Under the UK and EU GDPR, you may collect and use applicant data only for clear, fair purposes, you must tell applicants what you do with it, you may keep it only as long as needed, and applicants have rights to see, correct and in some cases delete it. This guide explains the main duties in plain language and gives a working checklist.
Key takeaways
- GDPR applies to applicant data, including CVs, interview notes and test results.
- You need a lawful basis, a privacy notice and a retention period before you collect anything.
- Applicants can ask for a copy of their data, and for correction or deletion in some cases.
- Special category data, such as health or ethnicity, has extra rules.
- Using software to support decisions adds duties. A person must stay in control of each decision.
What counts as applicant data
Personal data is any information about an identifiable person. In hiring it includes the CV, cover letter, contact details, answers to screening questions, test and assignment results, interview notes, scorecards, emails, references, and any score or flag attached to a record. Notes written by your hiring managers about a candidate are personal data about that candidate.
GDPR applies when you are established in the EU or UK, and in some cases when you recruit people located there. The UK has its own version, the UK GDPR, with the Data Protection Act 2018. The two are similar in structure but are separate laws, so UK and EU rules can differ over time. Read the official texts: the EU General Data Protection Regulation, the guidance of the European Data Protection Board, and the UK Information Commissioner’s Office pages on recruitment and selection.
The seven principles, applied to hiring
| Principle | What it means | Hiring example |
|---|---|---|
| Lawfulness, fairness and transparency | Have a lawful basis, treat people fairly, and be open about what you do | Publish an applicant privacy notice on the application page |
| Purpose limitation | Use data only for the purpose you stated | Do not add applicants to a marketing list without a lawful basis |
| Data minimisation | Collect only what you need | Do not ask for date of birth or a photograph by default |
| Accuracy | Keep data correct and up to date | Let candidates correct their details and fix errors quickly |
| Storage limitation | Keep data no longer than necessary | Delete declined applications on a set date |
| Integrity and confidentiality | Keep data secure | Use access by role, strong sign-in and secure sharing |
| Accountability | Be able to show how you comply | Keep a record of your decisions, notices and retention schedule |
Step 1: Choose a lawful basis
GDPR gives six lawful bases. Three are common in hiring.
- Steps before entering a contract. Processing is needed to consider the application, for example to read the CV and invite the person to interview.
- Legitimate interests. You have a real business interest, such as running a fair recruitment process, and the use of data is balanced against the rights of the applicant. Write a short assessment to show the balance.
- Consent. The person freely agrees to a specific use, for example to be kept on a talent list. Consent must be easy to withdraw. Because applicants may feel pressure to agree, avoid relying on consent for the main process.
Legal obligation can also apply, for example when you must check the right to work. Choose the basis for each purpose and write it down. Different purposes can have different bases. This is general information, and a data protection adviser can confirm the best fit for your case.
Step 2: Tell applicants what you do
Give applicants a privacy notice at or before the time you collect data. It should be short and clear. It should list who you are and how to contact you (and your data protection officer, if you have one), what data you collect and from where, why you use it and the lawful basis, who receives it (for example your applicant system provider), whether data goes outside the UK or EU, how long you keep it, the rights people have, and how to complain to the regulator. If you use automated tools, say so. Our applicant privacy notice template gives wording you can adapt.
Step 3: Collect less
Review your application form field by field. Ask of each field: do we need this to decide who to interview? If the answer is no, remove it, or move it to a later stage and ask only the finalists. For example, you do not need a home address to read a CV, and you do not need bank details until you make an offer. Collecting less lowers risk and reduces the work of protecting and deleting data later.
Special category data
Some data has extra protection: health, ethnicity, religion, sexual orientation, trade union membership, political opinions, and genetic and biometric data. You need both a lawful basis and a special condition to process it. In hiring, the most common case is equal opportunities monitoring, where you ask applicants to share data on a voluntary basis. Keep it separate from the people who make hiring decisions, explain the purpose, and make it clear that answers are optional. Criminal offence data has its own rules too, and checks are limited by national law.
Step 4: Set retention periods
Decide how long you keep each type of record, and why. For declined applicants, many employers choose a short period linked to the time in which a claim could be made, but the right figure depends on the country and your risk. Write the figure in your notice and apply it. If you want to keep CVs for future roles, ask for consent and renew it after a fixed time. Our guide to applicant data retention goes deeper.
Step 5: Respect applicant rights
| Right | What applicants can ask | Practical step |
|---|---|---|
| Access | A copy of the personal data you hold and information about its use | Know where data lives. Reply within the legal time limit, which is generally one month, with possible extension. Check the official text. |
| Rectification | Correct inaccurate data | Allow edits, and fix mistakes in notes and records |
| Erasure | Delete data in certain cases | Be able to delete a candidate from the system and from other places |
| Restriction and objection | Limit or object to some uses | Have a route to review the request |
| Not to be subject to solely automated decisions | A person should be involved where decisions have legal or similarly significant effects | Keep a person in charge of each hiring decision. See our guide to GDPR Article 22 in hiring. |
Create a one-page procedure: who receives the request, who checks identity, who gathers the data, who reviews it for other people’s information, and who replies. Practice with a dummy request. Interview notes are included in an access request in many cases, so write them as if the candidate may read them.
Step 6: Be careful with automation
If you use software that sorts, scores or filters applications, GDPR adds duties: transparency, a lawful basis, fairness, and in some cases a data protection impact assessment. See our guide on data protection impact assessments for hiring tools. The EU AI Act also treats some hiring systems as high risk. We do not give dates here. Check the official text, and read our overview of the EU AI Act and hiring tools.
FastHire is being built around a simple idea: show each job requirement next to the exact CV passage that supports it, so a person can check the evidence. FastHire is coming soon. It does not rank, score or reject candidates. People make every decision.
A GDPR applicant checklist
| Check | Done? |
|---|---|
| Lawful basis chosen and recorded for each purpose | |
| Applicant privacy notice shown on the application page | |
| Application form reviewed, extra fields removed | |
| Special category data collected only where needed, separated and optional | |
| Retention period set for each record type | |
| Process for access, correction and deletion requests tested | |
| Data processing agreement signed with each software vendor | |
| Access limited by role, strong sign-in turned on | |
| Automated tools identified, with a person deciding in each case | |
| Impact assessment considered for high-risk tools |
Mistakes to avoid
- Treating the CV as public because the candidate sent it. You are still responsible for how you use it.
- Using one global notice for every country. Review rules for the UK and each EU country where you hire.
- Keeping CVs “for future roles” without asking. Ask, and set a time limit.
- Searching social media profiles without a clear reason. Public information is still personal data, and it can reveal protected details.
- Emailing CVs to managers. Share through the system, and remove attachments from inboxes on a schedule.
Which lawful basis for which task: a worked example
This fictional example shows how one hiring process can use different bases for different tasks. A small company in Ireland hires a project coordinator. It is invented for illustration. It is not advice for any real case.
| Task | Possible basis | Reason to write down |
|---|---|---|
| Read the CV and invite people to interview | Steps before entering a contract, or legitimate interests | Needed to consider the application |
| Run a short skills exercise | Legitimate interests | Fair way to compare applicants on the same task |
| Ask all applicants to complete an optional equal opportunities form | Consent for voluntary special category data, with a lawful basis for monitoring | Optional, separate from decision makers |
| Keep the CV of a declined applicant for six more months for future roles | Consent | The applicant said yes and can withdraw |
| Check the right to work of the person who gets the offer | Legal obligation | National law requires the check |
| Contact referees | Legitimate interests, after telling the candidate | Tell the candidate and ask before you call |
Notice what the table does not say. It does not say that the company can use any data for any purpose because the applicant sent a CV. Each purpose has its own reason, and each reason is recorded where the team can find it. When a regulator, a candidate or a manager asks why you hold a piece of data, the answer comes from the table, not from memory.
A short note on international teams
If your recruiters sit in one country and the candidates in another, ask three questions. Where is the data stored? Who can access it from other countries? Which law applies to the candidate? The answers decide which notice you show and which transfer tools you need. Keep a simple map: one line per tool, with country of storage and the vendor agreement. Update it whenever you add a new tool or move a team. A current map is often the first thing an auditor asks to see.
Frequently asked questions
Does GDPR apply if I only hire a few people a year?
Yes. The size of your hiring does not exempt you. Smaller organisations can use simple tools, but the principles still apply.
Can I keep a CV from a rejected candidate?
Only for as long as you can justify. If you want to keep it for future roles, ask the person and set a review date.
Do I need a data protection officer?
Only in specific cases, such as large-scale monitoring or processing special category data on a large scale. Your national regulator and the official text explain when. Even if you do not need one, name a person responsible.
Can I use LinkedIn to find candidates?
Yes, but you must still tell people how you got their data and what you do with it, usually within a month, and use it only for the stated purpose. Read the official guidance for your country.
What if the candidate lives in the EU but my company is in the US?
GDPR may still apply in some cases when you target people in the EU. Ask a data protection adviser about your situation.
Related guides
- Hiring guides for fair and compliant hiring
- Applicant tracking system compliance checklist: GDPR and US records
- EU AI Act and hiring tools
- How to reduce bias in resume screening
- All hiring guides for employers
- Applicant privacy notice: what to include, with a template
- Data protection impact assessments for hiring tools
- Criminal record checks in hiring: fair practice by country
- How to handle candidate data requests under GDPR
This is general information, not legal advice.