What you will learn from this guide:

• The DPDP Act applies to all candidate data processed electronically - resumes, contact details, interview notes, and assessment scores
• Explicit consent is required before collecting any candidate information, and candidates can withdraw consent at any time
• Penalties reach up to Rs 250 crore per violation and multiple violations attract separate fines
• Candidate data must be deleted once the hiring purpose is complete indefinite storage is not permitted
• AI-powered screening tools must be explainable and operate on consented data to remain DPDP-compliant
• The Data Protection Board of India (DPBI) enforces the Act and must be notified of any data breach
  
  

The Digital Personal Data Protection (DPDP) Act, 2023, is a landmark legislation in India, enacted on August 11, 2023, to regulate the processing of digital personal data and protect individual privacy in the digital age. 

It applies to personal data any information that can identify an individual, such as names, addresses, phone numbers, or IP addresses when processed electronically. The act covers data processing within India and by entities outside India offering goods or services to Indian residents, ensuring a broad scope in today’s digital landscape. As data protection in hiring becomes a legal requirement under India's new legislation, recruitment teams face both challenges and opportunities

It also allows cross-border data transfers, except to countries restricted by the government, balancing privacy with global business needs. Enforcement falls to the Data Protection Board of India (DPBI), which investigates breaches and imposes penalties up to Rs 250 crore for data breaches or Rs 200 crore for failing to safeguard children’s data.

As data protection in hiring becomes a legal requirement, recruitment teams face both obligations and an opportunity to build genuine candidate trust. 

Key Provisions of the DPDP act

1. Explicit Consent for Data Processing

One of the central pillars of the DPDP Act is the requirement for explicit consent from individuals, termed "data principals," before their personal data can be processed. This provision ensures that organizations, referred to as "data fiduciaries," must secure clear, informed, and specific permission prior to collecting or using personal information such as names, addresses, or financial details.

• How it works: Consent must be freely given, and individuals must understand the purpose of data collection. For instance, if a company collects customer data for marketing, it must explicitly state this purpose and obtain agreement.
• Withdrawal option: Individuals can withdraw consent at any time, requiring organizations to cease processing their data upon request.

This empowers individuals to control their personal information, fostering transparency and trust between them and the entities handling their data.

2. Data Security Obligations

The DPDP Act mandates robust data security measures to safeguard personal data against breaches, unauthorized access, or misuse. Organizations are required to adopt "reasonable security safeguards," such as encryption, restricted access controls, and periodic security audits, to protect the data they handle.

• Breach notification: If a data breach occurs, organizations must promptly inform both the affected individuals and the Data Protection Board of India (DPBI). This ensures quick action to mitigate harm.
• Compliance: Organizations must maintain detailed records of their data processing activities and demonstrate adherence to security standards if audited.

This provision protects sensitive information and holds organizations accountable, with penalties up to Rs 250 crore for failing to prevent breaches, encouraging proactive security practices.

3. Rights of Data Principals

The Act grants individuals a set of rights to manage their personal data effectively. These rights include:

• Right to access: Individuals can request details about what data an organization holds about them.
• Right to correction: They can demand corrections if their data is inaccurate or incomplete.
• Right to erasure: Individuals can ask for their data to be deleted when it’s no longer needed for its original purpose.
• Right to portability: In some cases, they can request their data be transferred to another entity.

These rights shift power to individuals, ensuring they are not just data subjects but active participants with authority over their information.

Penalties for Non-Compliance

The act imposes significant financial penalties for non-compliance. These stringent penalties underscore the importance of compliance with the Act. 

These penalties are enforced by the Data Protection Board of India (DPBI), which conducts inquiries and communicates decisions in writing, with a requirement to complete inquiries within six months, extendable by three months

Unlike some other data protection regulations like the GDPR (General Data Protection Regulation in the EU), the DPDP Act does not set a cap on the penalties for multiple breaches. This means that if an organization is found to be non-compliant in several ways, each offense can attract a separate fine. As a result, the total penalty can accumulate to a significant amount, far exceeding the individual maximum limits per offense.

Operational Impacts on Talent Acquisition Under the DPDP Act

Operational Impacts on Talent Acquisition Under the DPDP Act 

The DPDP Act brings fundamental changes to how talent acquisition teams in India handle candidate information. Hiring managers need to update their processes to comply with these new data protection rules while still finding and onboarding talent effectively. 

Process Updates

Under the DPDP Act, talent acquisition professionals must obtain explicit consent from candidates before processing any personal information, including resumes, contact details, and interview notes. This necessitates:

• Redesigning job application forms with clear, user-friendly consent mechanisms
• Developing comprehensive privacy notices that transparently explain data collection methods, usage purposes, retention periods, and candidates' rights
• Implementing secure data handling protocols throughout the recruitment lifecycle
• Establishing encrypted channels for sharing candidate profiles with hiring teams
• Creating defined access limitations to prevent unauthorized data exposure

These adjustments add necessary oversight to routine recruitment tasks while ensuring candidates maintain control over their personal information.

Team Training

Training should begin with foundational knowledge about candidate data privacy laws, particularly how the DPDP Act creates new obligations for talent acquisition teams. This training should cover:

• Proper methods for securing and documenting explicit consent
• Techniques for ensuring data accuracy and completeness
• Protocols for responding to candidates' data access, correction, or deletion requests
• Best practices for secure data handling during each recruitment phase

Beyond initial training, regular refresher sessions are crucial to address regulatory updates and reinforce proper data handling practices. While this educational investment requires time and resources, it equips recruiters to navigate candidate interactions confidently and reduces non-compliance risks.

Technology Investments

Modern data protection in hiring demands robust technological solutions including encryption, access controls, and compliant applicant tracking systems:

• Strong encryption mechanisms for stored and transmitted candidate data
• Granular access controls limiting data visibility based on role requirements
• Comprehensive audit trails documenting all data access and modification activities
• DPDP-compliant applicant tracking systems with built-in consent management features
• Automated data retention policies that flag outdated information for deletion

Though these technological upgrades represent significant initial investments, particularly for smaller organizations, they provide essential protection against data breaches and compliance violations.

Does the DPDP Act Apply to AI-Powered Recruitment Tools? 

As AI-assisted screening, matching, and candidate ranking become standard in enterprise hiring, this critical question is rapidly becoming a top priority for forward-thinking TA leaders. 

The short answer is yes. The DPDP Act applies to any processing of candidate personal data, including processing done by AI systems on behalf of an organization. The organization remains the Data Fiduciary legally responsible for how candidate data is used regardless of whether a human or an AI system processes it.

For TA teams using AI-powered screening, matching, or ranking tools, three specific obligations apply:

AI tools must process only consented data

If a candidate consented to their resume being used to evaluate fit for a specific role, that data cannot be fed into an AI model used to rank candidates for other roles, train the vendor's broader model, or build candidate profiles beyond the stated purpose. The consent must cover the specific use.

AI recommendations affecting candidates must be explainable

If an AI system produces a ranking or recommendation that affects whether a candidate progresses in a hiring process, the organization must be able to explain the basis for that recommendation. A score with no visible criteria is not sufficient. The explanation must link the output to specific, documented evaluation criteria.

Candidates have the right to request deletion of data processed by AI

If a candidate exercises their Right to Erasure, the organization must be able to action that deletion across every system where their data was processed including AI screening tools, shortlisting platforms, and any third-party vendor that had access to the data.

For TA teams evaluating ATS platforms with AI features, ask every vendor this question before signing: if a candidate requests deletion of their data, can you confirm it is removed from every system and model where it was used? If the vendor cannot answer this clearly, the organization is carrying the compliance risk.

Read our full guide to evaluating ATS compliance for the complete set of questions to ask any vendor.

Educate Hiring and Recruitment Teams to Adapt with DPDP Act

Implementing comprehensive training programs for recruitment teams is essential for ensuring compliance with the Digital Personal Data Protection (DPDP) Act in India. 

These educational initiatives must go beyond surface-level awareness to develop a deep understanding of how the legislation affects everyday talent acquisition practices. Recruitment professionals need to understand key concepts like consent, purpose limitation, data minimization, and security obligations. 

This baseline education helps teams recognize how the law fundamentally changes their approach to handling candidate information throughout the hiring lifecycle.

Practical Application Training

Practical application training is particularly valuable, as it translates abstract legal concepts into concrete recruitment scenarios. 

Interactive workshops can demonstrate proper consent collection during application processes, showing recruiters exactly how to present privacy notices and obtain explicit permission before processing resumes or conducting background checks. These sessions should include examples of compliant and non-compliant practices to help teams distinguish between appropriate and problematic behaviors.

Role-Specific Compliance Education

Role-specific training ensures that different members of the talent acquisition team understand their unique responsibilities. 

• Sources need guidance on ethical candidate research practices.
• Interviewers require instruction on secure documentation of assessment notes. 
• Recruitment coordinators benefit from training on proper data transfer protocols when scheduling interviews or sharing candidate profiles with hiring managers.

Standard Operating Procedures

Organizations should develop clear standard operating procedures (SOPs) for common recruitment tasks that involve personal data. 

These SOPs should outline step-by-step processes for activities like candidate screening, interview feedback collection, and post-interview data management. Having documented procedures helps reinforce training concepts and provides quick reference guides for teams facing real-time decisions.

Simulation Exercises

Simulation exercises offer powerful learning opportunities by presenting teams with realistic scenarios that test their knowledge application. 

These might include handling a candidate's request to access their data, responding to a data breach during the recruitment process, or determining appropriate retention periods for different types of candidate information.

Technology Tools Training

Training should address the technology tools recruiters use daily, explaining security features and compliance capabilities within applicant tracking systems and other recruitment platforms. Teams need to know how to leverage encryption, access controls, and audit logs to maintain data protection throughout the talent acquisition process.

Ongoing Education

Regular refresher sessions are crucial as interpretations of the DPDP Act evolve and as recruitment practices change. 

Monthly or quarterly updates keep compliance knowledge current and demonstrate organizational commitment to ongoing data protection education. Measuring training effectiveness helps identify knowledge gaps and areas requiring additional focus through assessments that evaluate both theoretical understanding and practical application.

Cross-Functional Collaboration

Cross-functional training involving legal, IT security, and HR teams promotes collaborative compliance approaches. When recruiters understand how their actions intersect with broader organizational data governance, they make more informed decisions about candidate information handling.

Cultural Transformation

Cultural change management is perhaps the most important aspect of DPDP education. Training must shift recruiters' mindsets from viewing compliance as a burdensome requirement to recognizing it as an ethical imperative that builds candidate trust. This cultural transformation happens through consistent messaging, leadership modeling, and recognition of compliance champions within the team.

5 Best Practices for Data Handling in Hiring

These five best practices ensure DPDP compliance for recruiters while maintaining efficient hiring processes

1.Implement Data Minimization Principles

Only collect candidate information that's directly relevant to the hiring decision. Review your application forms and recruitment processes to eliminate requests for unnecessary personal details. This reduces compliance risks while simplifying data management. 

For example, collecting information about family members or personal hobbies is rarely necessary during initial screening phases and increases your data protection obligations unnecessarily.

2.Establish Clear Retention Policies

Develop and enforce specific timeframes for retaining different types of candidate data. Create automated deletion schedules that remove personal information when it's no longer needed. 

For instance, unsuccessful candidate profiles might be retained for 6-12 months to consider for future positions, while application materials for candidates who withdraw should be deleted promptly unless there's a legitimate business reason to retain them.

3.Secure Candidate Data throughout the Hiring Process

Implement robust security measures for all platforms and channels used in recruitment. This includes encrypted file sharing, password-protected document access, and secure transfer methods when sharing candidate information with hiring teams. 

Avoid sending unprotected candidate profiles via email, and instead use secure applicant tracking systems with appropriate access controls based on recruiter roles and responsibilities.

4.Obtain and Maintain Proper Consent Documentation

Develop transparent consent mechanisms that clearly explain how candidate data will be used. Document when and how consent was obtained for each candidate, and ensure your systems allow for consent withdrawal. 

Your consent requests should be specific about what information will be collected, how it will be used, who will have access to it, and how long it will be retained.

5.Create Procedures for Responding to Candidate Data Requests

Establish clear protocols for handling candidate requests to access, correct, or delete their personal information. Train recruitment teams to recognize these requests and designate specific team members responsible for coordinating responses within required timeframes. 

Document all actions taken in response to these requests to demonstrate compliance with data subject rights under the DPDP Act.

DPDP Compliance Checklist for Recruiters 

This checklist is designed specifically for talent acquisition professionals navigating DPDP Act requirements. It breaks down complex compliance obligations into actionable tasks across ten critical areas that directly impact recruitment processes.

How to use this checklist:

• Begin with a baseline assessment mark each item as Complete, In Progress, or Not Started to visualize your priorities
• Start with Consent Management and Data Security Measures which require immediate attention
• Data Minimization and Retention policies can follow
• Documentation and training elements can be implemented as the program matures
• Assign specific team members responsible for each section with realistic deadlines

What to prioritize first:

Focus on high-risk areas that could trigger penalties:

• Explicit consent mechanisms in your application process
• Security measures protecting candidate data
• Procedures for handling candidate requests to access or delete their information
• Documentation that proves compliance with key DPDP requirements

Consent Management

• Update job application forms with clear, explicit consent mechanisms
• Create transparent privacy notices explaining how candidate data will be used
• Implement process for documenting when and how consent was obtained
• Establish procedure for handling consent withdrawal requests
• Review third-party recruitment platforms for consent compliance

Data Minimization

• Audit current application forms to identify and remove unnecessary data fields
• Establish clear purpose for each type of candidate data collected
• Implement different data collection stages based on recruitment progress
• Create guidelines for what candidate information should be documented during interviews
• Review background verification processes to ensure only necessary data is collected

Data Security Measures

• Implement encryption for candidate data both in transit and at rest
• Establish role-based access controls for recruitment team members
• Create secure protocols for sharing candidate information with hiring managers
• Implement multi-factor authentication for recruitment systems
• Establish data breach response plan specific to recruitment data

Candidate Data Rights

• Create procedure for handling candidate requests to access their data
• Establish process for correcting inaccurate candidate information
• Implement mechanism for candidate data deletion requests
• Train recruitment team to recognize and properly route data rights requests
• Document all actions taken in response to candidate data requests

Data Retention

• Establish clear retention periods for different types of candidate data
• Implement automated deletion schedules in applicant tracking system
• Create process for extending retention when necessary with documentation
• Establish archive protocols for data that must be retained for legal purposes
• Implement regular data audits to ensure compliance with retention policies

Documentation and Governance

• Maintain records of processing activities specific to recruitment
• Document security measures implemented for candidate data protection
• Create recruitment-specific data protection impact assessments
• Establish regular compliance audits for recruitment processes
• Appoint recruitment team member responsible for data protection coordination

Training and Awareness

• Provide DPDP-specific training for all recruitment team members
• Create role-specific training modules for different recruiting functions
• Establish regular refresher training schedule
• Develop quick-reference guides for common data protection scenarios
• Implement knowledge assessment to verify understanding of requirements

Vendor Management

• Review contracts with recruitment service providers for DPDP compliance
• Establish data processing agreements with recruitment vendors
• Verify security practices of third-party recruitment platforms
• Create process for regular vendor compliance reviews
• Establish data transfer protocols for sharing candidate information with vendors

Cross-Border Considerations

• Identify recruitment activities involving international data transfers
• Verify which countries are approved for data transfers under DPDP
• Implement additional safeguards for cross-border recruitment activities
• Create documentation process for international candidate data flows
• Review global recruitment platforms for compliance with transfer restrictions

Technology Implementation

• Ensure applicant tracking system has built-in consent management features
• Implement automated data retention and deletion capabilities
• Configure comprehensive audit logging for all candidate data access
• Verify that recruitment technology supports data portability requirements
• Implement secure candidate portal for exercising data rights

Disclaimer: This checklist is provided for informational purposes only and should not be construed as legal advice. Organizations should consult with legal professionals to ensure complete compliance with the Digital Personal Data Protection Act.

Embrace DPDP Compliance with the Right Technology Partner

As the DPDP Act reshapes talent acquisition in India, organizations need to transform their recruitment processes to maintain both compliance and hiring efficiency. The technical and operational changes required securing candidate data, implementing consent mechanisms, building audit trails are significant. The right technology partner makes them manageable.

RippleHire's AI-powered ATS platform is specifically designed to address these challenges, offering built-in data privacy frameworks and compliance features that align perfectly with DPDP requirements. With encrypted data storage, automated retention policies, and granular access controls, RippleHire provides the technological foundation needed for DPDP compliance without sacrificing recruitment speed or candidate experience.

Schedule a demo today to see how RippleHire can help your organization not only avoid penalties but gain competitive advantage through enhanced candidate trust and streamlined processes. 

Frequently Asked Questions

What is the DPDP Act?

The Digital Personal Data Protection (DPDP) Act is India's landmark data privacy legislation enacted on August 11, 2023. It regulates how organizations process digital personal data and protects individual privacy rights. The DPDP Act applies to any personal information that can identify an individual names, addresses, phone numbers, IP addresses -- when processed electronically. It covers data processing within India and by entities outside India that offer goods or services to Indian residents. 

What is the maximum penalty for DPDP Act violations in recruitment?

Organizations can face penalties up to ₹250 crore for security breaches of candidate data and up to ₹200 crore for failing to notify affected candidates of breaches. Unlike GDPR, the DPDP Act doesn't cap penalties for multiple violations, meaning total fines can exceed these individual limits.

How long can recruiters retain candidate data under the DPDP Act?

Candidate data should only be retained as long as necessary for the original hiring purpose. For unsuccessful candidates, 6-12 months is generally appropriate. Establish automated deletion schedules and clearly document your retention decisions to demonstrate compliance if questioned by regulators.

What rights do candidates have over their data under the DPDP Act?

Candidates have rights to access their complete application information, correct inaccuracies in their profiles, withdraw consent at any time, and request deletion of their data. Organizations must establish clear protocols to handle these requests promptly and document all actions taken.

What are the key consent requirements for recruitment under DPDP?

Consent must be explicit, freely given, and candidates must understand the purpose of data collection. Redesign application forms with clear consent mechanisms, develop transparent privacy notices, and ensure candidates can withdraw consent. Document when and how consent was obtained for each candidate.

What training do recruitment teams need for DPDP compliance?

Training should cover consent collection, data handling protocols, responding to candidates' access requests, and security practices. Role-specific education is essential sorcers need guidance on ethical research, interviewers on secure assessment documentation, and coordinators on proper data transfer protocols.

What immediate security measures should recruiters implement for DPDP compliance?

Implement encryption for candidate data in transit and at rest, establish role-based access controls, create secure protocols for sharing candidate information, implement multi-factor authentication for recruitment systems, and develop a data breach response plan specific to recruitment data.