RecrutFlo logoRecrutFlo
Create account
← All articles

Recruitment operations

GDPR Recruitment Compliance: A Practical Guide for Small Teams

By Andre · · 14 min read

GDPR Recruitment Compliance: A Practical Guide for Small Teams

Geometric illustration of governed recruitment records

GDPR recruitment compliance comes down to five things: a lawful basis for holding each CV, a clear privacy notice, a retention period you actually enforce, a way to answer candidate requests on time, and control over where CV copies live. Most small teams fail on the last one first, because CVs pile up in shared inboxes, downloads folders and forwarded threads.

This guide is for US-based and international teams that hire, or recruit for clients, in the EU or UK, and for anyone wondering whether the rules reach them at all. It is general information, not legal advice. For a specific situation, such as a cross-border agency or a complaint from a candidate, talk to a privacy lawyer or your data protection officer.

Recrutflo
recrutflo.com
Keep Recruitment Records Organized
RecrutFlo centralizes CVs from shared inboxes into searchable candidate profiles, helping teams manage recruitment documents in one place.
Explore RecrutFlo

TL;DR

  • GDPR can apply to a US company when it handles personal data of people in the EU, so a US hiring team recruiting EU candidates should assume it does (Article 3 explained).
  • There is no fixed legal retention period for CVs. Set your own, document the reason, and delete on schedule. Common practice for rejected candidates is 30 days to 6 months, longer only with consent.
  • You often do not need consent to review applications, but you do for a talent pool of people you did not hire.
  • Your privacy notice is where most complaints start. Name your tools, say how long you keep data, and explain how to request deletion.
  • Shared inboxes multiply copies of personal data. Centralize CVs, restrict access and keep an audit trail.

Table of Contents

Does GDPR apply to a US company?

Yes, in many cases. GDPR applies to organizations outside the EU when they offer goods or services to people in the EU or monitor their behavior. TermsFeed’s summary of Article 3(2) describes exactly that reach for US companies. In recruitment terms: if you advertise a job to candidates in Germany, Ireland or Portugal and collect their CVs, you should treat those CVs as GDPR data.

The UK has its own version, UK GDPR, enforced by the Information Commissioner’s Office (ICO). Its recruitment and selection guidance is aimed at employers and at agencies, head-hunters and consultancies hiring on behalf of others, and it is the most readable official material on this topic. The principles are close to the EU rules, but the regulator and the details differ, so check which regime covers each role you fill.

A purely domestic US search for US candidates is generally outside GDPR. Many teams still adopt its habits, because a candidate from Europe can apply at any time and a single clean process is easier than two.

Does GDPR apply to a US company? — overview diagram

Pick a lawful basis for every CV

GDPR lets you process personal data only on one of six legal bases listed in Article 6. Three matter for hiring.

Situation Typical basis What to watch
Reviewing a live application Steps before entering a contract, Article 6(1)(b) Applies while the candidate is genuinely being considered
Keeping a CV for future openings Consent, Article 6(1)(a) Must be freely given, specific, and easy to withdraw
Sourcing or keeping data on a legitimate-interest footing Legitimate interests, Article 6(1)(f) Requires a documented balancing test against candidate rights

A common mistake is asking for consent from every applicant. Consent can be withdrawn at any time, which makes it a fragile foundation for something as routine as reading a CV someone sent you. The EDPB’s guidelines on Article 6(1)(b) are the reference for when pre-contract steps cover your processing.

For storing CVs beyond the current vacancy, the EDPB’s SME data protection FAQ addresses the question directly: consent can be a valid basis for keeping applicants’ CVs for future recruitment, and it names another possible basis too. If you choose legitimate interests instead, write the balancing test down. An unwritten one will not help you in an inquiry.

How long to keep resumes

GDPR sets no number of days. It says personal data should be kept only as long as necessary for the purpose you collected it for. You decide the period, justify it, and apply it consistently. Certix’s guide to CV retention walks through the criteria for setting one.

In practice, teams settle on these windows:

  • Rejected applicants, no consent: delete shortly after the process closes. Anything from about 30 days to 6 months is common, and the longer end needs a reason, such as the time a candidate has to challenge a decision.
  • Talent pool, with consent: typically 1 to 2 years, then ask again or delete.
  • Hired candidates: the CV moves into the employment file and follows employment record rules, which are a separate topic.

These are market practice, not statutory limits. Pick one number per category, put it in your privacy notice, and make the system do the reminding. A retention policy that depends on someone remembering to clean a mailbox will fail by the second quarter.

A worked example

Say a 12-person agency in Chicago fills a marketing role for a client in Dublin. Applications close on 15 March. The agency decides it needs 6 months to handle disputes and to re-contact runners-up if the hire falls through, and it states that in its notice. On 15 September, everyone not hired and not in the talent pool is deleted, including the copies in email threads. Candidates who ticked a separate, unbundled box for future roles are kept until 15 March two years later, then asked to renew. Every step is dated and written down, which is what an inquiry would look for.

Example timeline for candidate CV retention

Consent for talent pools, done properly

The talent pool is where consent earns its place. Make it work like this:

  1. Ask separately from the application itself. A pre-ticked box or a line buried in terms does not count as freely given consent.
  2. Say what you will do: keep the CV for up to a stated period, and contact the person about similar roles.
  3. Record who agreed, when, and to what wording.
  4. Make withdrawal as easy as agreeing: a reply to an email should be enough.
  5. Renew or delete when the period ends.

If you cannot show the record, you cannot show the consent.

The privacy notice is where complaints begin

The ICO’s guidance makes the point that transparency matters most: candidates should be told what you collect, why, how long you keep it and who sees it. Articles 13 and 14 set the content. Article 13 covers data candidates give you; Article 14 covers data you got elsewhere, such as a recruiter pulling a profile from a job board.

A good recruitment privacy notice answers, in plain language:

  • who you are and how to reach whoever handles privacy questions
  • which data you collect and from where
  • the lawful basis for each purpose
  • your retention period for each category
  • which tools and service providers process the data, named
  • how to ask for access, correction or deletion

The naming point is often missed. Regulators expect a notice to reflect the tools you actually use, including CV parsers and applicant databases, and to be updated when they change. Treat the notice as a living document and review it whenever you add or switch software.

Candidate rights you must be ready to answer

Candidates can ask what you hold on them, ask for corrections, and ask for deletion. Under Article 12, you generally have one month to respond, with limited extensions for complex requests. Deletion is not always absolute, since you may have a reason to keep certain records, but a candidate asking you to erase a rejected CV is usually asking for something you must do.

The hard part is not the policy. It is finding every copy. If a CV came in by email, was forwarded to a hiring manager, saved to a laptop and pasted into a spreadsheet, a deletion request means hunting through all four. This is also why a speedy, searchable single source of truth matters more than any badge on a tool.

The EDPB published a decision from the Norwegian authority on a complaint against a large energy company that included a deletion request handled after 38 days and recruitment outsourced to a third party. Read the redacted decision for how a regulator looks at timing and processor arrangements in a hiring context.

Automated screening and Article 22

If software ranks or rejects candidates with no human involved, Article 22 applies. People have the right not to be subject to solely automated decisions with legal or similarly significant effects, and the ICO’s guidance on automated decision making and profiling explains when this triggers and what you owe candidates: information, a way to express their view, and human review on request.

The simple way to stay clear of the problem is to keep a person making the decision. A tool that extracts contact details, skills and experience from a CV and lets a recruiter search and choose is a different thing from one that auto-rejects. If you use scoring, be able to explain the logic to a candidate who asks. The ICO has also published research on how the public perceives automated decisions in recruitment, which is a useful reminder that candidates notice and care.

Why shared inboxes are the weak point

A recruitment inbox such as jobs@ or careers@ feels harmless. In privacy terms, it is a store of personal data with several readers, no retention rule and no deletion routine. Attachments get downloaded to personal devices. Threads are forwarded. Nobody knows how many copies exist. CVault’s GDPR resume screening guide makes the same point: uncontrolled copies are what turn a deletion request into a scramble.

Fixes that work without buying a heavyweight system:

  1. Decide who has access. Our guide to shared inbox permissions recruiters should check covers what to review.
  2. Stop passing files around. Share a link to a candidate profile, not a forwarded attachment.
  3. Make CVs findable. If you can search by name, skill or role, you can answer an access request in an afternoon. See how to search CVs you received by email.
  4. Catch duplicates. The same person applying three times creates three records to correct, export or delete.
  5. Keep a trail. Know who opened, changed or exported a profile.

A step-by-step setup for a small team

  1. Map your data. List where CVs arrive (inbox, job boards, referrals, LinkedIn messages) and where they end up.
  2. Write the notice. Use the checklist above, and name your tools.
  3. Set retention rules. One period for rejected candidates, one for talent pool, each with a reason.
  4. Decide the consent flow for the talent pool, and keep records.
  5. Name a contact for privacy requests and agree a one-month internal deadline.
  6. Consolidate storage. Move CVs from mailboxes into one place with access controls.
  7. Review quarterly. Delete what is due, check the notice against your current tools, and test a mock deletion request.

The fines are the reason people take this seriously: up to 4% of global annual revenue or 20 million euros, whichever is higher, for the most serious breaches. Small teams are rarely the target of the biggest penalties, but a documented, repeatable process is what separates a minor finding from a bad one.

Our view: tools help, but they do not make you compliant

We build RecrutFlo, so here is our perspective, grounded in how recruiting teams actually work.

No software is “GDPR compliant” on its own. Compliance is how you use it: your lawful basis, your notice, your retention rules. What a tool can do is make the right behavior easy and the wrong behavior harder. For teams that receive CVs by email, the biggest risk we see is not hacking. It is scattered copies and no one owning deletion.

That shapes how we build. RecrutFlo connects to your existing mailboxes (Microsoft 365, Outlook and IMAP, with Gmail coming soon), finds CV attachments in incoming mail, and turns them into searchable candidate profiles. We flag duplicates, support CSV export, isolate each workspace, keep an audit trail and let you control team access. Automation handles the repetitive data entry, while recruiters stay in charge of every decision. We do not position it as an automated rejection engine, because the Article 22 questions are simpler when a person decides.

Our design is guided by EU data protection principles, and we say so plainly: you still need your own notice, retention schedule and lawful basis. If a vendor promises to take all of that off your hands, ask harder questions.

— Marco

Where RecrutFlo fits

If your CVs already live in a shared inbox, RecrutFlo turns that inbox into one searchable candidate database without moving your team to a new platform. You can test the workflow on the free plan, then move to Starter at €19 per month, Professional at €49 per month or Business at €149 per month. Extra processing runs are a one-off €9 for 100, €29 for 500 or €49 for 1,000. Details are on the pricing page. If you are weighing this against a full applicant tracking system, our comparison of a recruitment inbox versus a traditional ATS lays out the trade-offs, and our guide to building a candidate database from your inbox shows the setup.

FAQ

Do I need consent to keep a CV?

Not to consider the person for the job they applied for, because that is usually covered by steps taken before a contract. You generally do need a basis, most often consent, to keep the CV for future vacancies. The EDPB’s SME guide confirms consent can serve for this.

How long can I keep rejected candidates’ resumes?

GDPR gives no fixed number. It requires keeping data only as long as necessary. Many teams delete between 30 days and 6 months after the process closes, and keep talent pool records for 1 to 2 years with consent. Whatever you choose, write the reason down and state it in your privacy notice.

Does GDPR apply if my company is in the US?

It can, when you process data of people in the EU in connection with offering goods or services to them or monitoring their behavior. A US company recruiting for jobs open to EU residents should plan for it. The UK has a separate regime enforced by the ICO.

What should I do when a candidate asks me to delete their data?

Confirm who they are, find every copy (inbox, downloads, spreadsheets, databases), delete it, and reply within one month. Keep a note of the request and the date you completed it. Seek legal advice if you believe you have a reason to retain something, such as a pending dispute.

Is a shared recruitment inbox allowed under GDPR?

It is not banned, but it makes compliance harder. Many people can read it, copies spread to devices, and nobody applies a deletion schedule. Restrict access, move CVs into a controlled, searchable store and keep an audit trail.

Sources

Recommended

GDPR Recruitment Compliance: A Practical Guide for Small Teams | RecrutFlo