Compliance in global hiring is not a feature you add after the product is finished. Excruit was built with Privacy by Design as a foundational principle. Every interaction the platform has with a candidate is governed by the correct framework for their jurisdiction from the first moment — without any manual tracking required.
Framework 01
GDPR compliant recruiting software
The General Data Protection Regulation applies to every organisation that processes personal data belonging to individuals located in the European Union — regardless of where that organisation is based. A company hiring candidates in Germany or France must comply with GDPR whether the company is headquartered in Bangalore, Austin, or Berlin.
For recruiting, GDPR means every piece of candidate data collected has a legal basis, is stored only as long as necessary, and can be accessed, corrected, or erased on the candidate's request. These are not optional obligations. Cumulative GDPR fines surpassed 5.88 billion euros by mid-2025 and enforcement activity has grown sharply year on year.
For recruiting, GDPR means every piece of candidate data collected has a legal basis, is stored only as long as necessary, and can be accessed, corrected, or erased on the candidate's request. These are not optional obligations. Cumulative GDPR fines surpassed 5.88 billion euros by mid-2025 and enforcement activity has grown sharply year on year.
Framework 02
DPDP compliant HR tool
The Digital Personal Data Protection Act is India's comprehensive data privacy framework, applicable to all digital personal data processed within India and to organisations outside India that offer goods or services to Indian data principals. For hiring teams sourcing candidates through Naukri, Foundit, or any other Indian platform, DPDP compliance is not optional.
The Digital Personal Data Protection Act is India's comprehensive data privacy framework, applicable to all digital personal data processed within India and to organisations outside India that offer goods or services to Indian data principals. For hiring teams sourcing candidates through Naukri, Foundit, or any other Indian platform, DPDP compliance is not optional.
The Digital Personal Data Protection Act is India's comprehensive data privacy framework, applicable to all digital personal data processed within India and to organisations outside India that offer goods or services to Indian data principals. For hiring teams sourcing candidates through Naukri, Foundit, or any other Indian platform, DPDP compliance is not optional.
Framework 03
CCPA recruiting software
The California Consumer Privacy Act grants California residents significant rights over the personal information businesses collect about them. Amended and strengthened by the California Privacy Rights Act in 2023, CCPA now applies broadly to businesses processing California residents' personal data — including candidates applying for roles regardless of where the hiring company is located.
For recruiting, CCPA means candidates have the right to know what personal information was collected about them, the right to delete it, and the right to opt out of the sale or sharing of their personal information. Businesses must respond to verified requests within 45 days and must not discriminate against consumers who exercise their rights.
Excruit handles CCPA obligations automatically for every candidate processed in the US market. Disclosure obligations are met at first contact. Candidate data subject requests are processed through automated workflows. Opt-out mechanisms are built into the candidate-facing experience. No manual compliance management required for US-based hiring.
Framework 04 — Phase 3
LGPD HR software
Brazil's General Data Protection Law is one of the most comprehensive data privacy frameworks in the Americas, closely modelled on the GDPR structure but adapted to the Brazilian legal context. It applies to any processing of personal data of individuals located in Brazil, regardless of where the processing organisation is headquartered.
For recruiting teams hiring in the Brazilian market through platforms such as Catho and InfoJobs, LGPD means obtaining valid consent before processing candidate data, limiting collection to what is necessary for the hiring purpose, and honouring data subject rights including access, correction, deletion, and portability.
Excruit's LGPD compliance module arrives in Phase 3 alongside the Catho and InfoJobs integrations and Portuguese language AI Call support. The compliance architecture for LGPD is being built to the same standard as GDPR and DPDP — automated, built into the platform, and requiring no manual operation from the HR team. Teams operating in Brazil will not need to build a separate compliance layer or manage LGPD obligations independently of their existing workflow.
Framework 05 — Phase 3
Australian Privacy Act HR tool
The Privacy Act 1988, together with the Australian Privacy Principles it established, governs how organisations collect, hold, use, and disclose personal information in Australia. It applies to most private sector organisations with an annual turnover above $3 million, and to all organisations in specified sectors regardless of turnover — which includes most companies doing professional hiring in the Australian market.
For recruiting teams sourcing candidates through SEEK, the Australian Privacy Act means candidates must be notified of why their information is being collected and how it will be used, have the right to access and correct their personal information, and be protected from having their data disclosed to parties they have not consented to.
Excruit's Australian Privacy Act compliance module arrives in Phase 3 alongside the SEEK integration. The same Privacy by Design architecture that handles GDPR and DPDP is applied to Australian candidate data from the first interaction. Consent, retention, and rights management are automated. Hiring teams in Australia operate through the same compliance dashboard interface as those in the EU or India.
When Excruit completes an AI Interview with a candidate, it generates a Right to Explanation report. The report is sent to every candidate who completes the process — whether they advance to the next stage or not. It explains which criteria were evaluated, how the candidate performed against each one, and what the outcome was.
This is not a legal requirement. No jurisdiction currently mandates that automated hiring systems explain their decisions to candidates in this way. It is an ethical commitment built into the platform architecture because using AI to evaluate a person's career prospects and then providing no visibility into that evaluation is not a standard worth accepting.
The Right to Explanation report serves a practical function too. Candidates who receive clear, specific feedback — even when the outcome is not what they hoped for — are far more likely to speak positively about the hiring company and the process. Candidate experience at this stage is a meaningful part of employer brand whether or not the organisation is tracking it.
Every report is generated automatically. No recruiter time is required to produce it, review it, or send it. It is part of what happens at the end of every AI Interview, for every candidate, on every role.
Most software is built first and audited for compliance afterward. A legal team reviews the product. GDPR features are added to satisfy regulators. A compliance dashboard is bolted onto a platform that was not designed with one in mind. The result is a product that is technically compliant but structurally fragile — one where compliance obligations are met through features you activate rather than principles the architecture enforces.
Excruit was built the other way. Every data interaction in the platform was designed with the question — is this the minimum necessary, is it consented, and is it auditable? — built into the decision. The five compliance frameworks are not features. They are the outcome of building an architecture where the right thing to do with candidate data is also the default thing the platform does.
Excruit applies the correct compliance framework to each candidate automatically, based on their jurisdiction. An HR team hiring simultaneously in India, the EU, and the United States does not need to manually track which obligations apply to which candidate. The platform handles it.
Excruit applies the correct compliance framework to each candidate automatically, based on their jurisdiction. An HR team hiring simultaneously in India, the EU, and the United States does not need to manually track which obligations apply to which candidate. The platform handles it.
Honest assessment of compliance coverage across the platforms most commonly compared with Excruit. No claims that are not supported by each platform's published documentation.
| Compliance capability | Workable | Recruitee | HireBound | Excruit |
|---|---|---|---|---|
| GDPR compliance | 
|
Partial |
|
|
| CCPA compliance |
|
Partial |
|
|
| DPDP compliance (India) | 
|
Partial |
|
|
| LGPD compliance (Brazil) |
|
|
Phase 3 | |
| Australian Privacy Act |
|
| Phase 3 | |
| Automatic consent collection |
|
Partial |
|
|
| Right to erasure workflow |
|
|
|
|
| Data minimisation enforcement | Manual |
 |
✓ Automatic | |
| Automated processing logs |
|
|
|
|
| Multi-framework single dashboard |
|
|
|
|
| Right to Explanation for AI decisions |
|
|
✓ Every candidate | |
| Privacy by Design architecture |
|
|
✓ Built in | |
| Assessment based on published documentation and product pages for each platform as of early 2025. Partial indicates documented capability in one jurisdiction only or compliance features available only on specific pricing tiers. Excruit Phase 3 capabilities are scheduled and not yet live. | ||||
See how Excruit manages compliance across every market your team hires in — automatically, from a single dashboard.