HR & Recruitment
GDPR in HR and recruitment: applicant data, CV retention, talent pools, AI in candidate selection and staff records.
Recruitment & GDPR: A Practical Checklist for Employers
Want to assess your whole recruitment process at once? Start here.
The six first steps
Work through them in this order, from collecting the right data to checking your documentation.
- 1 Step 1What Personal Data Can You Collect from Job Applicants? First determine what candidate data you collect and whether you actually need it.
- 2 Step 2When and How Should You Inform Candidates About the Use of Their Personal Data? Make sure candidates receive the required privacy information at the right time.
- 3 Step 3Candidate Privacy Notices: What Should They Contain? Create or review the Candidate Privacy Notice.
- 4 Step 4How Long Can You Keep a Candidate's CV? Set appropriate retention periods for recruitment data.
- 5 Step 5What Happens to Applicant Data When the Candidate Becomes an Employee? Deal correctly with the transition from recruitment to employment and the Staff Privacy Policy.
- 6 Step 6What GDPR Documents Does an Employer Need? Finish with an overview of the GDPR documentation the employer should have in place.
When relevant
Specific topics to pick up once they come up in your process.
Using AI in Recruitment: What Employers Need to Know arrow_forward
AI can draft vacancies, summarise CVs and rank applicants, but it does not shift your GDPR responsibilities. What employers must check before deploying recruitment AI.
Can AI Automatically Reject a Job Applicant? arrow_forward
Article 22 GDPR is a prohibition in principle, not a right candidates have to invoke. What that means before you switch on automated rejection.
Can You Use ChatGPT or Other AI Tools to Review CVs? arrow_forward
Pasting a candidate's CV into an AI tool is personal data processing. What to check about the provider, how much to upload, and where the real risk starts.
Can You Check a Candidate's LinkedIn Profile? arrow_forward
A public LinkedIn profile is still personal data. Checking one during recruitment is often defensible, but only when the information you use is genuinely relevant to the vacancy.
Do You Need Consent to Keep a Candidate's CV? arrow_forward
Consent is not required to process applicant data for the vacancy itself. For keeping a CV afterwards you have two workable routes, and this is how to choose between them.
Can You Contact Former Candidates About a New Vacancy? arrow_forward
A new vacancy opens and you remember a strong candidate from last year. Whether you can email them depends on why you still hold their data and what you told them at the time.
GDPR and the AI Act in Recruitment: How Do They Work Together? arrow_forward
Recruitment AI can fall under both the GDPR and the EU AI Act. The two frameworks overlap but do not do the same thing, and complying with one is not enough.
How Do You Create a GDPR-Compliant Talent Pool? arrow_forward
A talent pool is not permission to keep every CV you have ever received. Here is how to define its purpose, legal basis, retention period, access rules and deletion process.
Can You Keep CVs of Unsuccessful Candidates for Future Vacancies? arrow_forward
Keeping rejected candidates' CVs for future openings is a separate purpose under the GDPR. Here is how to be transparent, pick a legal basis and set a retention period.
The Most Common GDPR Mistakes in Recruitment arrow_forward
Fourteen recruitment privacy mistakes employers make most often, from keeping every CV forever to pasting candidate data into AI tools, and what to do instead.
Can You Screen Applicants' Social Media Profiles? arrow_forward
Searching a candidate's name takes seconds and can reveal far more than a CV. That is exactly why social media screening creates GDPR and discrimination risks for employers.
When Should Applicant Data Be Deleted? arrow_forward
Recruitment creates data faster than most organisations delete it. Here is how to decide when applicant data must go, and where the forgotten copies usually hide.