AI in Hiring and Employee Monitoring: DPDP, Labour Codes and the EU AI Act

A candidate in Ranchi applies for a job in Bengaluru. Before any human reads her CV, an AI tool has parsed it, scored her against the job description, analysed her video interview and ranked her below 300 other applicants. Once hired, another tool tracks her keystrokes, screen time and “productivity score”. None of this is science fiction. It’s ordinary HR-tech in 2026.

AI in hiring and employee monitoring sits where three bodies of law meet: India’s DPDP Act, the new labour codes, and, for HR-tech companies selling abroad, the EU AI Act. This guide explains how each applies, the discrimination risks, and the remedies available to candidates and employees.

How AI in hiring and monitoring is used today

AI in hiring now covers the whole funnel: sourcing candidates from online profiles, parsing and ranking CVs, chatbot screening, gamified assessments, video interview analysis, and background checks. Employee monitoring tools track logins, activity levels, emails, location for field staff, and sometimes biometric data such as facial recognition for attendance.

These tools promise speed and objectivity, but they carry real legal risks. They process large amounts of personal data, sometimes sensitive. They can reproduce bias from historical hiring data. And they’re often opaque: neither the candidate nor the HR team can explain why someone was rejected or flagged.

India has no AI-specific employment law. Instead, AI in hiring is governed by general laws, chiefly the DPDP Act for data, the labour codes for employment terms, and constitutional and statutory equality principles, plus foreign laws for companies with global operations. Staff use of AI tools raises a related problem of confidentiality; see our guide to AI tools at work and confidentiality.

What the DPDP Act means for candidates’ and employees’ data

The DPDP Act, 2023, whose main obligations apply from 13 May 2027, governs almost every piece of data an AI hiring or monitoring tool touches. Employers can rely on a “legitimate use” for certain employment purposes under Section 7, which covers processing for the purposes of employment and safeguarding the employer from loss or liability, such as preventing corporate espionage. That doesn’t give employers unlimited freedom: processing must still be for the specified purpose, and the security, accuracy, retention and breach-reporting duties apply in full.

Candidates are a different matter. A person who has only applied for a job isn’t yet an employee, so employers and HR-tech vendors should be careful about relying on the employment legitimate use for candidate data. Clear notices, consent where needed, and strict limits on data collected and how long it’s kept are the safer course, especially for video interview analysis and scraping candidate profiles from the web.

The Act also requires reasonable security safeguards, with penalties of up to ₹250 crore for failures, and gives individuals rights to access a summary of their data, correct it and have it erased. An employee who asks what monitoring data the company holds about them is exercising a legal right, not making an awkward request. Our DPDP Act compliance checklist and guide to consent managers cover the mechanics.

Labour codes, discrimination and fairness

India’s new labour codes, in force since 21 November 2025, don’t regulate AI directly, but they matter. The Code on Wages prohibits discrimination on the ground of gender in matters of wages and in recruitment conditions for the same or similar work. An AI hiring tool that systematically ranks women lower for a role can expose the employer to claims, even if no human intended the result. The Rights of Persons with Disabilities Act, 2016 adds duties on equal opportunity and reasonable accommodation, and AI assessments that disadvantage candidates with disabilities, such as timed tests or video analysis of facial expressions, can create risk. See our guide to the new labour codes for startups.

Monitoring raises its own fairness questions. Productivity scores generated by AI can be used to justify warnings, pay decisions or terminations. Under the labour codes and general employment law, disciplinary action and dismissal must still follow fair procedure. An unexplained algorithmic score is weak evidence if an employee challenges a dismissal.

Bias doesn’t need to be intentional to be unlawful. The practical answer is human oversight. Use AI to assist decisions, not to make them, keep a human reviewer accountable for every rejection or disciplinary decision, and test tools regularly for disparate outcomes across gender, age, disability and other groups. The same logic applies to platform workers managed by algorithm; see our guide to gig and platform workers.

The EU AI Act and Indian HR-tech companies

For Indian HR-tech startups with European customers, the EU AI Act is the most important foreign law. AI systems used for recruitment and selection, and for decisions on promotion, termination, task allocation and monitoring of workers, are classified as high-risk. High-risk providers must meet requirements on risk management, data governance, technical documentation, logging, human oversight, accuracy and cybersecurity.

After the EU’s 2026 Digital Omnibus, which has been in force since 27 July 2026, the high-risk obligations for these stand-alone systems now apply from 2 December 2027, while the Article 50 transparency rules were not postponed. The Act applies to providers outside the EU whose systems are placed on the EU market or whose outputs are used there, so an Indian company selling a hiring tool to a German employer is a provider of a high-risk AI system. Our guide to the EU AI Act for Indian SaaS companies explains the wider regime.

Vendors and employers should also agree in writing who is responsible for what. An employer using a third-party hiring tool remains answerable to candidates and employees, so contracts should cover bias testing, data protection, security, explanation of decisions and cooperation in disputes. Building to EU standards also prepares Indian HR-tech companies for India’s own direction of travel. MeitY’s AI Governance Guidelines of November 2025 emphasise accountability, transparency and graded liability, and documented testing and human oversight are exactly the evidence of due diligence those principles reward. Autonomous screening agents raise the liability questions in our guide to AI agent liability in India.

Remedies for candidates and employees, and quick answers

Candidates and employees have several routes. Under the DPDP Act, once its main obligations apply, they can ask the employer or vendor for a summary of the personal data processed about them, seek correction of inaccurate data, raise a grievance, and then complain to the Data Protection Board. Employees facing disciplinary action based on monitoring data can insist on a fair inquiry and challenge the decision under the labour codes and their employment contract. Where AI in hiring leads to gender-based discrimination in recruitment or pay, claims can be raised before the authorities under the Code on Wages. For employers, the best protection is a written AI policy for HR, vendor contracts that allocate responsibility for bias testing and data protection, and a documented human review of every significant decision.

Quick answers

Is it legal to use AI in hiring in India?

Yes. There’s no ban, but the DPDP Act, labour codes and anti-discrimination principles apply, and AI should support rather than replace human decisions.

Can employers monitor employees using AI?

Within limits. The DPDP Act allows processing for certain employment purposes, but monitoring must be proportionate, secure and for a specified purpose.

Does the EU AI Act apply to Indian HR-tech companies?

Yes, if their systems are used in the EU. Recruitment and worker-management AI is high-risk, with obligations applying from 2 December 2027.

Final word

At Halverton & Co., we advise founders, technology companies, investors and individuals on HR-tech compliance, employee data, the labour codes and AI governance. We practise in Jharkhand, Maharashtra and before the Supreme Court of India, and act as fractional legal counsel for technology-driven businesses that need senior legal support without a full in-house legal team. Halverton & Co. is built on a simple idea: Where tech needs law! If this issue affects you or your business, write to us at office@halvertonandco.com, or get in touch, and we’ll help you work out where you stand.

This article reflects the law and developments reported up to early October 2026. It is for general information only and is not legal advice. Please take advice on your specific facts before acting.