GDPR in recruitment
GDPR in recruitment means applying the EU General Data Protection Regulation to candidate data: CVs, contact details, screening answers and call transcripts. The employer or agency decides why and how that data is used. It must inform candidates, keep only what it needs and respect their rights.
Every application creates personal data. A frontline hiring team that screens hundreds of candidates a month handles a lot of it, often across a job board, an applicant tracking system (ATS), WhatsApp and a calendar. GDPR applies to all of it, today, whatever the EU AI Act timeline says.
Who is responsible for candidate data?
| Controller | Processor | |
|---|---|---|
| Who | The agency or employer that hires | A vendor that handles data on the controller's behalf |
| Decides | Why and how candidate data is used | Nothing on its own; it follows the controller's instructions |
| Main duties | Inform candidates, choose a legal basis, answer their requests, run a DPIA | Protect the data, use approved sub-processors, help the controller meet its duties |
| Contract | Signs a data processing agreement (DPA) with each processor | Signs the DPA and works within it |
Using a vendor does not move the responsibility. The controller still answers to the candidate.
Which rules apply when you hire?
- A clear purpose. Collect data to fill a role, not "just in case".
- Transparency. Tell candidates what you collect, why and for how long. When AI is involved, tell them at the moment it happens.
- Data minimisation. Ask only what the job needs.
- Retention. Do not keep CVs forever. Set a period and delete or anonymise after it.
- Candidate rights. Candidates can ask for access, correction or deletion and can object. See candidate opt-out.
- Automated decisions. GDPR Article 22 limits decisions made by an algorithm alone. A human click on every AI result may not be enough. See rubber-stamping.
When do you need a DPIA?
A data protection impact assessment (DPIA) is required before you start processing that is likely to carry a high risk for people. GDPR Article 35 already required one for AI screening of candidates. The AI Act sharpens what "high-risk" means for recruitment tools. Run the DPIA before go-live, not after.
What should you ask an AI vendor?
- Will you sign a data processing agreement?
- Which sub-processors do you use and where is that list published?
- What data do you process, where and for how long?
- Can you give the input our DPIA needs?
- Will you fill in our security or GDPR questionnaire?
A vendor that hesitates on any of these is a risk for you as controller.
How does Ringtime handle GDPR?
Ringtime processes candidate data on behalf of its customers, following their instructions and the data processing agreement.
- Ringtime signs a DPA with every customer.
- Its security posture, policies and sub-processors are on trust.ringtime.ai.
- Ringtime gives the input your DPIA needs: what data it processes, where and for how long.
- Its security team fills in your security or GDPR questionnaire.
- A candidate who asks to stop is never contacted again.
This page is general information, not legal advice. Talk to your legal team or data protection officer about your own setup.
To see how GDPR and the AI Act fit together in staffing, read what the EU AI Act means for staffing.
