GDPR in Recruitment: A Practical Guide for Hiring Teams

Recruitment involves CVs, contact details, interview notes and other information about people applying for a role. Before publishing a job ad, decide why you need each category of data, who can access it, how candidates will be informed and when processing will end.

This guide is for small hiring teams working in the EU. GDPR applies alongside national employment, equality and record-keeping rules, which vary by country. The right legal basis and retention period depend on the purpose, data and circumstances; this article is general information, not legal advice.

1. Define each purpose and legal basis

Write down why you need candidate data: to run the current recruitment, contact applicants, assess role-related qualifications or invite people to future roles. Each purpose needs an appropriate legal basis under Article 6 of the GDPR. Choose it for the real process and data involved; do not add a blanket “I consent to recruitment processing” checkbox by default.

Consent can be suitable for a separate, optional purpose such as keeping a candidate in a talent pool, if it is freely given, specific, informed and easy to withdraw. Some data, including special-category data, may need additional conditions under Article 9. Check local employment law before deciding what an employer may request.

2. Collect only what the role requires

Match application fields and interview questions to the role. Avoid collecting information “just in case,” including personal details that are not relevant or legally required. Ask whether every field changes a legitimate hiring decision; remove it if it does not.

If an applicant volunteers extra information, do not assume that you can use or retain it for any purpose. Assess its relevance, legal basis and retention separately. Avoid unnecessary copies of CVs in personal inboxes, spreadsheets and shared folders.

3. Explain the processing when you collect data

Give candidates a clear privacy notice at the time you collect their data. Under Article 13 of the GDPR, it should explain at least:

• who the controller is and how to contact them, including the data protection officer where applicable;
• the specific purposes and legal bases for processing;
• who receives the data, including recruitment software providers where relevant;
• how long the data will be kept, or the criteria used to decide that period;
• the candidate’s rights, the right to complain to a supervisory authority and whether providing the data is required by law or necessary to take part.

Keep the key information easy to find. A short notice beside the application form can link to a fuller privacy notice; a long policy alone is rarely a helpful first explanation.

4. Clarify the roles of your company, agency and vendors

A company that decides why and how it hires will often be the data controller. An ATS provider may be a processor when it handles data only on the company’s documented instructions; in that case, assess the contract requirements under Article 28. A recruitment agency may act as a separate or joint controller, or in another role, depending on who actually determines the purposes and means. The label in a contract does not decide the role on its own.

Before using a tool, check what data it receives, who can access it, how subprocessors and backups work, and how export and deletion are handled. Make sure written arrangements match the real workflow.

5. Restrict access and protect candidate data

Give access only to people who need it for a recruitment. Remove outdated permissions, avoid shared logins and define how documents may be exported or shared. Choose technical and organisational safeguards based on risk, purpose and scale. Article 32 does not prescribe one setup that fits every small business.

A single ATS can help keep applicants and communication in an organised process. It cannot make a company GDPR-compliant by itself: access settings, team practices, contracts and actual deletion procedures still matter.

6. Set retention and deletion rules

Do not keep candidate data indefinitely, but do not assume one fixed period is correct for every recruitment. Set a schedule for each purpose, legal basis, applicable obligations and potential claims, then explain the period or criteria in the privacy notice. When a recruitment ends, check whether another documented purpose and legal basis still apply. If not, delete the data under a consistent procedure.

Keep the data that is necessary for any continuing lawful purpose and remove the rest. Have a clear way to handle candidate requests, legal holds and deletion from working copies or connected systems. Ask a privacy professional or lawyer to review the schedule where local rules or potential claims are relevant.

7. Review automated screening and decisions

Automated sorting, reminders or stage changes do not automatically mean a decision was made solely by automated means. If a candidate is subject to a solely automated decision that has legal or similarly significant effects, assess Article 22 of the GDPR, including its conditions and safeguards. Maintain meaningful human oversight and document how the tools affect hiring decisions.

Recruitment privacy checklist

• I know which candidate data each role requires and why.
• I have selected a legal basis for every purpose.
• Candidates receive an up-to-date privacy notice when their data is collected.
• I know who in my company, agency and vendor team can access applications.
• Contracts and controller/processor roles reflect the actual workflow.
• I have a retention schedule and a practical deletion process.
• I have assessed whether automated tools influence hiring decisions.

How can an ATS help a small business?

An ATS can reduce the clutter that comes from keeping applicants, notes and decisions in separate inboxes and spreadsheets. GoJobee helps teams manage candidates through an organised recruitment workflow. Before rollout, review permissions, data flows and processing terms; software does not replace legal assessment or the controller’s responsibilities.

Official sources

Read the GDPR text on EUR-Lex and the European Data Protection Board’s Guidelines 05/2020 on consent. If you recruit in Poland, also check the current Labour Code and the Polish supervisory authority’s guidance. Always verify the applicable national rules before adopting a policy.

Bring your hiring process together

See how GoJobee can help your team manage candidates in one workflow. Start a free 14-day trial