GDPR in recruiting

Connect each use to a purpose

A CV, an interviewer’s notes and a sourcing record all contain personal data. Under the GDPR, applicable since 25 May 2018, the employer must identify the purpose and lawful basis for processing it. Collect only information needed for that purpose and explain the processing to the person.

The EDPB’s guidance on lawful processing sets out several possible bases. A current application, future recruitment contact and retention for a legal claim should not be treated as one undifferentiated use. Additional conditions can apply to sensitive information and criminal-conviction data.

Keep a retention rule, not an indefinite archive

Review what is still needed when the search closes. A retention policy should cover CVs, notes, messages and copies held outside the recruitment system.

The EDPB’s CV-retention FAQ identifies consent as a possible basis for future recruitment. It does not make consent a justification for keeping everything forever. Where you rely on it, ensure that it is specific, informed, freely given and withdrawable.

Know who must respond

The organisation deciding the purposes and means of processing is the controller. A service provider processing data on its behalf acts as a processor for that activity; the relationship needs the arrangements required by Article 28.

Join’s privacy policy makes this distinction concrete: Join acts as a processor for applications to a recruiting company’s specific vacancy, while acting as a controller for certain separate platform activities. The role depends on the processing, rather than one label covering every service.

Assign responsibility for candidate requests and access to the record. GDPR Article 12 generally requires a response within one month, with a permitted extension in specified circumstances. The applicable rights and exceptions should be assessed for the request received.