Recruitment Under DPDP: Handling Candidate Data From Application to Talent Pool
TL;DR
Candidates are Data Principals too. CVs and assessments submitted for a role can be processed for that recruitment, but keeping them in a talent pool for future roles, sourcing profiles from portals and running AI screening each raise separate questions. Give candidates a clear notice, get consent for talent pools, check vendors and AI tools, and erase unsuccessful candidates' data on a fixed schedule.
Who this is for: talent acquisition leaders, recruiters, HR operations and the teams that run applicant tracking systems.
Recruitment generates large volumes of personal data about people who are not, and may never become, employees. Most organisations hold thousands of CVs, interview notes and assessment results for candidates who were not hired, often in several systems and inboxes, often indefinitely. Under the DPDP Act, every one of those candidates is a Data Principal with rights.
The basis for recruitment data
| Activity | Likely basis |
| Processing a CV submitted for a specific role | Section 7(a): voluntarily provided for that purpose |
| Interviews, assessments and reference checks for that role | Section 7(a), and arguably employment purposes under Section 7(i) |
| Keeping the CV for future roles (talent pool) | Consent |
| Sourcing profiles from job portals or social networks | Within the platform's terms and the candidate's purpose; risky beyond that |
| Background verification through third parties | Notice and candidate authorisation; see [background verification](/blog/background-verification-dpdp) |
| Sharing CVs with clients (staffing firms) | Candidate's informed agreement; see [DPDP for staffing](/blog/dpdp-for-staffing) |
Tell candidates what happens to their data
Publish a short candidate notice on your careers page and in your application flow:
- what data you collect (CV, assessments, interview notes, video, references)
- the purpose (assessing the application for this role)
- who sees it (hiring team, recruitment vendors, assessment tools)
- how long you keep it
- how to ask for access, correction or deletion, and how to raise a grievance
Talent pools need consent
"We may keep your CV for future opportunities" buried in a careers-page policy is not specific consent. Offer a separate, unticked option to join the talent pool, explain how long you will keep the data, and let candidates leave at any time. Refresh consent periodically.
Job portals and sourcing
Recruiters often download profiles from job portals and professional networks into an ATS or spreadsheet. Two points matter:
- Data the candidate made public themselves can fall outside the Act under Section 3(c)(ii), but that exclusion is narrow, and portal profiles are usually shared under platform terms, not made public for any use.
- Building a permanent private database from portal downloads goes beyond the purpose for which candidates shared their data.
Use sourced data for the specific vacancy, tell the candidate when you contact them where you got their details, and do not keep it indefinitely.
AI screening and video interviews
AI tools that rank CVs, analyse video interviews or score assessments process personal data at scale. Before using one:
- tell candidates that automated tools are used, and for what
- confirm the vendor is a processor under a valid contract and does not use your candidates' data to train its own models without a lawful basis
- check where the data is hosted (Section 16)
- keep a human in the loop for rejection decisions
- set short retention for recordings
Retention for unsuccessful candidates
Set a fixed retention period for unsuccessful candidates, long enough to handle queries or disputes about the recruitment, then erase across the ATS, email and shared drives. Section 8(7) requires erasure when the purpose is served, unless consent to a talent pool or a law requires otherwise. See HR records retention.
Candidate requests
Candidates can ask what data you hold about them, correct it, or ask for it to be erased, because their application data is voluntarily provided under Section 7(a). Route these through your rights request process.
Checklist
Checklist
- Candidate notice on careers page and application forms
- Separate, optional consent for talent pools
- Sourcing rules for job portals and social networks
- Contracts with ATS, assessment and AI screening vendors
- Human review of automated rejections
- Fixed retention and automated erasure for unsuccessful candidates
- Candidate requests routed to the rights process
How ConsentifyAI helps
ConsentifyAI adds candidate notices and talent-pool consent to your application flows, records each candidate's choices with the notice version, and applies retention rules so unsuccessful candidates' data is erased on schedule. Candidate requests run through the same rights process as customers'.
Sources & references
- DPDP Act, 2023 — Section 5, 6, 7(a), 7(i)
- DPDP Act, 2023 — Section 8(2), 8(7)
- DPDP Act, 2023 — Sections 11, 12, 16
Frequently asked questions
Do we need consent to process job applications?
Data a candidate voluntarily submits for a specific role can generally be processed for that recruitment under Section 7(a). Using it for other roles or purposes usually needs consent.
How long can we keep unsuccessful candidates' CVs?
Only as long as needed for that recruitment and any likely dispute, unless the candidate consents to a talent pool. Set a fixed period and erase automatically.
Can we use profiles from job portals?
Use portal data within the portal's terms and for the purpose the candidate made it available. Downloading profiles into your own database for unrelated or indefinite use is risky.
Is AI screening allowed under DPDP?
The Act does not ban it, but the candidate must be told, data must be limited to what screening needs, the vendor must be contracted as a processor, and you should keep human review of decisions.
Can candidates ask for their data?
Yes. Data candidates voluntarily provided falls within the access and correction rights (Sections 11 and 12), and they can raise grievances.
Related reading
DPDP for HR Leaders: What You Own and What to Do First
HR holds more personal data than almost any other function: candidates, employees, contractors, interns and former staff, much of it sensitive. Under the DPDP Act, most employment processing can rely on the Section 7(i) legitimate use rather than consent, but notices, security, vendors, retention limits and breach reporting all still apply. HR leaders should map their data, separate employment needs from extras, tighten vendor contracts and set retention schedules before 13 May 2027.
ReadBackground Verification Under DPDP: What Employers Can Check, and How
Background verification collects some of the most sensitive data an employer handles: identity documents, education and employment history, addresses and sometimes criminal records. Under the DPDP Act, tell candidates exactly what will be checked and by whom, get their authorisation, check only what the role requires, handle Aadhaar carefully, contract your BGV vendor as a processor and delete verification data once it has served its purpose.
ReadDPDP Act for Staffing and HR Tech Companies: A Compliance Guide
Staffing firms, RPOs, job platforms and HR tech vendors hold some of the largest personal data sets in India: candidate databases running to millions of records. Under the DPDP Act, they are usually Data Fiduciaries for their own databases and processors for client work. Sharing CVs with clients needs candidates' informed agreement, databases need retention limits, AI screening must be transparent, and deployed workers' data must be handled as an employer's.
Read