Psychometric Testing and India's DPDP Act: An HR Checklist
Psychometric assessments collect personal data: names, contact details, demographic information and, often, detailed answers about behaviour and attitudes. India's Digital Personal Data Protection Act, 2023 (DPDP Act) sets rules for how that data is handled. This guide is a practical checklist for HR teams. It is general information, not legal advice; take advice from counsel for your own situation.
Where the law stands
The DPDP Act was enacted in 2023. The government notified the DPDP Rules in November 2025, and the obligations are being brought into force in phases. Published analyses differ on exactly when notice and consent duties apply, so check the current position in the official Gazette or with counsel rather than relying on a summary. Good practice does not need to wait: the principles below are sound whenever the formal date falls.
Core principles that matter for assessments
In the language of the Act, the organisation deciding why and how data is used is the data fiduciary, and the person the data is about is the data principal.
- Notice and consent: tell candidates what personal data you collect, for what purpose, and how they can exercise their rights, and obtain consent where consent is the basis.
- Purpose limitation: use the data only for the purpose you told people about. Assessment data collected for a hiring decision should not quietly be reused for something else.
- Data minimisation: collect only what the assessment needs.
- Storage limitation and accuracy: keep data only as long as needed, and keep it accurate.
- Security: protect the data with reasonable safeguards, and have a process for breaches.
- Rights: give people a way to access, correct and request erasure of their data, and to raise grievances.
- Children: special rules apply to people under 18, which matters for campus and early-career programmes.
Questions to ask any assessment vendor
Your vendor processes data on your behalf, so ask clearly.
- What notice and consent text do candidates see before they start, and can we adapt it?
- What exactly is stored: scores only, or the individual answers too? For how long?
- Where is the data hosted and processed, and which sub-processors are involved?
- How can a candidate ask for their data to be deleted, and how fast is it done?
- Who in your organisation can see candidate results, and is access logged?
- How are the data and backups protected, and how are breaches handled and reported?
- Is candidate data used for anything other than delivering the assessment, such as building norms or research? If so, is it anonymised and is there an opt-out?
What AXIS360 provides today
Candidates see a data-protection notice and consent step before an assessment begins, and a page where they can submit a request to erase their data. Access to results is limited to the inviting organisation's authorised users. If you have specific questions about storage, retention or sub-processors, ask us and we will answer them in writing.
Practical steps for HR
Put these in place before you launch a testing programme.
- Write down the purpose of each assessment and the decision it informs.
- Check that your candidate communication matches what the platform collects.
- Set a retention period for assessment data and for candidate reports.
- Name an owner for candidate rights requests and a response time.
- Review your vendor contract for data protection terms.
Frequently asked questions
Do we need consent to run a psychometric test on a job applicant?
You need a lawful basis and must give notice. Whether a particular hiring use falls within a legitimate-use ground or needs consent is a legal question; consent with a clear notice is the safer working practice. Check with counsel.
How long can we keep candidate assessment data?
Only as long as needed for the stated purpose. Set a defined retention period and delete after it.
Does the DPDP Act apply to assessments of existing employees?
It applies to personal data of individuals processed in India, including employees. Confirm the specific grounds and obligations with counsel.
Related
Assessments: DISC Personality Assessment · Big Five OCEAN Assessment · Integrity Screener · Verify Express
Solutions: BFSI Assessment Solution · Campus Hiring Solution
More guides: Choosing a psychometric test provider · What psychometric tests are
Sources
- Digital Personal Data Protection Act, 2023 (India).
- Digital Personal Data Protection Rules, 2025, notified 13 November 2025 (phased commencement).
This guide is general information, not legal advice. Questions or corrections: nizam@nonverbals.com.