Is it safe to upload your CV online? Your data rights under DPDPA 2023

What actually happens to your CV after you upload it

When you upload a resume, the platform typically parses it into structured data — your skills, employers, dates, location, and contact details — and stores that in a database that recruiters or its algorithms can search. That part is normal and necessary. The real question is what happens around that core function:

• Is your data sold or shared? Many free platforms monetise candidate data by selling access or sharing it with third parties and advertisers.
• How long is it kept? Some platforms retain your data indefinitely, even after you stop using the service.
• Who can see it? A publicly searchable profile is visible far more broadly than a consent-gated one — including, potentially, to your current employer.
• Can you get it back or delete it? The ability to export and permanently erase your data is the single most important control you have.

Your rights under DPDPA 2023

India’s Digital Personal Data Protection Act, 2023 (DPDPA) is the law that governs how platforms handle your personal data. At a high level, it gives you:

• The right to consent. A platform must obtain your consent before processing your personal data, and tell you what it is collecting and why.
• The right to access and correction. You can ask what data is held about you and have inaccuracies fixed.
• The right to erasure. You can withdraw consent and have your personal data deleted — a compliant platform must honour this.
• The right to grievance redressal. Platforms must provide a way to raise and resolve complaints about your data.

In plain terms: DPDPA shifts the default. Your data is yours, a platform is only borrowing it with your permission, and you can take it back. (This is general information, not legal advice — but it is the lens to evaluate any job platform through.)

A 60-second checklist before you upload anywhere

Before uploading your CV to any job site, scan its privacy policy for these answers:

1. Does it state clearly that your data is not sold to third parties?
2. Can you delete your account and data permanently — and is a retention window stated (e.g. purged within 30 days)?
3. Is matching consent-first — i.e. do you approve before a company gets your contact details?
4. Can you pause visibility without losing your profile?
5. Is the profile publicly browsable, or only visible to vetted companies?

If a platform cannot answer these clearly, that is your signal. If it can, uploading your CV is no riskier than any other service you trust with personal data.

The question is not “should I upload my CV at all?” — it is “does this platform treat my data as mine?”

How Arborhire handles your CV data

We built Arborhire on the premise that you are the customer, not the product — which is exactly why we charge a small membership instead of monetising your data. Concretely:

• We never sell your data. There are no advertisers and no third-party data sales in our model.
• You can delete everything, any time. Permanent deletion is purged within 30 days, as required under DPDPA 2023.
• Matching is consent-first. Companies express interest; your contact details are never shared until you choose to respond.
• The pool is not publicly browsable. Your job search stays private — you can also pause matching so companies stop seeing you, without losing your profile.
• You see who viewed you. Full transparency on which companies looked at your profile and your match score.

Frequently asked questions