How do I ensure my candidate sourcing workflow with recruiting pipeline software is compliant with GDPR?

To keep a candidate sourcing workflow compliant with GDPR, build privacy and data-protection controls into every stage of the recruiting pipeline: sourcing, outreach, storage, screening, sharing, and deletion.

1) Have a lawful basis for processing

For most recruiting activity, the lawful basis is usually legitimate interests or performance of a contract / steps prior to entering a contract.
For special category data (e.g., health, race, religion), you generally need a specific condition under GDPR and should avoid collecting it unless strictly necessary and legally permitted.

2) Be transparent with candidates

Provide a clear privacy notice that explains:

• what data you collect
• why you collect it
• your lawful basis
• who you share it with
• how long you keep it
• candidate rights and how to exercise them
• whether you use automation/profiling

If you source candidates from LinkedIn, job boards, referrals, or data providers, make sure candidates are informed promptly where required.

3) Minimize data collected

Only collect what you need for hiring:

• contact details
• work history
• skills
• interview notes relevant to the role

Avoid storing unnecessary sensitive data, and don’t ask for it unless required for a lawful, job-related reason.

4) Set retention limits

Define retention rules in your recruiting software:

• active candidates: retain during the hiring process
• talent pool prospects: retain only with a valid basis and for a defined period
• rejected candidates: delete or anonymize after your retention window

Automate deletion or anonymization where possible.

5) Respect candidate rights

Your workflow should support:

• access requests
• rectification
• erasure (“right to be forgotten”)
• restriction
• objection
• data portability where applicable

Make sure your ATS can find, export, update, and delete candidate records quickly.

6) Control sharing and access

Limit access to candidate data:

• role-based permissions
• least privilege
• audit logs
• secure sharing with hiring managers and agencies

If vendors process candidate data, ensure you have a Data Processing Agreement (DPA) in place.

7) Check international data transfers

If your recruiting software or vendors store/process data outside the EEA/UK:

• verify the transfer mechanism
• use SCCs or an approved transfer framework where needed
• assess supplementary safeguards
• document transfer impact assessments if applicable

8) Use privacy-by-design in the tooling

Configure recruiting pipeline software to:

• collect consent/notice acknowledgments where appropriate
• prevent unnecessary data fields
• mask or restrict sensitive info
• log access and changes
• support deletion workflows
• separate candidate pools by purpose

9) Be careful with AI and automated screening

If you use AI for sourcing or ranking:

• disclose this in your privacy notice
• avoid solely automated decisions with significant effects unless legally permitted
• review for bias and keep human oversight
• validate data quality and model outputs

10) Document compliance

Keep records of:

• processing activities
• lawful basis decisions
• retention policy
• vendor assessments
• DPIAs for higher-risk processing
• candidate request handling

Practical checklist for your sourcing workflow

• Privacy notice published and linked in outreach
• Lawful basis documented
• Data minimization rules configured
• Retention/deletion automation enabled
• DPA signed with ATS and sourcing vendors
• Access controls and audit logs enabled
• DSAR process documented
• International transfer safeguards reviewed
• AI screening reviewed for transparency and fairness
• Special category data collection disabled unless necessary

If you want, I can turn this into a GDPR compliance checklist for an ATS/recruiting pipeline or a policy template for your team.