GDPR checklist for recruitment: 30 checks, the article behind each and the evidence to keep
On this page
- Why does every check list "evidence"?
- What should be in place before you advertise?
- What applies when candidates apply or are sourced?
- What applies during screening and interviews?
- What extra checks apply to AI and automated decisions?
- What applies when you share candidate data?
- What applies after the hiring decision?
- How do you handle requests, complaints and breaches?
- What is different between the UK and the EU?
- How do you keep the checklist current?
- Questions people ask
A GDPR-compliant recruitment process has a lawful basis for each purpose (Article 6), tells candidates what happens to their data when it is collected or within a month if you sourced them (Articles 13 and 14), collects only what the role needs (Article 5), meets an Article 9 condition for health, ethnicity and other special category data, has contracts with every vendor that processes candidate data (Article 28), keeps a record of processing (Article 30), reports serious breaches within 72 hours (Article 33), runs a DPIA before high-risk processing such as AI scoring (Article 35), deletes data on a schedule, and answers requests within a month (Article 12). The 30 checks below follow a hire from advert to deletion, each with the article behind it and the evidence to keep, as of October 2026.
The checklist is the index. Where a check needs more than a line, it links to the guide that does the work, such as the candidate privacy notice template or legitimate interest in recruitment.
Not legal advice. Article references are to the EU GDPR and the UK GDPR, which share numbering except where noted, as of October 2026. National employment law, works council rules and sector rules add to this list. Confirm your position with counsel in each country you hire in.
Why does every check list "evidence"?
Article 5(2) makes the controller "responsible for, and able to demonstrate compliance." A regulator investigating a candidate's complaint will not ask whether you meant to comply; it will ask for the notice the candidate saw, the assessment behind your lawful basis and the date the data was deleted. If the evidence column is empty, the check is not done.
What should be in place before you advertise?
| # | Check | Article | Evidence to keep |
|---|---|---|---|
| 1 | Map where candidate data lives: ATS, inboxes, calendars, job boards, interview tools, spreadsheets, laptops, agency partners | 5(2), 30 | A data map with an owner per system |
| 2 | Keep a record of processing activities for recruitment | 30 | The record. The under-250 exemption in 30(5) does not apply to processing that is "not occasional," which recruitment is not |
| 3 | Choose and document a lawful basis for each purpose: sourcing, assessment, interviewing, checks, talent pool, monitoring | 6 | A table of purpose and basis, with a legitimate interests assessment for each purpose relying on 6(1)(f); see the stage-by-stage guide |
| 4 | Identify an Article 9 condition for special category data (health, ethnicity, religion, sexual orientation, union membership) and an Article 10 basis for criminal records | 9, 10 | Written conditions; in the UK, the Schedule 1 DPA 2018 condition and an appropriate policy document where required |
| 5 | Decide whether you need a data protection officer | 37 | The decision and reasoning. Required where core activities involve large-scale regular and systematic monitoring, or large-scale special category or criminal data |
| 6 | UK: pay the ICO data protection fee unless exempt | DPA 2018 fee regulations | Registration reference; see the ICO fee page |
| 7 | Write a candidate data retention schedule by category | 5(1)(e) | The schedule; template in retention policy template |
What applies when candidates apply or are sourced?
| # | Check | Article | Evidence to keep |
|---|---|---|---|
| 8 | Give a candidate privacy notice at the point of application | 13 | The notice, its version date and where it appears (careers page, form, job board apply flow) |
| 9 | For sourced candidates, give the notice within one month, or at the first contact, and before passing their details to a client | 14(3) | The first-contact template with the notice link |
| 10 | State the right to object "clearly and separately" at the first communication where you rely on legitimate interests | 21(4) | The wording, set apart from the rest of the message |
| 11 | Ask only for what the role needs; remove date of birth, photo, marital status and similar fields from forms unless a law requires them | 5(1)(c), 25 | The application form, reviewed and dated |
| 12 | UK: treat direct social media messages to candidates as direct marketing under PECR, per the ICO's draft recruitment guidance | PECR | Sourcing message templates reviewed against PECR |
| 13 | Do not trawl personal social media; limit checks to what the role justifies and tell candidates first | 5(1)(b), 6(1)(f) | A written justification per role where checks are used |
What applies during screening and interviews?
| # | Check | Article | Evidence to keep |
|---|---|---|---|
| 14 | Brief interviewers on what not to record: health, family plans, religion and other characteristics volunteered in passing | 5(1)(c), 9 | Interviewer guidance and training record; see what not to write in interview notes |
| 15 | If you record or transcribe interviews, document necessity, tell candidates in advance and offer a no-detriment alternative | 6(1)(f), 13, 21 | The assessment, the invite wording and the spoken line; see recording interviews under UK GDPR |
| 16 | Keep notes and scorecards factual and job-related, because candidates can see them | 15 | Scorecard template with evidence fields; notes are disclosable on a subject access request |
| 17 | Restrict access to candidate records to the people on the requisition | 5(1)(f), 32 | Role-based access settings in each system |
What extra checks apply to AI and automated decisions?
| # | Check | Article | Evidence to keep |
|---|---|---|---|
| 18 | List every tool that scores, ranks, filters or rejects candidates, and confirm a person with authority reviews each decision | 22 (EU); 22A to 22D (UK) | Tool register; Recital 71 names "e-recruiting practices without any human intervention" as an example of what Article 22 covers |
| 19 | Run a DPIA before AI scoring, systematic monitoring or other high-risk processing | 35 | The DPIA, signed off before go-live; the ICO lists when one is required |
| 20 | Tell candidates about automated decisions and the logic involved where Article 22 applies | 13(2)(f), 14(2)(g) | Notice wording; see AI disclosure templates |
| 21 | EU: check AI Act duties: no emotion recognition of candidates (since February 2, 2025), AI literacy measures for staff, and high-risk deployer duties from December 2, 2027 | AI Act arts. 4, 5, 26 | AI register and training records; see the EU AI Act guide |
What applies when you share candidate data?
| # | Check | Article | Evidence to keep |
|---|---|---|---|
| 22 | Sign a data processing agreement with every processor: ATS, interview and transcription tools, assessment and background check vendors | 28 | Signed DPAs and sub-processor lists; checklist in DPAs for recruiting software |
| 23 | Agencies and clients: agree who is controller for what, and how candidate requests are passed on | 26, 28 | Terms of business with a data protection clause |
| 24 | Put a transfer mechanism in place for data leaving the UK or EU, including vendors' sub-processors | 44 to 49 | Adequacy reliance or signed standard clauses, plus a transfer risk assessment where needed |
What applies after the hiring decision?
| # | Check | Article | Evidence to keep |
|---|---|---|---|
| 25 | Delete unsuccessful candidates' data at the end of the retention period, in every system, including copies on laptops and in inboxes | 5(1)(e) | A deletion log |
| 26 | Keep talent pool records only if candidates were told, for a stated period, with an easy objection route | 5(1)(b), 13, 21 | The notice wording and pool expiry dates |
| 27 | Move the hired candidate's data into the employee privacy regime and notice | 13 | Employee privacy notice issued at onboarding |
Check 25 is where most teams fail, because candidate data scatters. Desktop interview tools are a common blind spot: Interview Signal, which we make, keeps transcripts and notes on the interviewer's own computer, so for a tool like that the deletion step happens on each laptop, not in a vendor dashboard. Whatever your stack, the data map from check 1 is what makes deletion possible.
How do you handle requests, complaints and breaches?
| # | Check | Article | Evidence to keep |
|---|---|---|---|
| 28 | Answer access, erasure, objection and rectification requests within one month, extendable by two further months where necessary | 12(3), 15 to 21 | A request log with dates; procedure and reply templates in candidate data access requests. UK: Article 12A sets when the month starts |
| 29 | UK: make it easy to complain and acknowledge complaints within 30 days, in force since June 19, 2026 | DUAA 2025 s. 103 | Complaint route and acknowledgment template |
| 30 | Report personal data breaches to the regulator within 72 hours unless unlikely to result in a risk; tell candidates when the risk is high; log every breach | 33, 34 | A breach log, including breaches you decided not to report |
Typical recruitment breaches are ordinary: a CV pack emailed to the wrong client, a shortlist shared with the whole company, a laptop with interview notes left on a train. Article 33(5) requires you to document every one, reported or not, with the facts, the effects and what you did.
What is different between the UK and the EU?
| Topic | EU GDPR | UK GDPR, as of October 2026 |
|---|---|---|
| Automated decisions | Article 22: decisions based solely on automated processing with legal or similarly significant effects only on listed grounds, with safeguards | Articles 22A to 22D, inserted by section 80 of the Data (Use and Access) Act 2025 and in force since February 5, 2026: permitted with safeguards, stricter for special category data |
| Legitimate interests | Three cumulative conditions | Same test, plus a short list of "recognised legitimate interests" since February 5, 2026, none of which covers recruitment |
| Request deadlines | One month plus two | Same periods, with Article 12A setting when the clock starts |
| Complaints | To the supervisory authority | Controllers must run their own complaints process first (section 103) |
| AI-specific law | EU AI Act (Regulation 2024/1689, as amended) | No equivalent statute |
| Regulator guidance | EDPB guidelines and national authorities | The ICO's recruitment and selection guidance, marked draft and under review when we checked |
Commencement dates for the UK changes are in SI 2026/82. US employers recruiting directly in the EU should check whether Article 3(2) brings them into scope and whether Article 27 requires an EU representative.
How do you keep the checklist current?
- Assign owners. One name per check, usually split between the recruiting lead, HR and whoever handles privacy.
- Review on change. A new ATS, interview tool, AI feature or country triggers a pass through checks 1 to 4, 19 and 22 to 24.
- Review on a date. Once a year at minimum, and after any complaint or breach.
- Sample the evidence. Pick three candidates from last quarter and trace them: what notice they saw, where their data is now, and whether anything should already have been deleted.
Questions people ask
What does GDPR require from a recruitment process?
A lawful basis for each purpose, privacy information given when data is collected or within one month for sourced candidates, only the data the role needs, an Article 9 condition for special category data, processor contracts, records of processing, security, breach reporting within 72 hours, a DPIA for high-risk processing such as AI scoring, set retention periods, and a process for candidate requests.
How long do recruiters have to answer a candidate's GDPR access request?
One month from receipt, extendable by two further months where necessary, with the candidate told about the extension and the reason within the first month. In the UK, Article 12A, in force since February 5, 2026, sets when the month starts, for example once the requester's identity is confirmed.
Do small recruitment agencies need a record of processing activities?
Almost always. Article 30(5) exempts organizations with fewer than 250 people only if their processing is occasional, unlikely to result in a risk, and excludes special category and criminal records data. Recruitment processing is not occasional, so most agencies and employers that hire regularly need the record.
Do I need a DPIA to use AI in recruitment?
Usually yes. Article 35 requires a DPIA for processing likely to result in a high risk, and Article 35(3)(a) names systematic and extensive evaluation of people based on automated processing, including profiling, where decisions with significant effects are based on it. AI scoring of candidates usually fits. Do it before the tool goes live.