The evidence library

The Act does not apply to personal data that the person it relates to has made, or caused to be made, publicly available, or that someone is legally obliged to publish.

• The exemption turns on WHO made the data public: the person themselves, or someone under a legal obligation.
• Content posted by friends or family that tags or names a candidate was not made public by the candidate, so it is not covered.
• The Act does not define 'made publicly available', or say what happens when a post is later made private or deleted.
• Public is not the same as exempt: scraping operations should not assume every visible post falls outside the Act.

Caveat. The scope of the exemption is untested before the Data Protection Board. Whether a vendor's bulk collection for scoring is covered is an open legal question for Kestrel's counsel.

Where the Act applies, personal data may be processed only for a lawful purpose, with consent or for a listed legitimate use. Consent must be free, specific, informed, unconditional and unambiguous, limited to the data necessary for the purpose, and preceded by a notice.

• The notice must describe the personal data and the purpose, and how to withdraw consent and complain.
• Consent covers only the data necessary for the specified purpose.
• Consent in hiring is rarely free: a candidate who refuses fears losing the job.

An employer may process personal data without consent 'for the purposes of employment' or to safeguard itself from loss or liability, with examples such as preventing corporate espionage and protecting trade secrets.

• Every statutory example is defensive and security-specific.
• Commentators read it as not authorising blanket surveillance.
• It refers to employment; whether it extends to applicants who are not yet employees is unsettled.

Caveat. Whether s.7(i) covers social-media screening of applicants has not been decided. Legal counsel must take a view.

Where personal data is likely to be used to make a decision that affects the person, the data fiduciary must ensure its completeness, accuracy and consistency.

• A hiring shortlist is a decision that affects the candidate.
• A profile matched to the wrong person, or a post misread by a model that does not understand its language, fails this duty.

Personal data must be erased when consent is withdrawn or as soon as it is reasonable to assume the purpose is no longer served, and the fiduciary must make its processors erase it too.

• The vendor's 'up to 5 years' retention has no link to the hiring purpose.
• Kestrel remains responsible for making its vendor delete data.

The Rules were notified on 13 November 2025. Most operational duties — notices, security safeguards, breach reporting, retention — apply from 13 May 2027, eighteen months after notification.

• Notices must give an itemised description of the personal data and the specific purpose.
• Kestrel's 2027 hiring cycle will run after the main obligations take effect.

Penalties reach ₹250 crore for failing to take reasonable security safeguards and ₹50 crore for breaches of other provisions of the Act or Rules.

• Penalties are imposed by the Data Protection Board of India.

The Supreme Court held privacy to be a fundamental right and applied a proportionality test to intrusions: a legitimate aim, a rational connection to it, no less restrictive means that would work, and a fair balance between the aim and the intrusion.

• The test binds the State; for a private employer it is the accepted Indian standard for judging whether an intrusion is justified.
• Question 6 of this review — is there a less intrusive way? — is the necessity limb of the test.

Caveat. Applied here as a normative standard. The constitutional test does not bind a private company directly.

Employers may not discriminate on the ground of gender, including transgender identity, in recruitment, wages or conditions of employment for the same or similar work. The Code replaced the Equal Remuneration Act 1976 when the four labour codes took effect on 21 November 2025.

• A signal that penalises women's engagement posts applies a gender-linked penalty at the recruitment stage.

Prohibits discrimination on the ground of disability in employment and requires every establishment to publish an equal opportunity policy.

• Health signals that reveal a disability bring this Act into play.

No establishment may discriminate against a transgender person in employment matters, including recruitment and promotion.

• Gender-linked signals can reach transgender candidates too.

Prohibits discrimination on the basis of HIV status in employment, including denial of employment.

• Applies to private employers. Health content is one way HIV status can surface.

European regulators' guidance on employee and applicant data. Employers should not assume that a public profile may be processed simply because it is public; screening must be necessary and relevant to the job, and applicants must be told.

• 'Availability of access' is not 'permission to process'.
• Consent is rarely valid in employment because of the power imbalance.
• Only information relevant to the job may be collected.

Caveat. Reference only: EU guidance, not Indian law.

Data revealing racial or ethnic origin, political opinions, religious beliefs, health, sex life or sexual orientation may not be processed except under narrow conditions.

• India's DPDP Act has no equivalent special category, so this is a benchmark for what is widely treated as sensitive.
• Inferring religion or politics from posts is processing of special-category data in the EU.

Caveat. Reference only. The absence of a sensitive category in Indian law does not make these inferences appropriate.

People have the right not to be subject to a decision based solely on automated processing that significantly affects them, with safeguards including human intervention.

• Rejecting applicants below an automated line without human review is the kind of decision Article 22 addresses.

Caveat. Reference only.

AI systems used to place job advertisements, filter applications or evaluate candidates are classified as high-risk, bringing duties on data governance, human oversight and informing affected people.

• Training data must be relevant, representative and examined for bias (Article 10).
• Deployers must assign human oversight and inform people affected (Article 26).

Caveat. Reference only. Shows where international practice for hiring AI is heading.

Employers using automated employment decision tools must commission an annual independent bias audit reporting selection rates and impact ratios by group, publish a summary, and notify candidates in advance.

• The model for the fairness test's impact-ratio table.
• Requires candidate notice before use.

Caveat. Reference only.

A selection rate for any group that is less than four-fifths (80%) of the rate for the group with the highest rate is generally regarded as evidence of adverse impact.

• A rule of thumb, not a test of legality.
• Small groups make ratios unstable; this review does not judge groups under 15 people.

Caveat. Reference only. India has no statutory equivalent.

The FTC treated a company compiling social-media reports for employers as a consumer reporting agency, bringing accuracy duties and the obligation to notify applicants of adverse action.

• Social-media screening vendors carry accuracy and notice duties in the US.

Caveat. Reference only.

A service that scored babysitters' 'risk' from their social media lost access when Twitter revoked its API access, citing a ban on using its data for surveillance or background checks, and Facebook restricted its access pending investigation. The service paused its launch.

• Platform terms can prohibit exactly this use, whatever the law says.
• Kestrel has no evidence the vendor collects data with platform permission.

Recruiters rated job-seeking students' Facebook profiles; the students were followed into their jobs. Ratings were unrelated to supervisor-rated performance, turnover intentions or actual turnover, added nothing beyond standard predictors, and differed across groups, favouring women and White applicants.

• No evidence that social-media impressions predict performance or retention.
• Evidence that they create group differences.

Caveat. Kluemper et al. (2012) reached a more positive result with trained raters; see that entry.

Trained raters' assessments of personality from Facebook profiles correlated with later job performance, on a small employed sub-sample of 56 students.

• Conflicting evidence exists; the research is not one-sided.
• Its raters scored personality traits, not the vendor's signals such as posting time or follower count.

Caveat. Small sample; not a validation of any automated tool. Recorded so the review does not overstate the case against.

Amazon abandoned an experimental résumé-scoring model after finding it downgraded résumés containing the word "women's" and graduates of two women's colleges. It had learned from ten years of mostly male applicants' résumés.

• A model trained on past hiring learns past hiring patterns.
• Why the missing training-data description is a serious gap.

59% of surveyed Indian employers used social media to research candidates, a further 33% planned to, and about 68% of those who found negative content decided against hiring.

• The practice is common in India; this review is about doing it at scale and by machine.

Caveat. An older employer survey; current figures may differ.