Yes. A resume, a phone screen recording, an assessment score and a recruiter's notes all identify a person, so they are personal data under India's Digital Personal Data Protection Act, 2023. The DPDP Rules, 2025 were notified on 14 November 2025, and the main duties, including notice, consent, security and breach reporting, apply 18 months later, in May 2027.
That leaves hiring teams about seven months from the date of this post. Recruitment is a good place to start, because it is where a company collects the most personal data from people it has no contract with yet.
Is a job applicant covered, or only employees?
Both, but the legal basis may differ. Section 7(i) of the Act lets an employer process data without consent "for the purposes of employment", which plainly covers people on the payroll. Whether it also covers someone who has only applied is not settled. A Bar and Bench analysis by NovoJuris Legal points out that the Act "does not explicitly cover data collection during the recruitment phase" and calls for clearer guidance.
Until that guidance arrives, the cautious reading is to treat candidates as people whose consent you need. In practice that means a clear notice and a consent step when someone applies, and a way to withdraw it. If your counsel takes a different view, write it down, because you may need to explain the basis later.
What has to change in the application flow?
The government explainer on the Rules says each organisation must give a separate notice that is clear and easy to understand and explains the specific purpose for which the data is collected and used. For a job application, that means saying, in plain words:
What you collect: resume, contact details, work history, answers, recordings, test results.
Why: to assess the candidate for this role, and, only if they agree, for future roles.
How they can withdraw consent, ask for a copy of their data, correct it or ask you to erase it, and who to contact.
Keep "this role" and "future openings" as separate choices. A candidate who agreed to be assessed for one job has not agreed to sit in your talent pool for three years.
How long can you keep rejected candidates?
The Act's approach is that data should be erased once the purpose is served and there is no other legal reason to keep it. The Rules also add a floor: according to Shardul Amarchand Mangaldas, every organisation must keep personal data, traffic data and processing logs for at least one year from the date of processing, for the purposes the Rules list.
For recruiting, a workable policy is to set a fixed retention period for unsuccessful candidates, at least the one year the Rules require, tell candidates what it is in the notice, and delete or anonymise on schedule. Offer a longer talent pool period only to people who opt in. Then make sure the deletion happens in every copy: the ATS, shared drives, email attachments and spreadsheets that recruiters export.
What rights can candidates use?
The explainer lists the rights: to give, refuse or withdraw consent, to know what was collected and why, to get a copy, to correct and update it, to ask for erasure in certain cases, and to nominate someone to act for them. Requests must be handled within a maximum of 90 days.
Rejected candidates are the group most likely to ask, often because they want to know why they were turned down. If you use AI resume screening or AI interviews, decide now what you will share, such as the transcript and the criteria used, so the reply is consistent. We cover the transparency side in Do You Have to Tell Candidates an AI Is Interviewing Them?
What if candidate data leaks?
Hiring data spreads easily: forwarded resumes, interview links, shared sheets, agency inboxes. Under the Rules you must tell every affected person without delay, and send a detailed report to the Data Protection Board within 72 hours, as summarised by AMLEGALS. The penalties under the Act reach up to ₹250 crore for failing to keep reasonable security safeguards and up to ₹200 crore for not notifying a breach.
The cheapest control is fewer copies. Keep candidate data in one system with role based access, and stop the habit of exporting pipelines to spreadsheets.
A checklist for hiring teams before May 2027
1. Map where candidate data lives: careers page, job boards, agencies, ATS, email, drives, interview and assessment tools.
2. Rewrite the application notice in plain language, with separate choices for this role and future roles.
3. Record the legal basis you rely on for candidates, consent or legitimate use, with your counsel's view.
4. Set a retention period for rejected candidates and a calendar for deletion.
5. Name an owner for candidate requests and test that you can answer one within 90 days.
6. Ask each vendor that touches candidate data how it handles security, deletion and breach notice, and put it in the contract.
7. Write a breach plan that covers the 72 hour report to the Board.
None of this is AI specific, but AI tools add data, such as recordings, transcripts and scores, so include them in the map. Our guide to AI interviewing law in 2026 covers the AI specific rules in other countries.
Where GetHirePlus fits
Fewer systems means fewer places to secure, search and delete. GetHirePlus keeps applications, AI resume screening results, AI phone interview transcripts and assessment scores in one applicant tracking system, so a recruiter can see what is held about a candidate in one place. The legal decisions, such as your notice wording, legal basis and retention period, stay with you and your counsel.
This post is general information, not legal advice.
Sources
Press Information Bureau, explainer on the DPDP Rules, 2025 (17 November 2025)
Shardul Amarchand Mangaldas, Enforcement of the DPDP Act and notification of the DPDP Rules
AMLEGALS, Digital Personal Data Protection Rules, 2025: what businesses need to know