GDPR Q43

How does GDPR affect recruitment?

Q43. How does GDPR affect recruitment?

Category: Employment

Recruitment involves handling applicant data sensitively and fairly from application through onboarding.

In simple terms

Collect only relevant information and keep it secure.
Provide transparent applicant privacy notices.
Retain data for limited periods and delete unsuccessful applications.

During recruitment

Explain why you need applicant data, how long you will keep it, and who will see it. Avoid unnecessary questions that reveal special category data unless justified.

Use secure applicant tracking systems.
Anonymise CVs where possible to reduce bias.
Obtain consent or another lawful basis for background checks.

After recruitment

Retain successful applicants’ data for HR purposes and delete or anonymise unsuccessful applications after a defined period unless the individual agrees to future contact.

Send clear communications about retention and deletion.
Store interview notes securely and restrict access.
Provide an easy way for candidates to update or withdraw their information.

Practical steps to take

Publish a recruitment privacy notice explaining data use.
Use secure channels for applications and references.
Limit access to recruitment data to those directly involved.
Delete data for unsuccessful applicants promptly (e.g., after six months).
Handle requests from candidates quickly, including SARs or objections.

Real-life examples

Graduate scheme

A company retains applicant data for six months to consider them for future roles, but only with explicit consent.

Sensitive reference

An employer stores reference checks separately with restricted access because they contain opinions about the candidate.

Helpful reminders

Avoid keeping copies of ID documents unless necessary for the role.
If using automated screening, provide human review options.
Ensure third-party recruiters follow your privacy standards.

Key takeaway

Respect candidate privacy throughout recruitment—be transparent, minimise data, and delete it when no longer needed.