What the portal is actually for
It does two jobs, and organisations usually build the first and forget the second.
- Intake. Collect an application in a structure the recruiter can screen, with enough qualifying information to separate the plausible from the speculative.
- Status. Tell the candidate where they stand without a human being having to answer an email. This is the half that is missing in most implementations, and it is the half candidates notice.
A third job appears after selection: collecting the documents and details needed to create an employee record. That phase is usually run over email and a spreadsheet, which is why it is also where the joining date slips.
The portal is not the careers page. The careers page sells the role and is optimised for traffic; the portal processes an intention that already exists and should be optimised for completion. Building one to do both usually produces a page that is slow to load and awkward to submit.
Where completion rate is lost
Application completion rate is the ratio of started applications to submitted ones, and it is worth measuring before spending anything on sourcing. A portal that loses half its applicants is a sourcing problem you are paying for twice.
| Cause | What it looks like | Fix |
|---|---|---|
| Re-entering the CV | Upload, then twelve fields repeating the same information | Parse the upload and ask the candidate to correct it |
| Account creation first | Registration and verification before the candidate has seen the form | Let them apply, then offer an account |
| Desktop-only layout | Most Indian applicants arrive on a phone, on a mobile network | Test the form on a mid-range phone and a weak connection |
| Mandatory fields nobody uses | Date of birth, marital status, community, photograph | Remove anything the screening decision does not use |
| Long assessments at stage one | A test before any human contact, with a high drop-off | Move it after the first screen, or shorten it |
| No progress or no confirmation | The candidate does not know whether it submitted | Confirm on screen and in a message |
The candidates who abandon are not a random sample. People with options leave first, which is why a poor form quietly filters for the least selective applicants.
The phase that matters most here: offer to joining
An accepted offer is not a joined employee. Candidates in most Indian markets hold multiple offers, serve a notice period of one to three months, and are counter-offered during it. The gap between acceptance and joining is long, and it is where the loss happens.
A portal that stays open through that period does more than an onboarding email sequence.
- Collect joining documents as they become available rather than in one demand on day one: identity and address proof, tax identifiers, provident fund and insurance details, bank details, qualification and experience documents, and the previous employer's relieving and salary particulars.
- Show what is still outstanding, so the candidate chases themselves.
- Run background verification in parallel and let the candidate see that it is progressing, since a silent verification period is often read as a withdrawn offer.
- Keep a channel open. A candidate who has spoken to nobody for six weeks is a candidate deciding on the basis of the last conversation they had, which was with the counter-offering employer.
- Track a joining ratio by role and by source. Reneging that clusters in one source or one recruiter is a fixable problem rather than a market condition.
What the portal may collect, and what it must protect
By the time a candidate reaches the document stage, the portal is holding a concentrated set of identity documents. That changes the obligations.
- Give notice at the point of collection: what the data is for, how long it is kept, and which vendors will see it, including the background verification agency.
- Do not collect an identifier because the form template had a field for it. Aadhaar in particular carries its own restrictions on when it may be sought, stored and used, and requiring it as a default field is not a neutral choice. Verify the current position before making it mandatory.
- Separate applicant data from joiner data. An unsuccessful candidate's file should not sit alongside identity documents indefinitely, and a retention rule should apply to each.
- Make the form usable by disabled candidates. An assessment or upload flow that a screen reader cannot handle is a barrier at the selection stage, not a design detail.
- Publish the domain your offers and communications come from. Fake portals and fake offer letters using real employer names are common, and candidates have no way to tell the difference unless you tell them.
Statutory reference
- Act
- Digital Personal Data Protection Act, 2023
- Section
- Digital Personal Data Protection Act, 2023 and the rules made under it: notice at the point of collection, purpose limitation, security safeguards, erasure once the purpose is served, and responsibility for a data processor such as a background verification vendor engaged to act on the employer's behalf. Aadhaar (Targeted Delivery of Financial and Other Subsidies, Benefits and Services) Act, 2016: Section 57, which had permitted use of Aadhaar by any body corporate or person under any law or contract, was omitted with effect from 25 July 2019 by the Aadhaar and Other Laws (Amendment) Act, 2019, so consent recorded in an employment contract is no longer a footing for anything. Section 4(4): an entity may perform authentication only if the Authority is satisfied it meets the specified privacy and security standards and is permitted to offer authentication services under a law made by Parliament, or is seeking it for a purpose the Central Government prescribes in the interest of State. Section 4(7): mandatory authentication for the provision of any service requires a law made by Parliament. Section 4(6): the entity must inform the individual of alternate and viable means of identification and may not deny any service for refusal or inability to authenticate. Section 4(3): the only route otherwise open is the holder's voluntary use, which the Explanation defines as use only with informed consent. Section 7, which does permit mandatory authentication, is a power of the Central or State Government tied to expenditure from the Consolidated Fund and is not available to an employer. Rights of Persons with Disabilities Act, 2016 (non-discrimination in recruitment and accessibility of the selection process, which extends to online forms and assessments)
- Key limits
- Applicant and joiner data collected through a portal is personal data with notice and retention obligations, and engaging a verification vendor does not move those obligations off the employer. Aadhaar should not be a field on a candidate form at all absent a specific footing. Section 4(7) makes mandatory authentication for a service dependent on a law made by Parliament, Section 4(6) forbids denying anything for refusal or failure and requires alternate means to be offered, and the contractual consent route disappeared with Section 57 in 2019. A candidate who declines cannot be turned away for declining. Under notification G.S.R. 843(E) dated 13 November 2025, sections 3 to 17 - the grounds for processing, notice, consent, the general obligations of a data fiduciary and all of the data principal rights - take effect eighteen months from that date, on 13 May 2027. Only the definitions and the Data Protection Board and penalty machinery are in force now. Separately, processing for employment purposes runs on the section 7(i) legitimate use and not on consent, and the erasure duty in section 8(7) yields where retention is necessary for compliance with any law, which is the position for statutory payroll and register retention. Section 20 non-discrimination in employment, the section 20(2) duty to provide reasonable accommodation and a barrier-free environment, the section 20(4) protection of an employee who acquires a disability in service, the section 23 Grievance Redressal Officer and the section 34 four per cent reservation all bind government establishments only. What binds every establishment, private included, is section 21, notifying an equal opportunity policy and registering it with the Chief or State Commissioner, and section 22, maintaining records of persons with disabilities open to inspection. For the private sector section 35 provides government INCENTIVES towards a five per cent workforce target, not a quota. The general prohibition that does reach private conduct is section 3(3), and it carries a defence where the act or omission is a proportionate means of achieving a legitimate aim. Reasonable accommodation is defined in section 2(y) as excluding what would impose a disproportionate or undue burden. Sections 3 to 17, which carry the duties described here, commence on 13 May 2027 under G.S.R. 843(E) of 13 November 2025. In force now are the definitions, the Data Protection Board and the penalty provisions. Aadhaar obligations are INDEPENDENT of the DPDP commencement timetable and apply now, which is the opposite of the DPDP position and easy to conflate. The load-bearing point, the omission of s. 57 by which private-sector authentication lost its statutory basis, is verified from the statute. The regulations made under the Act carry the operative detail and NONE was read, nor was Chapter VI on security and restrictions on sharing.
Frequently asked questions
What is a candidate portal?
The applicant-facing part of a recruitment system, where someone applies for a role, tracks the status of that application, and, once selected, submits joining documents. It is separate from the careers page, which exists to attract traffic rather than to process it.
Why do candidates abandon our application form?
Most often because the form asks them to retype a CV they have already uploaded, requires an account before they have seen the questions, or does not work properly on a phone. Measure the completion rate before spending more on sourcing.
How does a portal reduce candidates dropping out before joining?
By staying open through the notice period. It collects joining documents as they become available, shows the candidate what is outstanding, keeps background verification visibly in progress, and gives the organisation a reason to stay in contact during the weeks when counter-offers arrive.
Can we ask candidates for Aadhaar in the portal?
Not as a casual default field. Aadhaar carries restrictions on when it may be sought, authenticated and stored, and alternatives generally have to be offered, so verify the current position before making it mandatory rather than copying another employer's form.
How long should the portal keep an unsuccessful applicant's data?
Only as long as the purpose you gave notice of requires. Keep applicant data separate from joiner documents, apply a retention rule to each, and treat building a long-term talent pool as a separate purpose needing its own basis and notice.
How the candidate portal works in Engage
Engage parses an uploaded CV instead of asking the candidate to retype it, keeps the application status visible so recruiters are not answering status emails, and holds the portal open from offer to joining so documents arrive as they become available rather than in one demand on day one. Outstanding items are shown to the candidate, and joining ratios are tracked by role and source.
See recruitment in Engage