GDPR in Recruiting: Privacy Best Practices for 2026

By Sparsh Goyal, Founder at The Cognitive. Published 2026-11-03 · Last updated 2026-11-04

• Recruiting under GDPR needs a lawful basis per step, a privacy notice to sourced people by the first message or within one month, set retention periods, one-month replies to rights requests and a DPA with every vendor.
• Regulators fined about EUR 1.2 billion under GDPR in 2025 (DLA Piper), and the EDPB's 2026 enforcement action with 25 authorities targets the notice rules.
• GDPR sets no retention period, so national guidance fills the gap: France's CNIL recommends keeping talent pool records up to 2 years from last contact.

Recruiting under the General Data Protection Regulation (GDPR) comes down to six habits:

1. Have a lawful basis for each step: steps taken at the candidate's request for applicants, and a documented legitimate interest for sourcing.
2. Tell people what you do, and tell sourced people by your first message or within one month of getting their data, whichever comes first.
3. Collect only what the role needs.
4. Keep it no longer than necessary.
5. Answer access and deletion requests within one month.
6. Sign a contract with every vendor that touches candidate data.

This is general information, not legal advice; a data protection lawyer should check your own setup.

European regulators fined companies about EUR 1.2 billion under GDPR in 2025, according to the DLA Piper GDPR Fines and Data Breach Survey (January 2026). In March 2026 the European Data Protection Board (EDPB) began a coordinated enforcement action with 25 data protection authorities on one subject: telling people what you do with their data. For recruiters, the rule bites hardest with people they sourced, who never handed over their data and so have not yet been told anything.

What does GDPR require from recruiters?

GDPR in recruiting is the set of rules on how an employer collects, uses, keeps and deletes job candidates' personal data in the European Union and European Economic Area. It covers applicants and also people a recruiter finds and contacts who never applied. The employer is the controller. Under Article 5(2), the controller must "be able to demonstrate compliance". Most recruiting software vendors act as processors, working on the employer's instructions.

Four principles from Article 5 do most of the work in hiring:

• Purpose limitation. Data is collected "for specified, explicit and legitimate purposes", so a CV sent for one role cannot automatically be used for every future role.
• Data minimisation. Data must be "limited to what is necessary", so a first screen has no use for a date of birth or a home address.
• Storage limitation. Data is kept "for no longer than is necessary", and GDPR sets no number of months.
• Accountability. If it is not written down, it is hard to show.

The stakes are set in Article 83(5): fines of up to EUR 20 million or 4% of total worldwide annual turnover, whichever is higher. The DLA Piper survey (January 2026) counts EUR 7.1 billion in GDPR fines since May 2018, and an average of 443 breach notifications a day across Europe in the year it covers, up 22%.

The table maps each hiring stage to its rules. The lawful basis for rejected candidates and talent pools is common practice, not article text.

What lawful basis do you need to recruit, and do you need consent?

Most recruiting does not run on consent. Article 6(1) lists several lawful bases, and two fit hiring best.

For applicants, the basis is Article 6(1)(b): processing needed "to take steps at the request of the data subject prior to entering into a contract". The candidate applied, so reading the CV and running interviews are steps they asked for. Consent would add little and could be withdrawn mid-process.

For sourcing, the usual basis is legitimate interest under Article 6(1)(f). Consent is a poor fit there, because a recruiter cannot ask before holding the data, and a person can withdraw consent at any time. Legitimate interest has a condition attached: it fails where the person's interests or rights override the employer's. The EDPB guidelines on legitimate interest (2024, still the version published for public consultation) set three cumulative conditions:

1. A legitimate interest. Filling a specific role with a qualified person is a clear one.
2. Necessity. The data used must be needed for that interest: work history and skills, not family details or unrelated social posts.
3. Balance. The person's interests and rights must not take precedence. A professional profile someone published to be found for work weighs differently from a private account.

The EDPB says controllers should "carefully assess and document" these conditions "before carrying out the relevant processing". In practice that means one short written assessment for your sourcing activity as a whole, kept on file, rather than one per candidate. Methods for finding people are in passive candidate sourcing.

What must you tell candidates, and when?

Every candidate must get a privacy notice, and the timing depends on where the data came from. When a candidate applies, Article 13 applies, and the notice is due when the data is collected. A link on the job post or the application form usually covers it.

Sourced candidates fall under Article 14, which has its own timing rule. Article 14(3) says the notice is due "within a reasonable period after obtaining the personal data, but at the latest within one month". If the data is used to contact the person, it is due "at the latest at the time of the first communication". So the notice is due with the first outreach email, or one month after you got the data if that comes sooner. The exemption for "disproportionate effort" is narrow, and it is hard to claim when you are already writing to the person.

For a sourced candidate, the Article 14 items that matter are:

• who you are and how to contact you, and your data protection officer if you have one;
• why you hold their data and on what basis, including the legitimate interest you rely on;
• what categories of data you hold;
• where it came from, and whether that was a publicly accessible source;
• how long you keep it, or how you decide;
• who receives it, and whether it goes outside the EU;
• their rights: access, correction, erasure, restriction, objection and portability, plus the right to complain to a data protection authority;
• any automated decision-making, with meaningful information about the logic involved.

The full notice can live on a web page, with a short line in the first email that points to it, like this:

I found your public profile on [source] while searching for a [role] at [company]. We hold your name, current role, work history and contact details for this search, based on our legitimate interest in hiring for it. We keep them for [period], or delete them sooner if you ask. You can ask for a copy, a correction or deletion, or object, at [privacy email], and you can complain to your data protection authority. Full notice: [link].

How long can you keep candidate data and CVs?

GDPR sets no fixed retention period for candidate data or CVs. Each employer has to set and write down its own periods. National regulators and employment law fill the gap, so the answer changes by country.

In France, the CNIL, the data protection regulator, published a retention schedule for human resources in April 2026. It recommends keeping a talent pool record for up to 2 years from the last contact with an unsuccessful candidate, unless the person objects. Separately, French labour law lets an employer keep an unsuccessful candidate's file for 5 years from the date the job was filled, as evidence in case of a discrimination claim.

Other countries set other periods, so a team hiring across Europe needs a period per country or a single cautious one.

Three working rules hold everywhere:

• Set the period per stage. A rejected applicant, a talent pool member and a sourced person who never replied are different cases.
• Tell people about talent pools. Someone who applied for one job did not ask to be kept for the next one. Say so in the notice and give them a way out.
• Make deletion happen. A retention period needs something to run it: either an ATS rule deletes on schedule, or a named person runs a review on a set date.

The recruiting CRM guide covers how to run a talent pool day to day.

How do you handle access and deletion requests from candidates?

A candidate's access or deletion request must be answered within one month. Article 12(3) requires action "without undue delay and in any event within one month of receipt of the request". The deadline can be extended by two further months for complex or numerous requests, but the person must be told within the first month.

Deletion is hard to get right in every sector, not only hiring. In 2025, 32 European supervisory authorities collected answers from 764 controllers across sectors on how they handle the right to erasure. Their report, adopted in February 2026, lists seven recurring issues. Several map straight onto recruiting:

• no documented, up-to-date procedure for erasure requests;
• missing or weak staff training;
• too little information given to people;
• difficulty setting and applying retention periods;
• deleting data held in backups;
• difficulty with anonymisation as a way to answer requests.

For a hiring team, the procedure is short. Find every copy of the person: the ATS, the sourcing tool, the outreach tool, interview recordings, spreadsheets and shared inboxes. Delete or export from each, record what was done and when, and reply.

Then keep only the minimum needed to stop future outreach to the person, and say so in the notice.

Is AI screening or an AI interview allowed under GDPR?

AI screening is allowed under GDPR, with limits on decisions made by software alone. Article 22(1) gives a person "the right not to be subject to a decision based solely on automated processing" that has legal or similarly significant effects. Rejecting a candidate can be such a decision. Where a decision relies on the contract or explicit consent exception, Article 22(3) still requires at least the right to human intervention, to give a view and to contest the decision.

Let AI score, summarise and rank, and let a person make the reject decision. Tell candidates before the step what is recorded and how it is scored, and include any automated decision-making of that kind in the privacy notice, as Articles 13 and 14 require. The EU AI Act also classes AI used in recruitment as high-risk, with its own duties; those are covered on the EU AI Act page. The law by country, bias testing and vendor checks are in AI screening software compliance.

What should a GDPR-friendly ATS and recruiting stack do?

A GDPR-friendly applicant tracking system (ATS) makes lawful basis, notices, retention and deletion part of the daily workflow instead of a yearly clean-up. Look for consent and lawful-basis fields and retention rules that delete or anonymise on schedule. It should also add privacy notices to job posts and first emails, and offer a way to find and delete one person everywhere. The table shows how three common systems describe these features in their own help pages.

The wider ranked list is in the best applicant tracking systems.

Article 28 says a controller "shall use only processors providing sufficient guarantees", under "a contract or other legal act". That means a data processing agreement (DPA) with the sourcing tool, the outreach tool, the interview platform and the scheduling tool, not only the ATS.

Transfers outside Europe are the other check. Many recruiting vendors host data in the United States. That is lawful with a valid transfer mechanism, usually the European Commission's Standard Contractual Clauses or the EU-US Data Privacy Framework. Ask each vendor which one it uses and where it is written down.

The United Kingdom runs its own version, the UK GDPR. The Data (Use and Access) Act 2025 received Royal Assent on 19 June 2025, and most of its data protection provisions came into force on 5 February 2026. A team hiring in the UK should read the UK guidance separately rather than assume the EU text applies word for word.

Where does The Cognitive fit in GDPR-aware recruiting?

The Cognitive is AI recruiting software for sourcing, outreach and first interviews. It searches about 900M public profiles from a plain-English brief, sends personal email from the recruiter's own mailbox on the Sourcing Team plan and on Sourcing Pro and above, and runs a live two-way AI video interview. For candidate data and people found through sourcing, the customer is the controller and The Cognitive is the processor. A data processing agreement is part of the terms for business customers and is available on request.

Before anyone is contacted, the recruiter sees what each match rests on.

The privacy features, as an admin sees them:

• Find, export or delete one person. An admin looks someone up by email, and can add their LinkedIn link to also catch sourced profiles saved without an email, then sees what is held, and can export everything or delete it permanently. Lookups, exports and deletions are kept in an audit log.
• No re-contact after deletion. A person who asked to be deleted cannot be added to an outreach campaign again.
• An opt-out in every email. Each outreach email ends with a line inviting a "no thanks" reply, and a reply, an opt-out or a bounce stops the follow-ups. The message is editable per role, so the Article 14 line above, with a link to your own privacy notice, can go into the first email. The default email does not include a privacy notice; adding it is the employer's job.
• A notice before the AI interview. Before an AI interview starts, the candidate reads a notice about how the interview is recorded, scored and shared, and must agree to it. The agreement is recorded.

More detail is on the security page and in the privacy policy. The product pages are AI sourcing and AI interviewer.

When to skip The Cognitive

The Cognitive hosts its application and database in the United States. For transfers from the EEA, the UK and Switzerland, it relies on Standard Contractual Clauses, with the UK Addendum where relevant. It has not appointed an EU or UK representative. Teams whose policy requires EU-only hosting, or a vendor with an EU or UK representative, should choose a tool that offers them. It is also not an ATS: consent records, job-post notices and retention rules for applicants belong in the ATS.

How to start

Write the legitimate interest assessment for sourcing, set a retention period for each stage, and put a short privacy line in the first outreach email. Then list every tool that holds candidate data and check each one for a DPA, a transfer mechanism and a way to delete one person. To try sourcing and first interviews inside that setup, the free trial runs 7 days with no card. Try The Cognitive free.

Sources

• Regulation (EU) 2016/679 (General Data Protection Regulation), official text, eur-lex.europa.eu, 2016. Article text quoted from gdpr-info.eu.
• European Data Protection Board, Guidelines 1/2024 on processing of personal data based on Article 6(1)(f) GDPR, version 1.0 for public consultation, edpb.europa.eu, 8 October 2024.
• European Data Protection Board, Coordinated Enforcement Framework report on the right to erasure, edpb.europa.eu, 10 February 2026.
• European Data Protection Board, CEF 2026: coordinated enforcement action on transparency and information obligations, edpb.europa.eu, 19 March 2026.
• DLA Piper, GDPR Fines and Data Breach Survey, dlapiper.com, 21 January 2026.
• CNIL, Référentiel: durées de conservation, gestion des ressources humaines, cnil.fr, April 2026.
• UK Government, Data (Use and Access) Act 2025: plans for commencement, gov.uk, 2026.
• ATS features from each vendor's own help pages: Greenhouse (support.greenhouse.io, GDPR Configuration), Workable (help.workable.com, compliance settings), Teamtailor (support.teamtailor.com, automatic deletion rules and privacy policy).

All posts · thecognitive.io