GDPR-compliant recruitment starts with a clear purpose for every piece of candidate data. Collect only what the hiring decision needs, explain how it will be used, restrict access, and delete or anonymise it when the purpose or lawful retention period ends.
This guide explains the main GDPR terms recruiters need, how lawful basis and transparency affect hiring, and what to check when an ATS or another vendor processes candidate information. It is practical guidance, not legal advice, so confirm your organisation’s position with qualified privacy support.
If you are comparing systems, our best recruitment software guide for 2026 includes privacy, AI governance, retention, export, and audit questions to use in each vendor demo.
GDPR-compliant recruitment means collecting only what a hiring decision needs, explaining each use, protecting the record across every vendor, and deleting it on schedule. Modern hiring sends candidate data through job boards, ATSs, assessments, scheduling tools, and AI features, so a clear purpose and evidence trail matter throughout the process.
Key takeaways
- GDPR applies to recruitment data when an organisation processes personal information about people in scope, including applicants and sourced candidates.
- Do not treat consent as the automatic legal basis for every recruiting activity. Document the purpose, necessity, lawful basis and any special condition that applies.
- Give candidates privacy information when data is collected, including the purpose, recipients, retention period, rights and source of information when it was obtained elsewhere.
- Collect only role-relevant information, restrict access, keep records accurate and delete or anonymise data when the purpose or legal retention requirement ends.
- Background checks, health information, diversity data and automated decision-making need additional safeguards and may require a data protection impact assessment.
- An ATS vendor can process data on your behalf, but the employer or recruiter still needs clear contracts, instructions, access controls, retention rules and an audit trail.
- This is practical guidance, not legal advice. Confirm your basis, retention schedule and cross-border requirements with your data protection officer or qualified counsel.
GDPR And Recruitment: A Complete Guide For Recruiters
What Is GDPR And What Does It Mean For Recruiters?
The old Data Protection Act was drawn up before LinkedIn and Indeed existed. They were put together in the era when the internet was a novelty. So, clearly, there was a need for the data protection laws to catch up with the digitization of the recruitment world.
As a result, in May 2026, European Union imposed the General Data Protection Regulation. This law aimed towards protecting the EU residents’ personal data and rights to privacy. It gives individuals more control over how their private data is being collected and used online. This involves all the information right from the candidates’ contact information to salary expectation details.
From a recruiter’s point of view, they need to take every possible step, including technical safeguards like encryption, to ensure people’s data protection. If you’re a recruiter and collect data from candidates who are residents of Europe, the GDPR applies to you. So, GDPR puts immense pressure on you and your organization to comply with its different aspects.
Now that we’re familiar with the basic idea of what GDPR is, let’s move on to knowing a little more about it.
Basic Terms Of GDPR For Recruiters
Compared to previous data protection rules, GDPR focuses greatly on why data is collected, and the individual is aware of the reason. So, here are the basic terms of GDPR that you need to know as a recruiter.
Data Subjects
These are the candidates and employees who reside in Europe and who you collect data from. They are known as data subjects mainly because they are identified through the data that they provide to companies and organizations. For example, when a candidate applies for a position, their applications include data like their names, phone numbers, addresses, etc. The GDPR specifically aims at protecting this data.
Data Controllers
Data controllers are simply the people, companies, or organizations who collect data. In this case, if you’re a recruiter, you are the data controller. You collect data from your candidates or future employees for various purposes. That’s why recruiters and employers come under the category of data controllers. So, as a recruiter and employer, you are responsible for protecting your candidates’ data and use it lawfully.
Data Processors
Data processors are simply the software solutions like Applicant Tracking Systems and Recruiting Software that recruiters use during their entire hiring process to sort through candidate data. It involves all the tools that take in your candidates’ data and process them into reports and analytics on behalf of your company.
Key Aspects Of GDPR For Recruiters
For recruiters and employers, here’s how the GDPR affects your core operations.
Legitimate Interest To Process Candidate Data
The GDPR compels recruiters and employers to collect and process data only for specified and legitimate purposes. For instance, if you’re hiring a candidate for a role, you can collect information related to that specific role only.
Candidate Consent
Along with legitimate interest to process data, the GDPR also requires you to ask for the consent of your candidates while processing their data. You need to ask for consent for a wide spectrum of information like disability, culture, gender, ethnicity, or any other information gathered via a survey or during a background check.
Transparency For Data Collection
The GDPR obliges recruiters and employers to be very transparent and clear about their privacy policies. Also, the candidates should be well informed about the privacy policies. Apart from the disclosure of the privacy policy, you also need to disclose all the steps of your hiring process to your candidates. Transparency is one of the key aspects of GDPR and recruiters need to comply with it.
Accountability And Responsibility
This is probably the most important aspect that GDPR affects in recruiting. As a recruiter or employer, you need to assume responsibility towards the compliance of GDPR. You and your organization are entirely accountable for who you do business with. Be it an ATS company or recruiting software, each stakeholder involved in your recruiting process should comply with the GDPR.
GDPR controls to test in a live recruitment workflow
The safest way to review a recruitment process is to trace one candidate record from application to deletion. Check where the data travels, who can access it, which purpose supports each use, how long it is kept, and how the candidate can request access or correction.
| Recruitment activity | Question to answer | Practical control |
|---|---|---|
| Application collection | What information is necessary for this role? | Use role-specific fields and a privacy notice at collection |
| Sourcing and talent pools | Can the person reasonably expect this use? | Record the source, purpose, notice, and opt-out route |
| Screening and ranking | Is the assessment job-related and reviewed by a person? | Document criteria, test outputs, and keep a correction route |
| Interview and assessment | Are recordings or sensitive details necessary? | Limit collection, restrict access, and publish retention rules |
| Vendor and ATS processing | Who controls the data and where is it stored? | Review contracts, subprocessors, security, export, and deletion |
| Rejection and retention | What happens when the purpose ends? | Set review dates and securely delete or anonymise records |
If an AI system ranks, scores, or recommends candidates, record the data it uses, the criteria it applies, the reviewer responsible, and how a candidate can challenge an error. A human who can question and override the output needs enough evidence, time, and authority to do so.
Put GDPR into the recruitment process
Choose one open role and complete the audit before scaling the workflow. Fix the highest-risk gap first, document the owner and review date, and repeat the check when the role, vendor, AI feature, or retention policy changes.
Frequently Asked Questions
Does GDPR apply to recruitment?
Yes. It can apply when an organisation processes personal data about applicants, sourced candidates, interviewees, and successful candidates within the relevant territorial scope.
Do recruiters always need candidate consent?
No. Recruiters need a valid, documented lawful basis for each purpose. Consent may suit some optional activities, but it is not automatically required for every application, screening, or communication.
How long can recruiters keep candidate data?
There is no single period for every record. Set a period based on purpose, legal requirements, and risk, tell candidates about it, review the data, and securely delete or anonymise it when it is no longer needed.
What data should recruiters avoid collecting?
Avoid information that is excessive or unrelated to the role. Collect health, disability, ethnicity, criminal-record, or other sensitive information only when it is necessary, lawful, and protected by the required safeguards.
Is an ATS responsible for GDPR compliance?
An ATS may process candidate data as a service provider, but the employer remains responsible for purposes, instructions, notices, retention, and access. Review the vendor contract, subprocessors, security controls, and deletion process.
What should a GDPR privacy notice for candidates include?
It should explain who processes the data, why it is collected, the lawful basis, data categories, recipients, retention, rights, contact details, and the source when the information came from somewhere other than the candidate.
Source: https://recooty.com/blog/gdpr-and-recruitment-a-complete-guide-for-recruiters/
Jump To Section
Author's Profile
Recooty
Recooty is one of the fastest-growing Applicant Tracking Systems, helping businesses of all sizes streamline their hiring process. Through its content, Recooty shares expert insights...
View Full Profile →
