Definition
GDPR in recruiting — GDPR in recruiting refers to how the General Data Protection Regulation, an EU law governing personal data, applies to the resumes, interview data, and other personal information collected during hiring. It applies to any employer processing the personal data of candidates located in the EU, regardless of where the employer itself is based. Core requirements include having a lawful basis for collecting and using candidate data, most often consent or legitimate interest tied to the hiring process; data minimization, collecting only what's actually needed to evaluate a candidate; a defined retention period rather than keeping candidate data indefinitely; and specific candidate rights, including the right to access what data is held about them and the right to request it be deleted. Recruiting-specific data, like AI interview scores or recorded interview transcripts, falls under these same requirements if it identifies a specific person.
GDPR shapes several practical parts of a recruiting process: consent language shown to candidates before they apply or before an interview is recorded, how long a company retains resumes and interview data after a role is filled or a candidate is rejected, and what process exists for a candidate to request their data be deleted.
Because GDPR applies based on where a candidate is located rather than where a company is headquartered, any employer hiring across borders that includes the EU needs to account for it, not only companies based there.
Frequently asked questions
Does GDPR apply to a US company recruiting EU candidates?
Yes, generally. GDPR applies based on the location of the individual whose data is being processed, so a company outside the EU that collects data from EU-based candidates is typically still subject to it.
What rights does GDPR give a job candidate over their own data?
Common rights include access to the personal data held about them, correction of inaccurate data, and erasure, sometimes called the right to be forgotten, requesting that their data be deleted.
How long can a company keep candidate data under GDPR?
GDPR doesn't set one fixed number; it requires that retention be limited to what's necessary for the stated purpose, which is why employers typically document a specific retention period rather than keeping candidate data indefinitely.
Related pages
Handle candidate data on documented terms
Intervieux keeps append-only consent records and a documented data retention policy behind every candidate interaction, giving employers a clear trail for their own compliance review.