Does AI interview proctoring need consent under India's DPDP Act?
TL;DR: Yes. India's Digital Personal Data Protection Act (DPDP Act, 2023, with 2025 rules) requires clear notice and explicit consent before collecting personal data like face scans, video, and audio recordings. Companies proctoring interviews for India-based candidates need itemized consent language and a stated retention period, not a clause buried inside a generic offer-process disclaimer.
The claim
Companies that already have GDPR-style consent flows for EU candidates sometimes assume the same language covers India. It doesn't automatically — the DPDP Act has its own specific notice, consent, and data-principal-rights requirements that need to be addressed separately for India-based candidates.
The evidence
The DPDP Act and its 2025 rules establish requirements around clear notice of what data is collected and why, purpose limitation, and a data principal's right to access and erasure — principles that directly apply to biometric identity verification and recorded video/audio from an AI-proctored interview.
Comparison: DPDP Act vs GDPR vs NYC Local Law 144, at a glance
| Regulation | Region | Core requirement for interview proctoring |
|---|---|---|
| GDPR | EU | Lawful basis + explicit consent for biometric data |
| DPDP Act | India | Clear notice + consent, purpose limitation, erasure rights |
| NYC Local Law 144 | New York City | Bias audit disclosure for automated employment decision tools |
| EU AI Act | EU | Risk classification and transparency for AI used in hiring |
Step-by-step: compliant consent for India-based candidates
- Provide a standalone, plain-language notice before the interview explaining what's recorded (video, audio, face-match data) and why.
- Capture explicit, itemized consent — not a bundled checkbox covering unrelated terms.
- State a specific retention period for recordings and biometric data, and honor deletion requests.
- Ensure the consent flow works in the candidate's preferred language where feasible, given DPDP's emphasis on genuinely informed consent.
FAQ
Does this apply to candidates interviewing from outside India for an India-based company? The Act's applicability generally follows the data principal's location and citizenship in relevant contexts — consult counsel for cross-border specifics, but err toward applying the same notice-and-consent standard broadly.
Is a general "we may record this interview" line in an offer letter enough? No — DPDP's notice requirements are more specific than a general disclaimer; itemized notice of what's collected and why is expected.
Do trust reports need to be deletable on request? Yes, in line with data-principal erasure rights, retention and deletion policies should extend to derived data like trust reports, not just raw recordings.
By Pinal Dave Last updated: 2026-08-03