AI Interviews and Compliance in India: What HR Teams Must Know About DPDP Act 2023

When Indus Towers needed to screen 10,000 applicants in 48 hours, they used AI-powered voice interviews. The process worked. But it also created a compliance obligation that most HR teams are not yet structured to handle: every one of those candidates is now a data principal under the Digital Personal Data Protection Act 2023, with enforceable rights over audio recordings, AI-generated scores, and automated hiring decisions.

The DPDP Act 2023 received Presidential assent in August 2023. The rules are being finalised, but the obligations are not hypothetical — companies that deploy AI interview platforms today are accumulating compliance liability in real time. This guide covers what the law actually requires, where most AI interview deployments fall short, and how to evaluate whether your current vendor meets the bar.

Why AI Interviews Are a Distinct Compliance Challenge

Traditional phone screens and video interviews create a compliance surface. AI interviews create a substantially larger one.

Consider what an AI interview platform captures versus a human-led phone screen:

Data Category | Human Phone Screen | AI Voice Interview

Audio recording | Sometimes, rarely stored | Always — stored, transcribed

Transcript | No | Yes — full verbatim

AI-generated score | No | Yes — structured numerical output

Derived attributes (sentiment, fluency, confidence) | No | Yes — inferred from audio

Automated shortlist decision | No | Often yes

Data retention | Ad hoc | Systematic, in vendor cloud

The DPDP Act concerns itself primarily with personal data processed by a data fiduciary (the employer) with the support of a data processor (the AI interview vendor). In an AI interview context, you are both the data fiduciary and the party ultimately accountable for every obligation the Act creates.

The additional wrinkle for AI interviews specifically: the Act's provisions around automated decision-making and the right to grievance redressal become directly relevant when a candidate is rejected by an algorithm rather than a human.

DPDP Act 2023: The Provisions That Apply Directly to AI Hiring

The following provisions are not edge cases — they are directly triggered by a standard AI interview deployment.

Section 4 — Purpose Limitation

Personal data may only be processed for the specific purpose for which consent was obtained. If a candidate consents to an AI phone screen for a warehouse operations role, you cannot use the same audio recording to train a future AI model, evaluate them for an unrelated role, or share the data with a sister company.

In practice: your data processing agreement with the AI interview vendor must explicitly restrict secondary use of candidate data. Many vendor contracts, particularly those with US-headquartered companies, contain broad model training clauses. These clauses are non-compliant under Section 4 without separate explicit consent.

Section 5 — Consent Requirements

Consent must be free, specific, informed, unconditional, and unambiguous. It must be obtained through a clear affirmative action. For AI interviews, this means:

• Candidates must be told before the interview begins that an AI system will conduct and score the interview
• The consent request must name the types of data being collected (audio, transcript, AI-derived scores)
• Consent to participate in the hiring process cannot be bundled with consent to AI processing — these are separate decisions
• Consent obtained by coercion (e.g., "complete the AI interview or your application will be rejected without human review") is legally questionable

The Act does not permit bundled consent — a single checkbox covering multiple, distinct processing activities is insufficient.

Section 6 — Notice Requirements

Before or at the time of collecting personal data, the data fiduciary must give a notice containing:

• The personal data being collected
• The purpose of processing
• The manner in which the data principal may exercise their rights
• The identity and contact details of the Data Protection Officer (if applicable)

For AI interviews, the pre-interview notice must be substantive, not a generic privacy policy link. Candidates need to understand, in plain language, that their voice is being processed by an AI system to generate a score that influences a hiring decision.

Section 9 — Children and Age Verification

If you deploy AI interviews for campus recruitment — graduate hiring, apprenticeship programs — and any candidates are under 18, Section 9 requires verifiable parental consent. This is not a negligible concern for companies running large-scale campus drives. BabbleBots' campus recruitment deployments, including programs supporting clients like Growisto, account for this requirement at the point of invite dispatch.

Section 12 — Right to Erasure

A data principal can request erasure of their personal data at any time. For AI interview data, this means:

• The audio recording must be deleted
• The AI-generated transcript and scores must be deleted
• Any derived attributes must be deleted
• The erasure must propagate to sub-processors (i.e., your AI interview vendor must delete the data from their systems, not just mark it as inactive)

You need a documented process for handling erasure requests, and your vendor contract must require the vendor to complete erasure within a defined SLA. The Act does not specify a number of days, but 30 days is the emerging benchmark in vendor agreements.

Section 17 — Significant Harm Obligations

The Act defines "significant harm" to include discrimination on specified grounds. An AI interview system that produces scores correlated with protected characteristics (gender, religion, caste) and uses those scores to make automated rejection decisions creates a Section 17 exposure. This is the provision that makes bias auditing a legal obligation, not just a best practice.

Practical Obligations for HR Teams

1. Consent Flow Design

Your consent process for AI interviews needs to be a discrete, documented step — not buried in an application form or implied by participation. Best practice:

• Candidate receives an interview invite that clearly states: "This interview will be conducted by BabbleBots' AI voice system. The interview will be recorded. Your responses will be transcribed and scored by an AI algorithm. These scores will be used to determine whether you proceed to the next stage."
• Before the interview starts, the candidate must click an affirmative consent button — not just proceed
• The consent record (timestamp, candidate ID, version of consent text) must be stored and producible on request

For Hindi and regional language hiring — which accounts for a significant share of frontline hiring in India — consent notices must be in the candidate's language. Section 6 requires notices in a language the data principal can understand.

2. Data Minimisation

Collect only what is necessary for the stated purpose. If you are screening for a telecalling role, you need communication clarity and role comprehension — you do not need sentiment scoring or analysis of speech patterns beyond what is relevant. Work with your vendor to configure which data fields are captured and retained.

3. Retention Policies

You need a written data retention policy specific to AI interview data. Recommended framework:

• Hired candidates: retain interview data for the duration of employment plus 3 years (consistent with HR records norms)
• Rejected candidates: delete within 90 days of the final hiring decision, unless the candidate has an active grievance or legal challenge pending
• Withdrawn applications: delete within 30 days of withdrawal

This policy must be reflected in your vendor's data processing agreement, with deletion confirmations logged.

4. Cross-Border Data Transfer

If your AI interview vendor processes data on servers outside India — including AWS, Google Cloud, or Azure regions in the US or Europe — you are executing a cross-border data transfer. The DPDP Act permits this only where the Central Government has approved the recipient country (or the transfer meets specified conditions). The approved country list has not yet been finalized under the rules.

This is a live risk. Before signing with any AI interview vendor, confirm where interview data is stored and processed. India-region data storage (AWS ap-south-1, Azure Central India) eliminates this issue.

Bias Audit Requirements

Section 17 creates the underlying obligation. Equal Opportunity norms (under the Rights of Persons with Disabilities Act 2016, and relevant labour law provisions) add to it. The Ministry of Labour and Employment's draft AI governance guidance suggests that automated hiring tools should be subject to regular bias audits.

What a bias audit for an AI interview system involves:

1. Statistical disparate impact analysis — does the AI system score candidates from different demographic groups (gender, region, language) significantly differently on equivalent responses?
2. Adverse action audit — at what rate are candidates from different groups rejected by the AI vs. advanced to human review?
3. Feature audit — does the model use features that are proxies for protected characteristics (accent, speech pace, particular vocabulary)?
4. Remediation log — what changes were made following identified bias, and when?

These audits should be conducted annually and documented. The documentation should be producible to the Data Protection Board if a complaint is filed.

How BabbleBots Handles Each Obligation

BabbleBots' AI interview platform was built with India-specific compliance requirements in mind. Here is how each DPDP obligation maps to platform features:

Consent Capture: Every interview session includes a pre-interview consent screen in the candidate's preferred language (English, Hindi, or configured regional language). Consent is a mandatory affirmative step — the interview cannot begin without it. Consent records are logged with timestamp and version.

Purpose Limitation: BabbleBots does not use candidate interview data to train AI models without separate explicit consent. Customer data is isolated per tenant. Sub-processors are contractually restricted from secondary use.

India-Region Data Storage: Interview audio, transcripts, and scores are stored in AWS Mumbai (ap-south-1) by default. Cross-border transfer is not the default configuration.

Retention Settings: Admins can configure retention windows in the platform dashboard. Automatic deletion runs on schedule. Deletion confirmations are logged.

Right to Erasure Workflow: When a candidate submits an erasure request to an employer, BabbleBots provides a deletion API that propagates erasure across all stored data — audio, transcript, scores, and derived attributes — within 7 business days.

DPA Templates: BabbleBots provides a Data Processing Agreement template that covers DPDP Act obligations for customers to sign and retain.

Bias Monitoring: The platform includes demographic analysis reporting that surfaces score distributions by candidate segment. Customers deploying at scale (Indus Towers, Welspun) use this reporting as part of their quarterly HR compliance reviews.

For full capability details, see the AI Interviews product page. If you are evaluating compliance posture before deployment, book a compliance-focused demo.

Vendor Evaluation Checklist: 8 Questions to Ask Any AI Interview Vendor

Before signing with an AI interview vendor, get written answers to these questions:

1. Where is interview data stored and processed? Ask for the specific cloud region. "Global infrastructure" is not an acceptable answer.
2. Does your platform support per-candidate consent capture with an audit log? You need timestamped records, not just a checkbox in a generic application flow.
3. What is your data retention policy, and can we configure custom retention windows? Vendor-imposed 12-month default retention creates liability for you.
4. Do you use customer interview data to train your AI models? If yes, does this require separate consent? Read the DPA carefully.
5. What is your SLA for responding to candidate erasure requests? This should be in writing, in your contract.
6. Do you conduct bias audits on your scoring models? Can we see the last audit report? Refusal to share audit results is a red flag.
7. Do you provide a Data Processing Agreement that covers DPDP Act 2023 obligations? A generic GDPR DPA is not sufficient for Indian deployments.
8. What happens to our data if we terminate the contract? You need a documented data return and deletion process.

Red Flags: What Non-Compliant Vendors Look Like

No India-region data storage option. If all processing happens in US-region servers and the vendor treats this as a non-issue, they have not engaged with the cross-border transfer provisions of the DPDP Act.

Bundled consent in the application form. If the AI interview consent is a clause in the application T&Cs rather than a discrete pre-interview step, the consent is legally vulnerable.

No erasure capability. If the vendor cannot delete a specific candidate's data from all their systems — including backups — within a defined SLA, they cannot support your Section 12 obligations.

Broad model training clauses in the DPA. If the contract permits the vendor to use your candidates' interviews to train their AI, that is a secondary use that requires explicit, separate consent you almost certainly have not obtained.

No bias audit documentation. A vendor that has never audited their scoring model for demographic bias is not a vendor you can credibly deploy at scale under the current regulatory environment.

Vague data sub-processor list. The vendor's AI scoring engine, transcription service, and storage provider are all sub-processors. You are accountable for their compliance. If the vendor cannot name them, you cannot assess the risk.

Related Reading

For practical guidance on AI candidate screening at scale in India, including how to structure screening workflows for high-volume frontline hiring, see our enterprise screening guide.

If you are ready to evaluate BabbleBots for compliant AI interview deployment, book a demo and we will walk through your specific use case, data volume, and compliance requirements.

Frequently Asked Questions

<script type="application/ld+json"> { "@context": "https://schema.org", "@type": "FAQPage", "mainEntity": [ { "@type": "Question", "name": "Is AI interviewing legal in India?", "acceptedAnswer": { "@type": "Answer", "text": "Yes, AI interviewing is legal in India. There is no prohibition on using AI systems to conduct or score interviews. However, the Digital Personal Data Protection Act 2023 (DPDP Act) creates binding obligations for any company that deploys AI interview tools — including requirements for explicit consent, purpose limitation, data minimisation, the right to erasure, and protections against automated decisions that cause significant harm. Legal does not mean obligation-free." } }, { "@type": "Question", "name": "Do candidates need to give explicit consent to an AI interview in India?", "acceptedAnswer": { "@type": "Answer", "text": "Yes. Under Section 5 of the DPDP Act 2023, consent must be free, specific, informed, unconditional, and expressed through a clear affirmative action. Consent to the AI interview cannot be bundled with general application consent — it must be a separate step, taken before the interview begins, with a clear explanation of what data is collected and how it will be used. Consent notices must be available in the candidate's language." } }, { "@type": "Question", "name": "What data does an AI interview platform collect?", "acceptedAnswer": { "@type": "Answer", "text": "A typical AI voice interview platform collects: audio recording of the interview, a verbatim transcript, AI-generated scores across evaluated dimensions (communication, role comprehension, etc.), and derived attributes such as confidence scores or sentiment indicators. It may also collect metadata — interview timestamp, device type, connection quality. All of this constitutes personal data under the DPDP Act." } }, { "@type": "Question", "name": "How long can companies keep candidate interview data in India?", "acceptedAnswer": { "@type": "Answer", "text": "The DPDP Act requires that personal data be retained only as long as necessary for the stated purpose. For rejected candidates, a 90-day retention period post-decision is a reasonable and defensible policy. For hired candidates, interview data can be retained for the duration of employment plus a defined post-employment period (typically 3 years, consistent with HR records norms). You must document your retention policy and configure your vendor platform to enforce it." } }, { "@type": "Question", "name": "What happens if a candidate requests deletion of their AI interview data?", "acceptedAnswer": { "@type": "Answer", "text": "Under Section 12 of the DPDP Act 2023, candidates (as data principals) have the right to request erasure of their personal data. When a request is received, you are obligated to delete the audio recording, transcript, AI scores, and all derived attributes — and to ensure your AI interview vendor propagates the deletion across their systems, including sub-processors. You should have a documented process for handling these requests and an SLA with your vendor for deletion completion." } } ] } </script>

Is AI interviewing legal in India?

Yes, AI interviewing is legal in India. There is no prohibition on using AI systems to conduct or score interviews. However, the DPDP Act 2023 creates binding obligations — consent, purpose limitation, data minimisation, right to erasure, and protections against automated decisions that cause significant harm. Legal does not mean obligation-free.

Do candidates need to give explicit consent to an AI interview in India?

Yes. Under Section 5 of the DPDP Act 2023, consent must be free, specific, informed, unconditional, and expressed through a clear affirmative action. It cannot be bundled with general application consent — it must be a discrete pre-interview step, in the candidate's language, explaining exactly what data is collected and how it will be used.

What data does an AI interview platform collect?

A typical AI voice interview platform collects: audio recording, verbatim transcript, AI-generated scores, and derived attributes such as sentiment or confidence indicators. All of this is personal data under the DPDP Act. Some platforms also capture metadata — device type, connection quality — that may constitute personal data depending on context.

How long can companies keep candidate interview data in India?

The Act requires data be retained only as long as necessary for the stated purpose. A defensible policy: 90 days post-rejection for unsuccessful candidates, duration of employment plus 3 years for hired candidates. This must be documented and enforced at the vendor level, not just in internal policy.

What happens if a candidate requests deletion of their AI interview data?

Under Section 12, candidates can request erasure of all their personal data. For AI interviews, this means deleting audio, transcript, scores, and derived attributes — including from vendor systems and sub-processors. You need a documented request-handling process and a vendor SLA for completion. BabbleBots completes erasure across all systems within 7 business days.