Compliance in global hiring is not a feature you add after the product is finished. Excurit was built with Privacy by Design as a foundational principle. Every interaction the platform has with a candidate is governed by the correct framework for their jurisdiction from the first moment — without any manual tracking required.
The General Data Protection Regulation applies to every organisation that processes personal data belonging to individuals located in the European Union — regardless of where that organisation is based. A company hiring candidates in Germany or France must comply with GDPR whether the company is headquartered in Bangalore, Austin, or Berlin.
For recruiting, GDPR means every piece of candidate data collected has a legal basis, is stored only as long as necessary, and can be accessed, corrected, or erased on the candidate's request. These are not optional obligations. Cumulative GDPR fines surpassed 5.88 billion euros by mid-2025 and enforcement activity has grown sharply year on year.
Excurit manages every GDPR obligation automatically throughout the hiring cycle. Consent is collected at the point of first contact with a legally verified privacy notice attached to every outreach. Data minimisation is enforced by the platform — only the fields required for recruitment are collected. Erasure requests are actioned immediately through automated workflows. Processing logs maintain themselves and are available for audit without any manual intervention.
The Digital Personal Data Protection Act is India's comprehensive data privacy framework, applicable to all digital personal data processed within India and to organisations outside India that offer goods or services to Indian data principals. For hiring teams sourcing candidates through Naukri, Foundit, or any other Indian platform, DPDP compliance is not optional.
DPDP establishes rights for data principals — candidates — that include the right to access their data, the right to correction and erasure, and the right to grievance redressal. Organisations acting as data fiduciaries must collect data only for specified purposes, retain it only as long as necessary, and implement reasonable security safeguards.
Excurit is the only major recruiting platform with native DPDP compliance built in at launch. Purpose limitation is enforced by the platform — candidate data is processed only for the hiring cycle it was collected for. Consent is obtained in plain language before any processing begins. Data principal rights are supported through automated workflows that do not require a compliance team to operate.
The California Consumer Privacy Act grants California residents significant rights over the personal information businesses collect about them. Amended and strengthened by the California Privacy Rights Act in 2023, CCPA now applies broadly to businesses processing California residents' personal data — including candidates applying for roles regardless of where the hiring company is located.
For recruiting, CCPA means candidates have the right to know what personal information was collected about them, the right to delete it, and the right to opt out of the sale or sharing of their personal information. Businesses must respond to verified requests within 45 days and must not discriminate against consumers who exercise their rights.
Excurit handles CCPA obligations automatically for every candidate processed in the US market. Disclosure obligations are met at first contact. Candidate data subject requests are processed through automated workflows. Opt-out mechanisms are built into the candidate-facing experience. No manual compliance management required for US-based hiring.
Brazil's General Data Protection Law is one of the most comprehensive data privacy frameworks in the Americas, closely modelled on the GDPR structure but adapted to the Brazilian legal context. It applies to any processing of personal data of individuals located in Brazil, regardless of where the processing organisation is headquartered.
For recruiting teams hiring in the Brazilian market through platforms such as Catho and InfoJobs, LGPD means obtaining valid consent before processing candidate data, limiting collection to what is necessary for the hiring purpose, and honouring data subject rights including access, correction, deletion, and portability.
Excurit's LGPD compliance module arrives in Phase 3 alongside the Catho and InfoJobs integrations and Portuguese language AI Call support. The compliance architecture for LGPD is being built to the same standard as GDPR and DPDP — automated, built into the platform, and requiring no manual operation from the HR team. Teams operating in Brazil will not need to build a separate compliance layer or manage LGPD obligations independently of their existing workflow.
The Privacy Act 1988, together with the Australian Privacy Principles it established, governs how organisations collect, hold, use, and disclose personal information in Australia. It applies to most private sector organisations with an annual turnover above $3 million, and to all organisations in specified sectors regardless of turnover — which includes most companies doing professional hiring in the Australian market.
For recruiting teams sourcing candidates through SEEK, the Australian Privacy Act means candidates must be notified of why their information is being collected and how it will be used, have the right to access and correct their personal information, and be protected from having their data disclosed to parties they have not consented to.
Excurit's Australian Privacy Act compliance module arrives in Phase 3 alongside the SEEK integration. The same Privacy by Design architecture that handles GDPR and DPDP is applied to Australian candidate data from the first interaction. Consent, retention, and rights management are automated. Hiring teams in Australia operate through the same compliance dashboard interface as those in the EU or India.
When Excurit completes an AI Interview with a candidate, it generates a Right to Explanation report. The report is sent to every candidate who completes the process — whether they advance to the next stage or not. It explains which criteria were evaluated, how the candidate performed against each one, and what the outcome was.
This is not a legal requirement. No jurisdiction currently mandates that automated hiring systems explain their decisions to candidates in this way. It is an ethical commitment built into the platform architecture because using AI to evaluate a person's career prospects and then providing no visibility into that evaluation is not a standard worth accepting.
The Right to Explanation report serves a practical function too. Candidates who receive clear, specific feedback — even when the outcome is not what they hoped for — are far more likely to speak positively about the hiring company and the process. Candidate experience at this stage is a meaningful part of employer brand whether or not the organisation is tracking it.
Every report is generated automatically. No recruiter time is required to produce it, review it, or send it. It is part of what happens at the end of every AI Interview, for every candidate, on every role.
Most software is built first and audited for compliance afterward. A legal team reviews the product. GDPR features are added to satisfy regulators. A compliance dashboard is bolted onto a platform that was not designed with one in mind. The result is a product that is technically compliant but structurally fragile — one where compliance obligations are met through features you activate rather than principles the architecture enforces.
Excurit was built the other way. Every data interaction in the platform was designed with the question — is this the minimum necessary, is it consented, and is it auditable? — built into the decision. The five compliance frameworks are not features. They are the outcome of building an architecture where the right thing to do with candidate data is also the default thing the platform does.
Excurit applies the correct compliance framework to each candidate automatically, based on their jurisdiction. An HR team hiring simultaneously in India, the EU, and the United States does not need to manually track which obligations apply to which candidate. The platform handles it.
When a candidate from Germany applies through LinkedIn, GDPR governs. When a candidate from Mumbai applies through Naukri, DPDP governs. When a candidate from California applies through Indeed, CCPA governs. The recruiter sees a single pipeline. The compliance layer operates invisibly behind it.
Honest assessment of compliance coverage across the platforms most commonly compared with Excurit. No claims that are not supported by each platform's published documentation.
| Compliance capability | Workable | Recruitee | HireBound | Excurit |
|---|---|---|---|---|
| GDPR compliance | ✓ | ✓ | Partial | ✓ |
| CCPA compliance | ✓ | ✗ | Partial | ✓ |
| DPDP compliance (India) | ✗ | ✗ | Partial | ✓ |
| LGPD compliance (Brazil) | ✗ | ✗ | ✗ | Phase 3 |
| Australian Privacy Act | ✗ | ✗ | ✗ | Phase 3 |
| Automatic consent collection | ✓ | ✓ | Partial | ✓ |
| Right to erasure workflow | ✓ | ✓ | ✗ | ✓ |
| Data minimisation enforcement | Manual | Manual | ✗ | ✓ Automatic |
| Automated processing logs | ✓ | ✓ | ✗ | ✓ |
| Multi-framework single dashboard | ✗ | ✗ | ✗ | ✓ |
| Right to Explanation for AI decisions | ✗ | ✗ | ✗ | ✓ Every candidate |
| Privacy by Design architecture | ✗ | ✗ | ✗ | ✓ Built in |
| Assessment based on published documentation and product pages for each platform as of early 2025. Partial indicates documented capability in one jurisdiction only or compliance features available only on specific pricing tiers. Excurit Phase 3 capabilities are scheduled and not yet live. | ||||
The instinct when building compliance into a recruiting platform is to solve the most immediate regulatory problem first. For a European-founded company, that usually means GDPR. For a US company, CCPA. The problem with building jurisdiction-by-jurisdiction is that you end up with a compliance patchwork rather than a compliance architecture — different standards applied inconsistently across markets, different levels of automation in different regions, and a growing cost of maintenance as each new framework requires retrofitting.
Excurit was built for global operation from the first version. The five frameworks — GDPR for the EU, DPDP for India, CCPA for the United States, LGPD for Brazil, and the Australian Privacy Act — were all considered in the architectural decisions made before any candidate data flowed through the platform. Consent collection, data minimisation, retention enforcement, and rights management are standard behaviours of the system applied to every candidate in every market. The compliance dashboard shows the state of all active frameworks in one view because the underlying architecture treats them as one unified concern, not five separate problems.
This matters practically for teams hiring across borders. A company with offices in Mumbai, London, and San Francisco is subject to DPDP, GDPR, and CCPA simultaneously when sourcing candidates. Managing those obligations separately — different tools, different manual processes, different people responsible for each — is not only expensive but inherently unreliable. One missed consent collection in the wrong jurisdiction carries real regulatory and reputational risk.
The Right to Explanation commitment adds a dimension no other recruiting platform has attempted. When an AI system influences a hiring decision, the affected person has a reasonable expectation of understanding how. The GDPR's Article 22 provisions on automated decision-making gesture toward this obligation for EU candidates, but Excurit extends it to every candidate in every market regardless of whether the local law requires it. The report is not a legal minimum. It is the standard the platform was designed to meet.
See how Excurit manages compliance across every market your team hires in — automatically, from a single dashboard.