Personal data in the recruitment process — scope and legal bases
The recruitment process involves processing a broad range of personal data: CVs with names, addresses, contact details, education, and work history; cover letters; recruiter interview notes; and competency test results. Under GDPR, the legal basis for processing data for a specific recruitment is taking steps prior to entering a contract (Article 6(1)(b)). Retaining CVs for future recruitment requires separate, voluntary candidate consent (Article 6(1)(a)). Failing to distinguish between these two bases is the most common mistake HR departments make.
CV retention — how long and on what basis
After completing recruitment for a specific position, the employer should delete data of unsuccessful candidates. In practice, 3 months after recruitment completion is considered a justified period. Retaining CVs longer requires separate candidate consent with a clear indication of the period and purpose. The recommended consent period is a maximum of 12 months. The ATS should automatically flag data for deletion after the retention period.
Recruitment data security in the ATS
An ATS stores thousands of CVs with personal data — its security is a GDPR obligation. Basic requirements include: data encryption at rest and in transit, role-based access control, multi-factor authentication for system users, data access logging, and automatic data deletion after the retention period. When choosing a cloud ATS provider, check server location (EEA), the data processing agreement (DPA), and security certifications (ISO 27001, SOC 2).
Candidate rights and information obligations
Candidates have the right to: information about data processing, access to their data, rectification of inaccurate data, erasure (right to be forgotten), restriction of processing, data portability, and objection to processing. The HR department must respond within 30 days. The privacy notice should be accessible in the job posting. nFlo helps secure HR IT infrastructure and ATS systems in compliance with GDPR.
Cybersecurity for Your Industry
Learn more about cybersecurity in your industry:
Why this matters for organizations
How long can you retain candidate CVs? Learn GDPR requirements for recruitment data — retention periods, consent, candidate rights, and ATS security. In the context of growing cyber threats and tightening regulations (NIS2, DORA), organizations must proactively manage this security area. Failure to implement adequate safeguards can lead to data breaches, financial penalties, and reputational damage.
Best practices for implementation
Effective implementation requires several key steps:
- Risk assessment and inventory — identify assets, threats, and vulnerabilities specific to your organization.
- Policy development — document requirements, roles, and responsibilities.
- Technical controls — deploy tools and configurations proportionate to identified risks.
- Training and awareness — engage employees in protecting organizational security.
- Monitoring and continuous improvement — regularly verify effectiveness and adapt to the evolving threat landscape.
