Data protection
Handling candidate data under GDPR: a recruiter's working checklist
Practical data-protection habits for CVs, interview notes and talent pools — written for hiring teams rather than lawyers.
27 March 2026 · 6 min read
A CV is personal data from the moment it arrives
Every CV, interview note, assessment score and reference contains personal data. The obligations start at collection, not at storage — which means the way you ask for information matters as much as where you keep it.
Collect what the decision needs and nothing more. Date of birth, marital status, photographs and nationality are rarely necessary to assess capability, and collecting them creates risk without improving the hire.
Be specific about purpose and retention
Tell candidates what the data will be used for, who it will be shared with, and how long it will be kept. Vague statements about keeping a CV 'on file' are not enough; give a period and honour it.
If you want to keep a candidate in a talent pool beyond the current role, ask separately and record the answer. Consent gathered for one vacancy does not extend indefinitely.
Control who can see what
Share candidate files with the people involved in the decision, not the whole department. Avoid forwarding CVs through personal accounts or unmanaged group inboxes, and remove access when someone leaves the panel.
Interview notes are disclosable. Write them as if the candidate may read them — factual, job-related, and free of comment on protected characteristics.
Have a deletion routine that actually runs
Set a retention period, put a recurring reminder against it, and delete across every location the data lives — applicant tracking system, shared drives, email attachments and any spreadsheets used for tracking.
Be ready to respond to access and erasure requests within the statutory window. Knowing in advance where candidate data sits is what makes that possible.
This article is general information, not legal advice. Employment rules differ by EU member state — we scope the specifics with you before any hire.