{"id":1668,"date":"2026-08-12T10:09:06","date_gmt":"2026-08-12T10:09:06","guid":{"rendered":"https:\/\/hirium.com\/blog\/?p=1668"},"modified":"2026-08-12T10:09:06","modified_gmt":"2026-08-12T10:09:06","slug":"candidate-database-compliance","status":"publish","type":"post","link":"https:\/\/hirium.com\/blog\/candidate-database-compliance\/","title":{"rendered":"Candidate Database Compliance: GDPR and DPDP Act Checklist"},"content":{"rendered":"

Most recruitment teams are sitting on a legal liability they haven’t priced in. European regulators processed an average of <\/span>443 personal data<\/b><\/a> breach notifications every single day in the twelve months to January 2026, a 22% jump from the year before, and fines issued under GDPR since 2018 have now crossed \u20ac7.1 billion.\u00a0<\/span><\/p>\n

Recruitment databases, full of resumes, phone numbers, salary history, and interview notes, sit squarely inside the scope of that enforcement wave.<\/span><\/p>\n

Candidate database compliance<\/b> isn’t a legal footnote anymore. It’s an operational requirement that touches every stage of hiring from the moment a resume lands in your inbox to the day (which should be defined, not indefinite) that data gets deleted.\u00a0<\/span><\/p>\n

Two frameworks now govern this for most global and India-facing companies<\/b>: the EU’s General Data Protection Regulation (GDPR) and India’s Digital Personal Data Protection (DPDP) Act, 2023, now backed by the DPDP Rules, 2025.<\/span><\/p>\n

The two regimes overlap in spirit; both are consent-driven, both grant individuals rights over their own data, but they diverge in specifics: retention expectations, breach notification timing, and penalty structure are not identical. A hiring team that assumes “GDPR-compliant” automatically means “DPDP-compliant” is making an expensive assumption.<\/span><\/p>\n

This piece breaks down what both laws actually require for candidate data, how long you can legally hold on to a resume, what a working consent process looks like, and a checklist you can run against your own <\/span>candidate database management<\/b> setup today.<\/span><\/p>\n

\"GDPR<\/p>\n

What Is Candidate Database Compliance?<\/b><\/h2>\n

Candidate database compliance<\/b> is the practice of collecting, storing, processing, and deleting job applicant data in line with applicable data protection law, primarily GDPR for EU-connected data and the DPDP Act for India-connected data.\u00a0<\/span><\/p>\n

It covers lawful basis for collection, defined retention periods, candidate rights (access, correction, deletion), and breach reporting obligations for any system that stores resumes, contact details, or interview records.<\/span><\/p>\n

The Core Problem: Recruitment Databases Are Compliance Blind Spots<\/b><\/h2>\n

Recruitment data has a specific problem that most other business data doesn’t: it keeps arriving on autopilot and rarely gets cleaned up. A mid-sized company running 40 open roles a year through<\/span> job posting software<\/b><\/a> can accumulate 8,000\u201312,000 candidate records in 24 months, most of which are unsuccessful applicants whose data has no defined expiry date.<\/span><\/p>\n

Industry audits of European recruitment databases have repeatedly found that somewhere between 40% and 70% of stored candidate profiles are past any reasonable retention window, not because anyone decided to keep them, but because no one set a deletion clock in the first place.\u00a0<\/span><\/p>\n

That’s not a minor housekeeping issue. Under GDPR, indefinite retention without a stated purpose is treated as a violation on its own, independent of whether a breach ever occurs.<\/span><\/p>\n

The DPDP Act compounds this for India-facing hiring teams. Since the <\/span>DPDP Rules, 2025<\/b> were notified on November 13, 2025, and began phased enforcement with further phases scheduled through November 2026 and full penalty enforcement by May 2027, companies hiring in India can no longer treat data protection as a “we’ll deal with it later” item.\u00a0<\/span><\/p>\n

Penalties under the Act can reach \u20b9250 crore (roughly $30 million) for serious violations, and unlike GDPR’s percentage-of-turnover model, DPDP penalties are set in absolute rupee terms per violation category, which can hit smaller companies disproportionately hard.<\/span><\/p>\n

Most teams underestimate the size of this exposure by 3\u20134x, because they’re counting active job openings, not the accumulated backlog sitting in old spreadsheets, email threads, and abandoned <\/span>candidate database management<\/b> tools from a previous ATS.<\/span><\/p>\n

Where Compliance Risk Actually Hides in the Hiring Stack<\/b><\/h2>\n

Candidate database compliance<\/b> doesn’t live in one tool; it’s spread across every point where a candidate’s data gets touched, copied, or forwarded. Mapping those points is usually more revealing than reading the regulation itself.<\/span><\/p>\n

Job Posting Software and the Data Collection Moment<\/b><\/h3>\n

Compliance starts before a candidate ever reaches your database at the job posting stage. <\/span>Job posting software<\/b> that pushes listings to multiple boards often pulls applicant responses back through different integrations, each with its own data handling terms.\u00a0<\/span><\/p>\n

If your careers page, LinkedIn Easy Apply, and a third-party job board all feed into the same <\/span>candidate database management<\/b> system, you have three separate consent capture points to audit, not one.\u00a0<\/span><\/p>\n

A common failure mode: the careers page has a compliant consent checkbox, but the job-board integration imports applicants without ever showing them that language, because the board’s own form is what candidates actually filled out.<\/span><\/p>\n

AI Interview Scheduling and Assessment Tools<\/b><\/h3>\n

AI interview scheduling<\/b><\/a> and screening tools introduce a second layer of exposure: they usually process candidate data on a separate vendor’s infrastructure, which means every scheduling link, video interview recording, or automated assessment result is a cross-border or third-party transfer question waiting to be asked.\u00a0<\/span><\/p>\n

Under GDPR, this triggers a data processing agreement requirement with the vendor. Under the DPDP Act, it raises a “Significant Data Fiduciary” question if volumes are large enough, since heightened obligations, including mandatory audits, apply once an organization crosses thresholds the government designates for that category.\u00a0<\/span><\/p>\n

Before enabling an <\/span>AI screening<\/b> feature, it’s worth confirming the vendor deletes interview recordings and transcripts on the same schedule your own retention policy specifies, rather than keeping a separate copy indefinitely on their side.<\/span><\/p>\n

Recruitment Email Templates and Consent Language<\/b><\/h3>\n

Recruitment email templates<\/b><\/a> are an underrated compliance surface. Auto-rejection emails, talent-pool invitations, and re-engagement campaigns all involve processing stored candidate data for a new purpose each time they’re sent.\u00a0<\/span><\/p>\n

A rejection template that also pitches “we’ll keep your resume on file” is quietly expanding the original consent scope unless that talent-pool language was part of the original application form.\u00a0<\/span><\/p>\n

The fix is straightforward:<\/b> separate the transactional rejection message from any request to extend retention, and make the extension request an explicit yes\/no choice rather than an assumed default.<\/span><\/p>\n

GDPR and DPDP Requirements for Candidate Data: A Deep Dive<\/b><\/h2>\n

Lawful Basis: Why “We Need It to Hire” Isn’t Always Enough<\/b><\/h3>\n

Under GDPR, every piece of candidate data you touch needs a documented lawful basis, typically <\/span>consent<\/b> or <\/span>legitimate interest<\/b> for active applicants, and <\/span>contract necessity<\/b> once someone is hired.\u00a0<\/span><\/p>\n

The DPDP Act takes a narrower, more consent-centric approach: data can be processed either with explicit, informed consent from the candidate (a “Data Principal” in DPDP terminology) or under a defined “legitimate use,” which includes employment-related purposes but is more tightly scoped than GDPR’s legitimate interest test.<\/span><\/p>\n

Practically, this means your application form language matters. A checkbox that says “By applying, you agree to our terms” doesn’t meet the specificity bar either law expects.\u00a0<\/span><\/p>\n

Consent needs to state what data is collected, why, how long it’s kept, and who it might be shared with (background check vendors, <\/span>AI interview scheduling<\/b> tools, assessment platforms).<\/span><\/p>\n

Data Retention: How Long Can You Actually Keep a Resume?<\/b><\/h3>\n

This is the single most common compliance gap in recruitment. Neither GDPR nor the DPDP Act sets one universal retention number; both require you to define a <\/span>purpose-based retention period<\/b> and justify it.\u00a0<\/span><\/p>\n

But regulatory guidance gives usable benchmarks:<\/span><\/p>\n