Interview Recordings Under the DPDP Act: Consent, Retention and Who Can Access Them

Under India's Digital Personal Data Protection (DPDP) Act, the employer consent exemption in Section 7(i) covers employees, not job candidates, so a candidate's consent to being recorded during an AI interview should be collected separately and up front. Retention has no fixed number in the Act itself: keep the recording only as long as a named purpose, typically the hiring decision and its dispute window, actually requires, then delete it on schedule. Access should be limited to named roles with a specific reason to open the file, logged by who viewed it and when, rather than left open to the whole hiring panel.

Key takeaways

• Section 7(i)'s employment exemption was built for people already on the payroll; it likely does not cover a candidate who has not yet been hired, so consent to recording should be collected separately and before the interview starts.
• The DPDP framework sets no fixed retention period for interview recordings; tie the retention window to a named purpose and delete the file once that purpose is served.
• Named, role-based access with a simple access log is more defensible than a stricter-sounding blanket policy nobody can verify after the fact.
• A background-verification vendor processing the recording is a Data Processor under Section 8(2) and needs a written contract naming that processing, not a generic third-party clause.
• The DPDP Rules were notified on 13 November 2025 with an 18-month phased rollout, putting full compliance around 13 May 2027; the steepest penalty, up to Rs 250 crore, is specifically for failing reasonable security safeguards against a breach, not a blanket fine.

Do you need separate consent to record a candidate interview?

Yes. Candidate consent to an AI interview recording needs its own purpose-specific notice, separate from a hiring exemption written for employees and separate from any blanket line buried inside a job application form.

Section 7(i) of the DPDP Act lets an employer process personal data without consent "for the purposes of employment," plus related purposes like protecting the business from loss. The provision keeps referring to a Data Principal who is already an employee, and legal commentary on Section 7(i) reads it the same way: a carve-out for people already on the payroll, not applicants who have not been hired yet (Legal500). A candidate sitting through a first-round interview is, legally, still a stranger to the company, so leaning on the employment exemption here is an argument an employer would have to defend. A separate clause, Section 7(a), covers data someone voluntarily hands over for a stated purpose, such as a resume, but not a recording made afterward.

The operational answer is a consent notice naming what is being recorded, why, and for how long, delivered before the interview starts rather than retrofitted into a privacy policy afterward. A consent notice written the morning an interview begins is not a notice; it is paperwork. Being upfront also shapes candidate trust in AI-assisted hiring, already thin in high-volume AI screening.

A consent notice written the morning an interview begins is not a notice. It is paperwork.

How long can you keep an AI interview recording?

There is no single number in the DPDP Act for interview recordings. The principle is purpose-based: keep a recording only as long as the reason you collected it still applies, then delete it. The Rules treat the record that consent was given as a separate artifact from the recording, and compliance guides do not agree on exactly how long a consent record should be kept, so check that detail against the Rules text rather than a borrowed number.

For the recording, tie the window to a named purpose:

Once the purpose is served, delete the recording on schedule. Keeping it "just in case" is itself a retention decision, and the harder one to defend if a candidate asks what happened to their data.

Who should be allowed to access a stored recording?

Named, role-based access, not blanket panel access. The recruiter who evaluated the candidate and a compliance reviewer checking the process have a specific reason to open the file. Most of the rest of a hiring panel does not.

A simple access log, who viewed the file and when, does more to make this defensible than a stricter-sounding policy nobody can prove they followed.

The question is not whether a recording exists. It is whether you can say, specifically, who opened it and why.

This is also a product design choice: evidence-linked scoring only works if the people who review a decision can still open the recording, which is a reason to scope access tightly rather than restrict the recording itself.

What happens when a background-verification vendor also touches the recording?

A background-verification vendor processing the recording on the employer's behalf is a Data Processor under Section 8(2) of the DPDP Act. The Act is specific here: a Data Fiduciary may engage a processor "only under a valid contract" (Section 8, DPDP Act), not a vendor's standard terms of service.

Two consequences follow: name the vendor's role specifically in the notice (identity check, employment history, education verification) rather than a general third-party clause, and disclose each verification type on its own rather than bundled.

What is the compliance deadline, and what is actually at stake?

The Digital Personal Data Protection Rules, 2025 were notified on 13 November 2025, starting an 18-month phased rollout that puts full substantive compliance around 13 May 2027 (S.S. Rana & Co.). Some obligations apply from the notification date; others phase in over the following 18 months.

The headline penalty gets repeated imprecisely. The DPDP Act's Section 33 schedule sets a maximum of up to Rs 250 crore specifically for failing to take reasonable security safeguards that results in a breach, and a separate maximum of up to Rs 200 crore for failing to notify the Data Protection Board or affected individuals (Section 33 schedule). It is not a blanket fine: the amount scales with the failure's nature, gravity and duration, and how fast the company responded.

The practical argument for acting before the mid-2027 deadline is not legal risk alone. A purpose-specific consent notice, a retention schedule and a named access list are operational changes a talent acquisition team can make this quarter, not a legal filing to leave until the window closes.

Consent, retention and access are one piece of a wider compliance picture for AI-assisted hiring, alongside bias testing and algorithmic transparency, but they are the piece a team can act on fastest. Zinterview's own evaluation design assumes every recording stays retained and reviewable for the people who scored it, which is why this needs a specific answer rather than a vague policy.

See how Zinterview keeps every recording evidence-linked and access scoped by design, not bolted on after a compliance review. Book a demo.

Frequently Asked Questions

Can you record a candidate interview without telling them?
No. Notice and purpose-specific consent should be given before recording starts, not disclosed afterward in a privacy policy.

Does the DPDP Act apply if the AI interview platform is hosted outside India?
Yes. The Act follows the location of the data principal, so a recording of a candidate based in India is covered even if processing happens on servers abroad.

How is candidate data different from employee data under the DPDP Act?
A candidate has not yet been hired, so the employer-focused exemption in Section 7(i) was built for employees and does not clearly extend to pre-hire screening and recording.

What should a candidate consent notice actually include?
The purpose of the recording, the retention window, who can access it, the role of any vendor involved, and how the candidate can withdraw consent.