Candidate and employee data is among the most sensitive information an organisation holds, and adding AI into recruitment and HR workflows raises legitimate compliance questions. This FAQ addresses what HR, legal, and IT security teams in Indian enterprises need to know about data privacy, consent, and security when deploying AI in HR.
1. Is it legal to use AI for candidate screening calls in India?
Yes, using AI for candidate screening calls is legal in India, provided candidates are informed that they are interacting with an automated system and their data is collected and processed in line with applicable data protection law. There is no blanket restriction on using AI for recruitment communication, but organisations should ensure the screening process does not discriminate on protected grounds and that candidates have a way to reach a human recruiter if needed. Transparency about the nature of the interaction — making clear early in the call that it is an AI-assisted screening — is both good practice and reduces the risk of candidate complaints.
2. Does India's DPDP Act apply to candidate and employee data used in AI systems?
Yes, the Digital Personal Data Protection (DPDP) Act applies to candidate and employee personal data processed through AI systems, since names, contact details, employment history, and similar information collected during recruitment or HR interactions qualify as personal data under the Act. Organisations deploying AI for screening, onboarding, or helpdesk use cases need to ensure they have a lawful basis for processing this data, provide clear notice of what is collected and why, and honour data principal rights such as access and correction requests. HR and legal teams should treat AI-driven data collection with the same DPDP rigour as any other HR data system.
3. What consent is required before AI can collect or process candidate data?
Candidates should be informed, typically at the start of an AI-driven screening call or chat, that their responses are being recorded and processed for recruitment evaluation, and given the opportunity to proceed or opt for an alternative process where feasible. Clear notice — covering what data is collected, why, and how long it may be retained — is the baseline expectation under Indian data protection norms. Organisations should avoid burying this disclosure in fine print; a brief, spoken consent statement at the start of a voice AI call is generally more effective and defensible than a lengthy written policy candidates never read.
4. How is candidate and employee voice or call data stored and secured?
Voice and call data collected through AI screening or helpdesk interactions should be stored with encryption at rest and in transit, access-controlled so only authorised HR personnel and systems can retrieve it, and retained only for as long as necessary for recruitment or compliance purposes. Enterprises evaluating an AI vendor should specifically ask where data is hosted (India-based hosting is often preferred or required for regulated sectors like BFSI), how long recordings are retained, and whether data is used to train models beyond the specific client's use case. These are standard due-diligence questions that should be part of any vendor security assessment.
5. Can AI-driven screening introduce bias or discrimination risk, and how is that managed?
AI screening can introduce bias if the underlying evaluation criteria or training data reflect historical hiring patterns that favoured certain groups, so organisations need to actively review screening logic for fairness rather than assuming automation is automatically neutral. Structured, criteria-based screening — where the AI evaluates every candidate against the same explicit, job-relevant questions — actually reduces certain forms of inconsistent human bias, such as a recruiter being influenced by accent or background in an informal phone call. Regular audits of screening outcomes across different candidate demographics help catch unintended patterns early, and organisations should retain the ability to review and adjust evaluation criteria.
6. What happens to a candidate's data if they are not selected after an AI screening call?
Data for candidates who are not selected should be retained only for a defined period consistent with the organisation's data retention policy and applicable law, then securely deleted or anonymised, rather than kept indefinitely. Best practice is to have a clear, documented retention schedule — for example, retaining unsuccessful candidate data for a limited period to handle potential queries or reapplication, after which it is purged. Candidates should also be able to request deletion of their data under DPDP Act rights, and HR teams need a defined process for honouring such requests when AI systems are part of the data chain.
7. Is employee data used in HR helpdesk AI systems protected differently from candidate data?
Employee data used in AI helpdesk systems is generally subject to the same core data protection obligations as candidate data — lawful processing, purpose limitation, and security safeguards — but often involves more sensitive categories, such as payroll and salary information, medical or leave-related data, which warrant stricter access controls. Organisations should ensure that HR helpdesk AI only surfaces the specific employee's own data (through proper authentication) and does not inadvertently expose one employee's payroll or leave details to another. Role-based access and strong identity verification before the AI shares any personal data are essential safeguards.
8. Do AI vendors need to comply with sector-specific regulations for BFSI or healthcare clients?
Yes, when HR and recruitment AI is deployed within BFSI or healthcare organisations, the AI vendor's data handling practices may need to align with sector-specific regulatory expectations around data localisation, audit trails, and security standards that apply to the broader organisation, even though the data itself is HR-related rather than customer financial or health data. Regulated enterprises typically extend their vendor risk assessment process to any AI system touching employee or candidate data, not just customer-facing systems. It is advisable for HR teams in these sectors to loop in information security and compliance functions early in AI vendor evaluation, rather than treating it as a purely HR technology decision.
9. Can candidates or employees opt out of interacting with AI during recruitment or HR processes?
It is good practice, and increasingly an expectation, to offer candidates and employees a way to reach a human instead of the AI system if they prefer, particularly for sensitive conversations like grievances or compensation queries. For routine, high-volume interactions like first-round screening or leave balance queries, most candidates and employees engage with AI without issue once they understand its purpose, but organisations should not force AI-only interaction for cases where a person specifically requests human support. Building this opt-out path in from the start avoids compliance and experience issues later.
10. What security certifications or standards should HR teams look for when evaluating an AI vendor?
HR teams should look for recognised security certifications such as ISO 27001 for information security management, clear data processing agreements that specify data ownership and usage limits, and evidence of regular security audits or penetration testing. It is also worth confirming whether the vendor's infrastructure supports data residency requirements relevant to your industry, and whether they provide audit logs of who accessed candidate or employee data and when. Treating an AI vendor evaluation with the same security rigour as any other system touching sensitive personal data protects the organisation from both regulatory and reputational risk.
Related Reading
Related reading
Talk to YuVerse
Discuss data residency, consent workflows, and security architecture for AI in your HR function: https://yuverse.ai/contact?utm_source=qa-hub