Compliance
DPDP and hiring data: a practical checklist
Last updated Reviewed by Hab Business Solutions
India's Digital Personal Data Protection Act treats a resume as personal data. Here is what that means for a recruitment workflow, in operational terms rather than legal ones.
Short answer
What does India's DPDP Act mean for recruitment data?
The checklist
Most recruitment teams are closer to compliance than they fear, and further from evidence of it than they realise. Work through these six in order.
- Purpose: collect only the data the role decision needs, and write the purpose down
- Notice: tell candidates in plain language what you collect, why, and how long you keep it
- Retention: set a deletion date per requisition rather than keeping resumes forever by default
- Residency: know which country your resumes are stored and processed in, and be able to prove it
- Processors: hold every vendor in the chain to your standard in writing, including sub-processors
- Explainability: be able to say why a decision about a person was made, and who made it
Where most hiring stacks actually leak
It is rarely the tracking system. It is the resumes in a shared inbox, the spreadsheet on a personal drive, the WhatsApp forward to a hiring manager, and the free screening tool someone signed up for with a work email. Each of those is a processing location nobody documented.
Consolidating evaluation into one governed workspace is a compliance improvement before it is a productivity one.
What we do on our side
MinMaxHR and CandidRanker store and process customer data in India (Google Cloud asia-south1). Uploads are malware-scanned before entering the pipeline, workspaces are isolated with row-level security, API keys are held as SHA-256 hashes rather than recoverable secrets, and support access is explicit, read-only unless otherwise granted, and expires within 24 hours.
Controls are built to SOC 2 alignment, with independent certification on the roadmap. We say roadmap because it is a roadmap.
Automated decisions and the human gate
The safest position on automated decision-making in hiring is also the most useful one: let the system rank and explain, and require a named human to shortlist, select, or reject with a recorded reason. No candidate is ever auto-rejected in our products, and we advise clients to hold the same line in systems we build for them.
Frequently asked
Does DPDP apply to companies outside India?
The Act reaches processing of personal data of individuals in India, including processing carried out outside India when goods or services are offered to them. Confirm your specific exposure with counsel; this page is operational guidance, not legal advice.
How long can we keep candidate resumes?
Only as long as the stated purpose requires. Set an explicit retention period per requisition, tell candidates what it is, and delete on schedule instead of defaulting to indefinite storage.
Where is our hiring data stored if we use MinMaxHR?
In India, on Google Cloud asia-south1, with malware scanning on upload, tenant isolation through row-level security, and time-bounded read-only support access.
Can candidates ask why they were rejected?
You should assume yes and design for it. Because every decision carries a named owner and a written reason, and every score decomposes into evidence, the answer exists without anyone reconstructing it from memory.
Want this running on your next role?
Bring one job description and its applicants. You will see the ranked pool and the evidence behind it before the call ends.
No retainers to start · Pilot-first · Human-in-the-loop governance