What is General Data Protection Regulation (GDPR)?
The General Data Protection Regulation (GDPR) is the European Union's data protection law, with a closely matching UK version. It covers how you collect, use, store and delete personal data, including candidate data, and it limits decisions about people made solely by automated means.
Law and compliancetopic
2 minread
2related terms
In one line
The EU's data protection law, with a UK version. It covers candidate data and limits decisions made only by automated means.
GDPR requires a lawful basis for processing personal data. For recruiting this is often legitimate interests or steps taken before entering a contract, and sometimes consent. You must tell candidates what you collect, why, how long you keep it and their rights, usually through a privacy notice.
Candidates have rights to access their data, correct it, have it erased in some cases and object to some processing. Article 22 gives people the right not to be subject to decisions based solely on automated processing that significantly affect them, with exceptions, and requires safeguards such as human intervention where those exceptions apply.
Serious breaches can bring fines up to 20 million euros or 4 percent of worldwide annual turnover, whichever is higher. Rules differ in detail between the EU and UK; this is general information, not legal advice.
Why it matters to recruiters
Recruiters handle large amounts of personal data: resumes, contact details, interview notes and sometimes sensitive information. Sourcing EU or UK candidates, storing them in a CRM or running AI screening all bring GDPR into play. Good habits on notice, retention and access requests protect candidates and your company.
An example from a recruiting desk
For a US client, an agency sources software engineers in Germany. It records where each profile came from, sends candidates a short privacy notice within a month of collecting their data, sets its CRM to flag records for review after a fixed period and has a recruiter review any AI ranking before a candidate is rejected. When a candidate asks for their data, the agency responds within the legal time limit.
Tips that help
Send sourced candidates a privacy notice explaining what you hold and why.
Set a retention period for candidate data and stick to it.
Keep a person involved in any significant decision an AI tool influences.
Have a simple process for access and deletion requests.
Mistakes to avoid
Keeping every candidate's data forever just in case.
Assuming GDPR does not apply because your company is based outside Europe.
Frequently asked questions
Does GDPR apply to US recruiters?
It can. GDPR can apply to organizations outside the EU that offer services to, or monitor the behavior of, people in the EU. Recruiting EU based candidates often brings it into scope.
Do I need consent to store candidate data under GDPR?
Not always. Many recruiters rely on legitimate interests or pre contract steps instead. Whichever basis you use, document it and tell candidates in your privacy notice.
Can AI reject candidates automatically under GDPR?
Article 22 restricts decisions based solely on automated processing with significant effects, such as rejection, and allows them only in limited cases with safeguards including human intervention. Most employers keep a person in the decision.
