GDPR in Recruitment

When GDPR applies to your hiring

The GDPR (Regulation (EU) 2016/679) applies if your organization is established in the EU or European Economic Area, or if you offer jobs to people in the EU from outside it. A US company recruiting engineers in Poland or running a contact center in Ireland is covered for those candidates. The UK has its own near-identical UK GDPR, with the Information Commissioner's Office as regulator.

In recruitment terms, the employer is usually the controller: it decides why and how candidate data is used. Your applicant tracking system, assessment vendor, background screening company and recruitment agency are typically processors acting on your instructions, and each needs a written data processing agreement under Article 28. An agency that keeps its own candidate database is a controller for that database too.

Fines can reach 20 million euros or 4% of worldwide annual turnover, whichever is higher, for the most serious breaches. In practice, the more common outcome for employers is a complaint from a rejected candidate that turns into a regulator inquiry.

Lawful basis for processing candidate data

Article 6 lists six lawful bases. Three do almost all the work in recruitment:

• Steps before entering a contract (Article 6(1)(b)): processing an application the candidate sent you, so you can decide whether to hire them.
• Legitimate interests (Article 6(1)(f)): sourcing candidates from professional networks, running reference checks, keeping records to defend against discrimination claims. You should document a short legitimate interests assessment for each use.
• Legal obligation (Article 6(1)(c)): right to work checks and other records the law requires.

Consent is the weakest basis in employment because of the power imbalance between employer and candidate, and because it can be withdrawn at any time. Use it for genuinely optional things, such as keeping someone in a talent pool beyond your normal retention period.

Special category data (health, ethnicity, religion, sexual orientation, union membership, biometrics) needs an extra condition under Article 9, and criminal records data under Article 10 can only be processed where member state law allows it. That is why diversity monitoring forms should be voluntary, separated from the application and reported only in aggregate.

Transparency, sourcing and retention

Every candidate must get a privacy notice explaining who you are, what data you collect, why, on what basis, who you share it with, whether it leaves the EU, how long you keep it and what rights they have. For applicants, link it at the point of application. For sourced candidates, Article 14 requires you to give the notice within a reasonable period and at the latest within one month, or at your first message to them if earlier. A recruiter's first outreach email is the usual place.

Retention is where most teams fall down. GDPR does not set a number; it requires you to keep data no longer than necessary. Many EU employers keep unsuccessful applicants' data for roughly six months to a year, tied to the window for discrimination claims in their country, and then delete or anonymize it. Keep longer only with a clear reason, such as consent to a talent pool. Our candidate data retention entry covers how to set and enforce schedules.

Transfers to the US need a mechanism. Many employers rely on the EU-US Data Privacy Framework for certified vendors, or standard contractual clauses for everyone else.

Candidate rights and automated decisions

Candidates have the right to access their data, correct it, have it erased in many cases, restrict or object to processing, and receive certain data in a portable format. A data subject access request from a rejected candidate must normally be answered within one month and can include interview notes, scorecards, assessment results and recruiter messages about them. Write notes as if the candidate will read them, because they may.

Article 22 gives people the right not to be subject to a decision based solely on automated processing that significantly affects them. Rejecting applicants automatically through knockout questions or an AI ranking, with no human review, can fall squarely within it. Either keep meaningful human involvement in rejection decisions, or rely on one of the narrow exceptions and add safeguards: the right to human review, to express a view and to contest the decision. A data protection impact assessment under Article 35 is expected for large-scale or AI-assisted screening.

AI used in recruitment is also regulated by the EU AI Act, which adds its own obligations on top of GDPR rather than replacing it.

Worked example: high-volume hiring for an EU contact center

A customer service outsourcer hires 300 multilingual agents a year for a center in Lisbon. Applications come through its careers site, two job boards and a recruitment agency. Screening includes knockout questions, a language test and an async video interview scored by a vendor tool.

The data protection lead, Ana, maps each step to a lawful basis, signs processing agreements with the ATS, testing and video vendors, and checks where each stores data. She keeps a recruiter review of every knockout and AI-scored rejection, so no candidate is turned down by the system alone. Rejected applicants' data is deleted automatically after nine months unless they tick an optional box to join the talent pool, which they can leave at any time. She also runs a DPIA on the video scoring tool before go-live and publishes a short, readable privacy notice in Portuguese, English and Spanish.

Common GDPR mistakes in recruitment

• Relying on consent for everything, then having no basis left when a candidate withdraws it.
• Keeping every CV forever 'in case a role comes up.'
• Sourcing profiles into the ATS and never sending a privacy notice.
• Free-text interview notes with comments about health, family plans or appearance.
• Fully automated rejections with no human review route.
• Sharing candidate spreadsheets with hiring managers by email, outside the ATS.

For more on building candidate trust around data, read our guide to data privacy in recruitment tech. Requirements differ between EU member states and the UK, so confirm local rules with counsel.