scale with company size
Consent Managers	Registered intermediaries for managing consent	No equivalent	Candidates may manage consent through third-party platforms
Cross-border	Allowed except to restricted countries	Adequacy, SCCs or other safeguards	Simpler for Indian employers, for now

Two practical notes: First, the absence of an Article 22 right does not mean fully automated rejection is safe in India; the Section 8(3) accuracy duty and fairness expectations still apply, and candidates can ask what you hold. Second, if you hire candidates in the EU, the EU AI Act classifies AI used for recruitment and candidate evaluation as high-risk, which adds obligations on top of GDPR.

Does the DPDP Act Charge Penalties for Non-compliance?

Yes, and they are among the largest fixed penalties in Indian law. The Schedule to the Act sets maximum amounts per instance:

Violation	Maximum penalty
Failing to take reasonable security safeguards to prevent a personal data breach	₹250 crore
Failing to notify the Board and affected individuals of a breach	₹200 crore
Breaching obligations for children's data	₹200 crore
Breaching additional obligations of a Significant Data Fiduciary	₹150 crore
Breaching a voluntary undertaking accepted by the Board	Up to the penalty for the underlying breach
Any other breach by a Data Fiduciary	₹50 crore
Breach of duties by a Data Principal (for example, false information or impersonation)	₹10,000

Source: PIB explainer on the DPDP Rules

The Board does not apply the maximum automatically. Under Section 33, it weighs the nature, gravity, and duration of the breach, the type of data, whether it was repeated, any gain made or loss avoided, and what the company did to limit harm. Good documentation and a fast response genuinely lower exposure.

DPDP Compliance Checklist for AI Hiring in India

Work through this with legal, IT security, and your vendors. Each item maps to a provision above, so you can show your reasoning if the Board ever asks.

1. Map Your Candidate Data

List every system that holds candidate data: Your AI hiring software, job boards, email, spreadsheets, AI interview tool, assessment platform, BGV vendor, shared drives.
For each, record what data it holds, why, who can access it, where it is hosted, and how long it is kept.
Assign a legal ground to every use: consent, voluntary provision for a specific role, or the employment legitimate use after joining.

2. Fix Notice and Consent

Rewrite the candidate privacy notice as a standalone, itemised notice in plain language, with English and relevant regional language versions.
Name every AI step in the notice: parsing, scoring, AI interviews, automated scheduling.
Collect separate, unticked consent for talent-pool retention, AI interview recording, and any model training.
Give a one-click way to withdraw consent, and make sure withdrawal actually stops processing downstream.
Remove fields you do not need: date of birth, photo, marital status, religion, family details.

3. Make AI Decisions Defensible

Keep a human in the loop for every rejection driven by an AI score or knock-out rule.
Test resume parsing accuracy on a sample each quarter and fix systematic errors.
Store the reasons behind each AI score, not just the number.
Run a bias check on screening outcomes across gender, age band, college tier, and location.

4. Secure the Data and the Vendors

Enforce role-based access in the ATS; hiring managers see only their roles.
Encrypt interview recordings and BGV reports at rest; log every access and keep logs for at least a year.
Sign a DPDP-aligned processing agreement with every vendor, covering security, sub-processors, breach notice, deletion, and no training on your data without consent.
Block uploads of resumes into unapproved public AI tools.
Write a breach playbook that can notify affected candidates and file the Board report within 72 hours.

5. Handle Rights and Retention

Publish a contact for candidate data queries and set up a grievance workflow with a 90-day outer limit.
Build a process to answer access, correction and erasure requests, including data held by vendors.
Set retention periods by data type (for example, rejected applications, recordings, BGV reports) and automate deletion.
Add age checks for internships, apprenticeships, and campus drives that may reach under-18 applicants.

Govern It

Train recruiters and hiring managers, name an owner for hiring-data compliance, and review the whole list every six months.

Questions to Ask Your AI Recruitment Vendor to Comply with DPDP Act

You stay liable for what your processor does. Before renewal, ask:

Where is our candidate data stored and processed, and which sub-processors touch it?
Do you use our candidates' data to train or improve your models? If yes, can we switch that off in the contract?
Can your system delete a candidate's data across all modules, backups included, on request?
How fast will you tell us about a breach, and what will that notice contain?
Can recruiters see why the AI scored a candidate the way it did?
How do you test for bias and parsing errors, and can we see the results?
What access controls and audit logs exist for recordings and assessment results?
Which certifications do you hold (ISO 27001, SOC 2), and when were they last audited?

The Bottom Line

The DPDP Act does not restrict AI in hiring. It asks you to be able to work with more transparency and explainability: what data you took, why, who saw it, how the AI used it, and when you deleted it. Teams that can answer those five questions for any candidate are most of the way to compliance.

This article is for general information and is not legal advice. Speak with your legal counsel about how the DPDP Act applies to your organization.