Recruiting compliance in India works through data protection, labour, and workplace law, not a dedicated AI statute. Several of these laws have just changed, but most obligations aren't fully in force yet.
Core Legal Laws
- DPDP Act and Rules: Phased rollout through May 2027, so most substantive data obligations don't bind yet.
- Four Labour Codes: Took effect nationally in November 2025, though state-level rules are still being finalized.
- No Single Anti-Discrimination Law: Protection comes from scattered statutes like the POSH Act and disability rights law, not one unified rule.
- MeitY's AI Guidelines: Real, government-published, but entirely voluntary, with no binding AI law planned.
Skima AI supports human-reviewed scoring, documented rejection reasons, and job description checks that reduce discrimination risk. It's built to help recruiters stay compliant as India's Labour Code rules and DPDP deadlines continue to land.
Three legal areas affect every AI hiring decision made in India today. Data protection, labour law, and workplace discrimination protections all apply, whether recruiters realize it or not. The four Labour Codes took effect on November 21, 2025, and the DPDP Rules followed two days earlier.
Neither law was written with AI in mind, and neither is fully in force yet. That gap creates a real, practical risk for any recruiter relying on AI to screen candidates. Many assume their screening tool is already fully covered when it usually isn't yet. Here's what actually applies to your hiring process today, and what changes are still to come.
What Actually Governs AI Hiring in India?
None of these laws were written with AI in mind. Still, recruiters often assume there’s more protection than there is. Understanding the compliance below is more important than waiting for a dedicated AI law that won’t arrive soon.
Digital Personal Data Protection Act and Its Phased Rules
The Digital Personal Data Protection Act became law in 2023, but it sat unimplemented for two years. The implementing rules finally arrived on November 13, 2025, rolling out obligations across three separate phases. The Data Protection Board was established immediately, and consent manager registration follows in November 2026.
The obligations most recruiters actually care about, lawful processing and candidate notice, don't bind until May 2027. Many employers already assume the full law applies today, and that assumption is currently incorrect.
The Four Labour Codes and Recruitment
The four Labour Codes replaced 29 older labour statutes, taking effect nationally on November 21, 2025. They cover wages, industrial relations, social security, and occupational safety, touching recruitment at several points. Central Rules under the Codes weren't notified until May 8, 2026, months after the Codes themselves took effect.
Mandatory appointment letters, one concrete recruitment-facing requirement, are now a legal obligation under the new Codes. State-level rules under these same Codes are still being finalized, which the next section covers directly.
Why India Has No Single Anti-Discrimination Law?
The US has Title VII, the UK has the Equality Act, and India has neither equivalent. Articles 15 and 16 of the Constitution prohibit discrimination, but only by the state and public sector. Private employers fall entirely outside that constitutional protection, according to established Indian legal commentary.
Protection instead comes from scattered, narrower laws, the POSH Act, disability rights law, and equal-pay principles. An AI hiring tool that discriminates by caste, religion, or gender faces no single unified statute in response.
One National Law, Many State Timelines
Labour remains on India's Constitutional Concurrent List, meaning both the center and every state can legislate. The four Labour Codes are national law, but each state must still write and notify its own rules. As of a July 2026 government reply to Parliament, most states have only published draft rules so far.
A handful of states have finalized their own rules, while others are still gathering public comment. That means a recruiter in Maharashtra and one in Karnataka may face different compliance timelines right now. This is the real answer to whether India has state-specific law, one statute, uneven state-level timing.
Recruiters hiring across multiple states should track each relevant state's rule-notification status individually, not assume uniformity.
AI Guidance Exists in India But Isn't Law
MeitY, India's IT ministry, published official AI Governance Guidelines on November 5, 2025, under the IndiaAI Mission. The guidelines rest on a "Do No Harm" principle, spanning seven core principles the ministry calls sutras. They're sector-agnostic and entirely voluntary, relying on existing regulators and laws for actual enforcement.
The government has explicitly stated it isn't planning a binding, umbrella AI law anytime soon. Nothing in these guidelines addresses recruitment or hiring specifically, despite covering bias and discrimination broadly.
Treat them as a genuine signal of direction, not a compliance requirement you can be held to. That distinction matters enough that the next section turns it into concrete recruiter action.
What Compliant Recruiters Actually Do in India
You can turn this fragmented legal picture into a single, repeatable hiring process. We have created 5 actionables, and none of them require waiting for a binding AI law that may never arrive in the shape recruiters expect. Building these habits now also means less rework once the DPDP Act and state Labour Code rules fully take effect.
1. Map Which Private-Sector Protections Actually Apply
Confirm whether the POSH Act, disability rights law, or equal-pay principles apply to a given hiring decision. None of these laws work as a single umbrella, so each has to be checked separately. Screening tools that flag caste, religion, or gender indirectly still create real legal exposure regardless.
2. Track State Labour Code Rules as They Land
Identify every state where you actively hire, and follow that state's Labour Code rule-notification status. Don't assume the national Labour Codes alone govern you, since state rules can add further detail. Multi-state employers should build a simple tracker, updated monthly, rather than checking this occasionally.
3. Apply DPDP-Consistent Data Handling Now
Treat candidate data with DPDP-level care today, even though most obligations don't bind until 2027. Confirm a lawful basis exists before any AI tool processes or scores a candidate's personal information. Building this habit early avoids a scramble when the substantive DPDP obligations finally take effect.
4. Disclose AI Use Without Waiting for a Mandate
No Indian law currently requires you to tell candidates that AI is screening them. Disclosing it voluntarily builds candidate trust and gets ahead of MeitY's stated direction of travel. The AI Governance Guidelines explicitly name transparency as a principle, even without enforcement power behind it.
5. Vet AI Vendors for Data Residency and Oversight
Ask every AI vendor exactly where candidate data is processed, stored, and eventually deleted. Confirm a human reviews every AI-driven hiring decision, even though no Indian law requires it yet. A lighter regulatory bar today doesn't lower the reputational risk of getting this wrong later.
What Non-Compliance Actually Costs in India
None of these penalties come from an AI-specific regulator, since India doesn't have one. They come from data protection, labour, and workplace safety bodies that predate AI entirely. Using AI to hire doesn't shrink this exposure, it simply adds another layer worth documenting carefully.
How Skima AI Helps as an India Recruiting Compliance Ready Tool?
Skima AI has a core design of human-in-the-loop that's best in a market where almost no binding AI-specific rule exists yet. Every score, shortlist, and rejection Skima AI produces still needs a human to authorize it. That gives a recruiter documented oversight to point to, ahead of any binding Indian AI law.
Moreover, Skima AI processes candidate resumes and personal data entirely within its own models, not a public API. That infrastructure is located in Dublin, Ireland, governed by strict European data protection rules. Employers still need to confirm this setup satisfies their own DPDP cross-border transfer conditions once those apply.
Additionally, job descriptions get checked for biased or exclusionary language before Skima AI ever posts them live. That matters given how narrowly India's actual anti-discrimination protections are currently written. Protected characteristics are also excluded from scoring by contractual obligation, regardless of what Indian law technically requires.
A disqualified candidate always gets tagged with the exact requirement they failed to meet. That documentation becomes useful evidence once India's DPDP obligations and state Labour Code rules fully land.
None of this creates an Indian compliance obligation Skima AI satisfies on your behalf. You remain responsible under the DPDP Act, the Labour Codes, and every applicable state rule. A documented, human-reviewed process just gives you something concrete to show once those rules fully apply.
Indian Recruitment Compliance Checklist
Use this checklist to turn the sections above into a working India hiring process.
Final Note - What Recruiters Will Do Next?
Recruiters who wait for a single, comprehensive Indian AI law will wait past their next audit. The more useful move is tracking three moving parts at once, not waiting for one. Those parts are your state's Labour Code rules, the DPDP Act's 2027 deadline, and any MeitY update.
Build your hiring process around whichever of these already connects you, not the one that sounds most complete. Document human review now, since it costs nothing today and becomes real evidence later. The recruiters who get ahead here treat partial law as real law, not as a reason to wait.
Frequently Asked Questions
1. How does the new DPDP Act specifically change how our ATS handles resume storage and consent?
Once substantive DPDP obligations apply in May 2027, your ATS will need explicit candidate consent, clear retention limits, and a lawful basis documented for every resume stored.
2. What are the legal compliance risks if we hire independent contractors instead of full-time employees in India?
Misclassifying employees as contractors risks reclassification claims, back-payment of benefits, and Labour Code penalties. Courts examine actual working conditions, not just the contract's label, when deciding true employment status.
3. What specific state-level Shops and Establishments Act rules do I need to follow for a remote team across multiple states?
Each state's Shops and Establishments Act sets its own working hours, leave, and registration rules. Remote teams spanning states should confirm each state's specific requirements individually, not assume uniformity.
