DPDP Act Candidate Data: Rules for AI Interviews

On 13 November 2026, the consent manager provisions of India’s Digital Personal Data Protection Rules take effect, and the remaining DPDP Act candidate data obligations follow on 13 May 2027. If your company runs AI interviews, recruits from India or stores video, transcripts and assessment scores of applicants, those dates set a clear deadline to review how candidate data is collected, kept and shared. Hiring teams have a second reason to act now: fraud is rising while confidence in existing checks is falling.

What the Timeline Means for Employers

The DPDP Rules were notified in November 2025 under a phased rollout. According to Lexorbis’s overview of the DPDP Rules, 2025, the consent manager provisions take effect on 13 November 2026, while all remaining sections and rules apply from 13 May 2027. The Wikipedia summary of the Rules describes the same phased structure. For most employers, the operational duties on notice, consent, security safeguards, breach reporting and individual rights sit in the later phase, which means the next six months are the time to prepare.

Recruitment data is personal data. A hiring pipeline can collect identity documents, resumes, interview recordings, transcripts, behavioural profiles and proctoring signals, often before anyone has been offered a job. The pressure to verify is growing. In a survey of 3,000 US hiring managers fielded in September 2026, Checkr reported that 40% had interviewed someone later found to be using a fake identity, up from 31% a year earlier. Only 23% of managers said they were “extremely confident” their hiring process would catch a fraudulent candidate. More verification means more personal data, so the compliance work has to scale with it.

Consent Has to Be Specific, Not Bundled

Under Rule 3, notices must be independently understandable and written in clear, plain language. Consent must be free, specific, informed, unconditional and unambiguous. AMS’s analysis of the Rules for hiring argues that a consent clause buried in an offer letter does not meet this standard, and recommends a separate consent document signed after the offer and before background verification begins. The same analysis notes that consent materials may need to be available in the regional languages of the candidate population.

For AI interviews, the practical test is simple: could a candidate tell, from the notice alone, what is being done with their data? A candidate who agrees to an interview should not be left guessing about ID matching, recording, transcription, scoring or behavioural profiling. Each purpose deserves its own line in the notice.

InstaDataAssess runs several distinct processes in one candidate journey: government-ID face matching, proctoring, auto-recording, transcription and an OCEAN behavioural profile. Each of these is worth listing separately. The platform also states that integrity events automatically discount the round score and can cap the recommendation, so the candidate notice should say that plainly rather than leave it for the candidate to discover.

Retention, Erasure and Logs

Retention is where many recruitment teams are weakest. According to Lexorbis, personal data must be erased once the specified purpose is no longer served, including when a data principal does not engage with the fiduciary for a specified period, unless another law requires retention. The same overview states that personal data, associated traffic data and processing logs must be kept for a minimum of one year and then erased, unless another law or government notification requires otherwise.

AMS adds that candidates can request erasure, that the employer must respond within 90 days, and that deletion must extend to vendor systems. Taken together, these points mean one retention rule will not fit every artefact in an interview pipeline. A workable schedule usually separates:

• Recordings and transcripts: a defined window after the hiring decision, then deletion unless a specific legal reason applies.
• Government-ID match results and document images: keep only what your stated purpose needs, and say so in the notice.
• Scorecards and recommendations: retained for the period your hiring and audit obligations require, with the reason written down.
• Audit and processing logs: kept for at least one year under the Rules’ minimum, then erased unless another law requires more.
• Candidates who never progress: erased once the purpose ends, unless they have agreed to join a talent pool.

The one-year minimum for logs is not a licence to keep everything else. Read it as a floor for logs only.

Vendors and AI Tools Do Not Move the Liability

Many hiring stacks rely on background-verification partners, video vendors and AI tools. Under the Rules, the employer is the Data Fiduciary and the vendor is typically the Data Processor. AMS states that the fiduciary remains responsible for compliance regardless of any agreement with the processor. Rule 6 sets minimum security safeguards, including encryption, masking or tokenisation of personal data, access controls, logging, backups and contractual requirements for processors.

The stakes are set out in the same analysis: AMS cites penalties of up to ₹250 crore for failing to implement reasonable security safeguards, and up to ₹200 crore per incident for failing to notify a breach. Breach handling has two tracks. Affected individuals must be informed without delay, and the Data Protection Board must be told without delay, with a detailed report due within 72 hours, according to Lexorbis.

Review your data processing agreements now. AMS suggests they cover data categories, permitted purposes, security measures, breach timelines, audit rights, sub-processor limits and deletion on termination. These clauses are much easier to negotiate before a 13 May 2027 deadline than after it.

How InstaDataAssess Supports a Defensible Process

InstaDataAssess is built on the principle that AI does the volume and your people make the calls. AI screening rounds are proctored and recorded. Expert video rounds carry auto-recording, transcription and round-specific scorecards that HR approves. The Decision Cockpit fuses AI and expert scores into one advance, hold or hire recommendation, with the transcript, recording and integrity timeline alongside it. Nothing is auto-rejected, and every invite is HR-gated. The platform also includes a complete audit log of actions and decisions, and it runs under your own brand, data and keys.

Those features help with evidence and human oversight, but they do not make a company compliant on their own. The notice, the consent flow, the retention schedule and the vendor contract remain the employer’s responsibility. Treat the platform as one part of a process that you document, test and review with your legal team.

If you are preparing your hiring process for the DPDP timeline, start with an inventory: list every artefact your interviews create, the purpose for each, the person who can access it and the date it should be deleted. Most of the work is in that inventory.

Frequently Asked Questions

When do the DPDP Act candidate data rules start to apply?

According to Lexorbis’s overview of the DPDP Rules, the consent manager provisions take effect on 13 November 2026, and the remaining sections and rules apply from 13 May 2027. Employers should plan around the later date for most operational duties.

Does a consent clause in the offer letter count as consent?

AMS argues that a bundled clause in an offer letter is unlikely to meet the Rules’ standard, because consent must be specific, informed and unambiguous. A separate consent notice before background verification or interview recording is the more defensible approach. Confirm the position for your own situation with counsel.

How long can we keep candidate interview recordings?

The Rules do not set one number for every employer. Personal data must be erased once its purpose is no longer served, and processing logs must be kept for at least one year before erasure. Set a schedule for each artefact, document the reason for it, and review it with your legal team.

Are our hiring vendors responsible for DPDP compliance?

No. According to AMS, the employer as Data Fiduciary remains responsible for compliance regardless of any agreement with a processor. Vendor contracts should still cover security safeguards, breach timelines, audit rights and deletion on termination.

Sources

• Checkr: Hiring Hoax 2026, AI fraud outpacing detection (October 2026)
• Lexorbis: Building India’s Digital Privacy Framework, an overview of the DPDP Rules, 2025
• AMS: What the DPDP Rules 2025 actually change for hiring in India
• Wikipedia: Digital Personal Data Protection Rules, 2025

Ready to make your AI interview process easier to document and defend? Explore InstaDataAssess, or write to info@instadatahelp.com to talk through your workflow. This article is general information, not legal advice, so confirm your obligations with qualified counsel. You can read more on the InstaDataHelp blog.