Recruitment & HR · GDPR

Recruitment & HR — GDPR: candidates and employees

GDPR closely governs the processing of candidate and employee data: lawful basis, information, retention periods for applications, data minimisation, monitoring, and profiling. Employers and recruitment firms are data controllers. This guide details these obligations and a tailored roadmap.

DPO / CISO team — Data Comply One Updated on 15 June 2026

In brief

  • Regulation: GDPR.
  • All employers and recruitment firms are concerned, with no threshold.
  • Ground every processing activity.
  • Limit retention.
  • Minimise.
  • Fines of up to €20M or 4% of global turnover, in addition to employment litigation risk.

Regulatory deadlines

The key dates of this regulation.

May 2018

Entry into application

In force

What does GDPR cover?

The employer acts on various legal bases (pre-contractual measures, contract, legal obligation, legitimate interest). Unsuccessful applications cannot be retained indefinitely; placing them in a talent pool requires consent.

Data collection must be limited to what is necessary, excluding irrelevant sensitive data.

Is the 'Recruitment & HR' sector concerned?

All employers and recruitment firms are concerned, with no threshold. HR tool publishers are processors and must be governed accordingly.

Employee representatives must be informed/consulted on certain systems (surveillance).

Detailed obligations

Ground every processing activity

Define the legal basis (recruitment, personnel management) and inform the individuals concerned.

Limit retention

Govern the retention period for applications; obtain consent for the talent pool.

Minimise

Collect only relevant data; exclude unjustified sensitive data.

Govern surveillance

Scale and declare monitoring systems; inform and consult stakeholders where applicable.

Govern profiling

Informing on HR profiling and ensuring human intervention.

Sanctions & risks

Fines of up to €20 M or 4% of worldwide turnover, in addition to employment litigation risk. Disproportionate monitoring and excessive retention of applications are frequent grounds.

Common mistakes in the sector

  • 1Applications retained without limit. Retaining unsuccessful CVs indefinitely without consent.
  • 2Sensitive data collected. Collecting irrelevant information.
  • 3Disproportionate surveillance. Monitoring employees beyond what is necessary.
  • 4Missing information. Failing to inform candidates and employees.

Practical case

A company was retaining all job applications for an undefined period and monitoring employee communications without informing staff. Remediation involves setting a defined retention period, obtaining consent for talent pools, ensuring proportionality in monitoring and informing the individuals concerned.

Compliance roadmap

  1. 1

    Map. Inventory candidate and employee processing activities.

  2. 2

    Frame data retention. Define retention periods and talent pool.

  3. 3

    Minimise. Limit the data collected.

  4. 4

    Govern surveillance. Proportionate and inform.

  5. 5

    Document. Maintain the register and inform.

Frequently asked questions

A limited and justified retention period; beyond that, consent is required for the talent pool.

Back to the Recruitment & HR guideRecruitment & HR & AI Act

Take action on GDPR

Free assessment or a chat with an expert dedicated to recruitment & hr.

Start my free assessment Talk to an expert

They already trust us

See how organisations in the recruitment & hr sector secured their compliance with DCO.

See testimonials