Data Access for Recruitment in India

Your personal information has a value, costing Rs 2,500 for a month or Rs 9,000 for a half-year subscription. For this price, individuals such as real estate agents, loan distributors, car salespeople, or others can potentially access contact information, between 60 to 300 complete professional profiles, and the personal data of millions of Indians who have uploaded their resumes in search of employment. Founders, C-suite executives, and senior leaders are likely familiar with unexpected calls from unknown numbers. Many ignore these calls as spam. A few, however, ponder how these callers acquire their phone, salary, residence, and professional information.

How the Investigation Unfolded

Startup Superb’s investigation identified a possible source, leading directly to one of India’s most reputable job portals. An encounter began with a sales representative from Naukri.com visiting the building hosting Startup Superb’s office. He intended to meet another firm but ended up introducing himself and promoting Naukri’s recruiter subscription service.

The Nature of the Sale

What was being sold was essentially access to data. The sales pitch was clear and comprehensive, detailing that Naukri’s database holds personal information of millions of Indian professionals, including CXOs and senior executives from various sectors. The subscription provides access to phone numbers, email addresses, home addresses, salary details, and complete professional profiles.

Subscription Details

The purpose was explicitly stated: the team at Startup Superb needed CXO information for business development and sales, not hiring. The response was telling. The executive neither questioned the intent nor declined the request. Instead, he conducted a live demonstration and agreed to provide the subscription despite the lack of a hiring need.

Costs and Offerings

To grasp what the subscription entails, consider Naukri’s recruiter plans. A one-month subscription costing Rs 2,500 includes two job postings for small and medium businesses, unlimited applications with immediate CV recommendations from Naukri’s database, 60 CV views, and direct access to contact information for 250 candidates. The six-month plan priced at Rs 9,000 allows for 300 CV views and access to 1,250 contacts. All subscriptions promise “unlimited applications with contact details available.” However, no verification exists to confirm that job postings are legitimate or that subscribers have an actual hiring requirement.

Concerns Over Data Usage

A critical detail often omitted from the subscription page is that once a recruiter gains access, they can download candidate profiles into Excel files. This means that phone numbers, email addresses, and other personal data can be extracted from the platform, moving beyond Naukri’s oversight, raising concerns over its eventual use.

Live Demonstration of Data Access

What followed was an astonishing display of how quickly professional data can be accessed. The sales executive performed a search for VP and Director-level professionals at Zomato and OYO, effortlessly retrieving their complete profiles, individual contact information, and both professional and personal details within minutes. Startup Superb verified several profiles against existing contact information, and they matched.
When asked about filtering candidates who had been active recently, a feature aimed at identifying job seekers, the executive suggested removing the filter, which would generate a larger volume of profiles and contacts. This was not an instance of an executive probing the stated purpose; rather, he was demonstrating ways to enhance access despite the known absence of a hiring requirement.

Costs Involved with Accessing Data

The enterprise pricing structure showed the extent of such data access. Prices included Rs 2,000 for 50 credits, Rs 1.2 lakh for 5,000, Rs 1.7 lakh for 10,000, and Rs 2.5 lakh for 25,000. One credit provided access to one complete professional profile, inclusive of phone numbers, emails, salary, work history, and home addresses.

Lack of Accountability

During this interaction, the sales executive acknowledged that while the database is intended for hiring, companies employ it in various ways, stating that there is no tracking mechanism for data usage. He cited two well-known firms, claiming that a leading telecom corporation had acquired a recruiter subscription worth Rs 1.5 crore, while a major used-car retailer had spent Rs 25 lakh. Startup Superb could not corroborate these claims. The sales executive speculated that although these subscriptions are marketed for hiring, companies might utilise the data for marketing other products.

Insights from Industry Players

The investigation went beyond just the Naukri sales representative. A founder of a Gurugram-based real estate firm, who requested anonymity, revealed that for Rs 2,500, they gain access to verified contacts of high-net-worth individuals, asserting that no real estate lead platform provides such quality data at this rate. The founder clarified that they do not use the subscription for hiring. Instead, they employ verified mobile numbers, email addresses, salary ranges, and job titles to reach professionals for property sales. This finding suggests a possible explanation for the unsolicited real estate calls that many Indian professionals receive, where callers often appear to have a surprising amount of information.

The Financial Aspect

In an interaction, Naukri maintained that recruiter access is exclusive to hiring needs, with subscribers legally bound to use the data solely for recruitment. Any improper usage constitutes a breach of their terms. Yet, the sales executive painted a noticeably different picture, stating that such sales were on the rise and he had a sales target of Rs 10 lakh, with a significant portion of his earnings linked to achieving that target. When Startup Superb expressed a desire for an individual subscription instead of a corporate one, the executive initially stated such options were no longer available but then attempted to arrange one regardless.

Recruitment Strategies and Data Protection Trends

Data protection trends are vital in today’s recruitment landscape. A significant portion of recruitment revenue, over 90%, arises from recruitment consultants and enterprises, while individual subscriptions form a minor part. However, this figure doesn’t clarify which enterprises utilise the platform solely for hiring versus those engaging recruiters for alternative purposes.

Info Edge’s Recruitment Performance

In Q4 FY26, Info Edge’s recruitment division generated approximately Rs 650 crore, marking it as the company’s most substantial revenue stream. Startup Superb’s investigation revealed that certain real estate firms maintained active recruiter subscriptions, despite lacking hiring needs. Additionally, Naukri’s sales representatives continued to pursue sales after being informed that the subscription was intended for business development.

The Need for Stronger Verification

Potential changes from regulators or Info Edge’s board could impose more stringent verification on hiring intentions or limit recruiter access to validated employers, possibly influencing the subscriber base. The executive indicated that recruiter subscriptions are increasingly sold to meet quarterly sales objectives. These observations lead to a critical question for shareholders and analysts: what percentage of recruitment revenue relies on subscribers whose main goal isn’t hiring, and how might heightened data protection enforcement impact future growth?

Responsibilities of a Listed Company

Info Edge is a publicly traded entity and, unlike a startup in a regulatory grey area, must be accountable for all personal data it handles outside the recruitment context. Listed companies globally are expected to uphold robust controls over employee actions and customer data management.

The sales executive that Startup Superb engaged with utilised the company’s product, including the official rate card and sales pipeline, while striving to meet sales targets. This raises questions not only about the individual’s conduct but also about the adequacy of systems, oversight, and incentives surrounding the product.

Data Protection Practices under the DPDP Act

The Digital Personal Data Protection (DPDP) Act of 2023 in India centres around principles relevant to Startup Superb’s findings. The legislation mandates that personal data be processed only for the purposes outlined during consent acquisition. Job seekers submit their resumes to Naukri for legitimate recruitment opportunities, expecting them to be accessed by authentic recruiters rather than for unrelated business activities. It also enforces data minimisation, specifying that only the necessary data for the purpose should be processed.

Significantly, the Act assigns liability to the data fiduciary, not the subscriber. As the data fiduciary, Naukri must ensure lawful processing and cannot rely solely on user contract declarations.

Vasundhara Shankar, Managing Partner at Verum Legal, remarked that allowing data gathered for recruitment to be accessed for alternative purposes without fresh consent could violate the principle of purpose limitation embedded in the Act, with the onus remaining on the data fiduciary.

Naukri’s Compliance Efforts

In a response to Startup Superb, Naukri indicated it is preparing to fully align with the DPDP Act ahead of its deadline in May 2027. However, the transitional phase is intended to facilitate compliance system development, not to compromise the Act’s foundational principles. The newly constituted Data Protection Board of India will possess the authority to levy fines of up to Rs 250 crore for significant breaches, making data governance critical for listed firms.

Addressing Unanswered Questions

Naukri’s response outlines a structure of contractual limitations, access controls, monitoring, and grievance mechanisms. Nevertheless, many of these safeguards may be challenging to reconcile with what Startup Superb documented during its engagement with the sales executive.

While the company asserted that recruiter data cannot be exploited for commercial reasons and misuse prompts suspension, the executive claimed there is no monitoring system to ascertain who is using the data and for what purpose, raising concerns about misuse enforcement.

Naukri also stated it declines requests when there is evident non-recruitment intent. However, Startup Superb explicitly mentioned seeking CXO data for business development, yet the sales process proceeded uninterrupted. Furthermore, although the company highlighted grievance mechanisms as protective measures, candidates are not informed when their profiles are accessed, complicating their ability to ascertain if their data has been misused.

Verification in Recruitment Access

Naukri contended that India’s hiring framework extends beyond large corporations, requiring MSMEs, startups, and local enterprises to have affordable access to recruitment tools. While this viewpoint is justifiable, enabling genuine hiring by small enterprises differs from permitting recruiter access without verifying hiring intent. Startup Superb’s investigation showed that access was granted even after clear non-hiring intent was stated. Thus, the essential question is not about who should recruit but what verification processes should be implemented before granting access to numerous resumes.

Implications of Data Privacy Breaches

Data privacy breaches present a critical challenge. Once a phone number is accessed, it cannot be unseen. Once sensitive information like salary, residence, or employment history is saved into an Excel file, it loses its confidentiality permanently. The potential harm arises the moment access is granted, not when a complaint emerges.

The potential consequences range beyond unwanted sales calls. Comprehensive professional profiles with contact details, salary data, employment history, and residential addresses can facilitate targeted fraud, impersonation, scams, and even pose physical safety threats, particularly to founders, CXOs, and senior executives.

Startup Superb is sharing the investigation’s outcomes, alongside audio recordings and documents, with the Ministry of Electronics and Information Technology and the Data Protection Board of India to assess the consistency of the documented practices with India’s data protection norms.

Global Standards and Regulatory Consequences

Across leading digital economies, utilising personal data beyond its original purpose incurs severe regulatory penalties. In the United States, the California Consumer Privacy Act (CCPA) empowers consumers to know how their data is employed and to opt out of sales, with intentional violations attracting fines of up to $7,500. In the European Union, the General Data Protection Regulation (GDPR) enshrines purpose limitation as a fundamental principle, imposing fines of up to 4% of a company’s global annual revenue, with enforcement actions leading to billion-euro fines. In the UK, the Information Commissioner’s Office (ICO) has enforced substantial penalties for misuse of personal data. Throughout these jurisdictions, responsibility lies with the data-collecting entity. India’s DPDP Act aligns with these principles of purpose limitation and accountability.

Naukri’s Stance and Future Compliance

For every founder, CXO, and professional curious about how outsiders acquired their private information, this investigation provides a potential explanation. The pivotal question for Naukri remains: if, as indicated by its sales executive, there is no mechanism to track data usage, are the platform’s safeguards adequate?

Before this report, Startup Superb presented Naukri with a detailed questionnaire covering areas like recruiter verification, privacy safeguards, misuse prevention, and compliance with the DPDP Act. Startup Superb also engaged with the company’s leadership for over an hour to discuss its findings.

Naukri asserted that jobseeker trust is crucial to its platform, claiming that candidate data is accessible solely within a controlled framework established for legitimate recruitment. The firm emphasised that recruiters must post genuine job opportunities, employ candidate data solely for hiring, and adhere to relevant laws. They also mentioned KYC checks, subscription limits, system monitoring, and grievance mechanisms as measures to avert misuse, with confirmed violations leading to suspension, termination, or legal action. Naukri mentioned it has declined subscriptions indicating non-recruitment intent and is preparing for full adherence to the DPDP Act before the 2027 implementation deadline. However, the organisation didn’t directly address Startup Superb’s specific queries regarding the conduct of its sales representative, disclosed rate cards, the sales targets highlighted by the executive, or the lack of technical restrictions to prevent downloaded candidate data from leaving the platform.

The comprehensive questionnaire sent by Startup Superb along with Naukri’s responses can be found in the attached PDF.