India's Digital Personal Data Protection Act treats a candidate's assessment score as personal data. Processing it requires either consent or one of a short list of legitimate uses — there is no legitimate-interest ground. The DPDP Rules, notified on 13 November 2025, give most employers 18 months to comply, with penalties reaching ₹250 crore for security failures.
That is the legal position. The operational position is harder, because assessment data is a category the drafters did not address directly, and the obligations it inherits sit awkwardly against how psychometrics actually works.
Two grounds, and "we are the employer" is probably not one of them
The DPDP Act, 2023 (Act No. 22 of 2023, assented 11 August 2023) recognises exactly two bases for processing personal data: consent, and a closed list of "certain legitimate uses" in Section 7. As the Future of Privacy Forum's explainer notes, that list deliberately omits the GDPR's contractual-necessity and legitimate-interest grounds. There is no catch-all.
Section 7(i) covers processing "for the purposes of employment or those related to safeguarding the employer from loss or liability". For existing employees that largely works. For candidates it is contested: a job applicant is not an employee, and Indian privacy practitioners treat pre-employment application of the clause as unsettled rather than settled in employers' favour. Section 7(a) — data a person voluntarily provides for a specified purpose, without objecting to its use — plausibly covers the CV and the test the candidate chose to sit. It does not stretch to a purpose invented later.
The practical consequence for assessment teams is narrow and specific:
Probably within Section 7(a) voluntary provision
- The responses and score from a test the candidate knowingly sat for this role
- Contact details supplied to receive the invite and the result
Probably needs explicit consent
- Reusing last year's score to screen for a different role
- Adding the candidate to a talent pool after the vacancy closes
- Running inferred-trait analytics the candidate was never told about
- Sharing scores with a client or group company
Three of those four are things most ATS configurations do by default.
What the Rules changed
The DPDP Rules, 2025 (G.S.R. 846(E)) commence in stages. Rules 1, 2 and 17–21 took effect on notification; Rule 4, on Consent Manager registration, at the twelve-month mark; and the substantive obligations — Rules 3 and 5 to 16 — 18 months after notification, which lands in mid-May 2027. Consent Managers must be Indian companies. Rights requests must be answered within 90 days.
Four substantive rules bear directly on an assessment pipeline.
Rule 3 — the notice. It must stand on its own, in plain language, with an itemised description of the personal data collected, the specified purposes, a link to the fiduciary's site or app, and the mechanics of withdrawing consent and complaining to the Data Protection Board. "By continuing you accept our privacy policy" at the foot of a test login page does not meet this.
Rule 7 — breach reporting. Affected individuals and the Board must be told without delay, with a detailed report to the Board within 72 hours of becoming aware. An item bank leak becomes a reportable event on a 72-hour clock, not a quiet re-authoring project.
Rule 8 — erasure. Note what it does not do. It fixes a retention period (three years from the data principal's last approach, with 48 hours' notice before deletion) only for the Third Schedule classes — e-commerce entities, online gaming intermediaries and social media intermediaries above specified user thresholds. An employer running hiring assessments is generally not in that Schedule, so there is no statutory clock to hide behind. The obligation reverts to Section 8(7): erase once consent is withdrawn or it is reasonable to assume the specified purpose is no longer served — a test you must define yourself and defend later. Rule 8(3) separately requires certain logs to be kept for a minimum of one year, so "delete everything quickly" is not compliant either.
Rule 13 — Significant Data Fiduciaries. Entities designated under Section 10 must appoint an India-based Data Protection Officer reporting to the board, engage an independent data auditor, run Data Protection Impact Assessments annually, and exercise due diligence that algorithmic software they deploy does not risk data principals' rights. That last clause is the one AI-scored assessment should be reading twice.
The retention conflict nobody has resolved
The real tension here is not legal but methodological. Good assessment practice requires keeping data. You need item-level responses to recalibrate a bank and retire drifting items. You need score distributions to re-verify a cut score and refresh norms. You need group membership to run adverse-impact analysis at all. The Standards for Educational and Psychological Testing (AERA, APA and NCME) treat documented validity and fairness evidence as a condition of defensible use, and US employers have a direct mandate for it — 29 CFR 1607.4 requires records of selection-procedure impact by sex and by race or ethnic group.
India has no equivalent mandate, and that is the trap: with no law requiring retention, the "compliance with any law" carve-out in Section 8(7) does not cover your validation archive. "We need them for validity work" is not a legal basis.
The resolution is to stop treating it as one dataset. Three different things sit under one label:
Short-lived and identified
- Name, email, phone, CV, candidate report, proctoring video
- Purpose expires when the requisition closes or the agreed talent-pool window ends
Long-lived and not personal data
- Item-level response matrices with identifiers irreversibly severed
- Aggregate score distributions and subgroup pass rates
Long-lived and still personal data
- Anything pseudonymised where you keep the re-identification key
Only the second category can safely outlive the hiring purpose, and only if the severing is genuinely irreversible. Teams routinely mislabel the third as the second.
Proctoring is where this bites hardest. Raw video is the most sensitive, highest-volume and least analytically useful artefact in the pipeline. An integrity classification — the approach AssessAll takes with integrity bands rather than retained footage — carries the decision-relevant signal at a fraction of the exposure. The same logic favours candidate-held evidence: a Skill Passport the candidate controls shifts the record outside your fiduciary perimeter.
What the Act does not give candidates
DPDP is narrower than GDPR in two ways that matter here. It creates no right to data portability, and no right not to be subject to a solely automated decision — the equivalent of GDPR Article 22 is simply absent. Nor does the Act create a special category of sensitive data, so an aptitude score and a psychological inventory attract the same baseline treatment.
Two caveats stop that being good news. Section 8(3) requires completeness, accuracy and consistency where personal data is used to make a decision affecting the data principal — which turns an unreliable score used for a rejection into a data-quality obligation, not merely a psychometric embarrassment. And if you hire into Europe the stricter regime governs anyway: the EU AI Act classes AI used in recruitment and selection as high-risk. Most organisations will build one stack to the stricter specification, not two.
One more threshold is easy to miss. A "child" under the Act is anyone under 18, and verifiable parental consent is required. Any skilling, ITI-entry or school-linked assessment programme touching 16- and 17-year-olds is in scope.
Six questions to settle before mid-2027
- For each assessment you run, which ground applies — Section 7(a), Section 7(i), or consent — and is that written down?
- Does your test-login notice meet Rule 3 on its own, without reference to a site-wide policy?
- What event ends the "specified purpose" for a candidate record, and what deletes it when that event occurs?
- Can you produce a de-identified response archive that survives erasure, and is the severing irreversible?
- How long do proctoring artefacts live, and do you need the footage or only the classification?
- Who is accountable if an item bank leaks on a Tuesday evening, and can they report within 72 hours?
Most are configuration decisions, not projects. The expensive version is discovering in 2027 that your validity evidence sits inside records you were obliged to delete a year earlier.
Takeaway: DPDP does not restrict assessment — it restricts vague purposes and open-ended identified storage. Define the purpose precisely, put a clock on the identified record, and keep the psychometric archive de-identified from the start.