Candidate Data: The Trust Asset You're Responsible For

When a candidate applies for a role, they share sensitive information: work history, contact information, education, availability, compensation expectations, medical accommodations, visa status, and sometimes deeply personal details about their situation. They're making a vulnerable choice—trusting you with information that could affect their career, reputation, and safety.

That trust is your responsibility. And when you introduce AI into recruiting, you multiply the ways that trust can be broken.

This isn't theoretical. The European Union fined Amazon €746 million for data privacy violations. Wells Fargo faced lawsuits for hiring discrimination. Candidates increasingly ask: "Will my resume be used to train AI models? Who will see my application? How long will you keep my data?"

Privacy Regulations You Must Understand

GDPR (European Union and Extended Reach)

The General Data Protection Regulation applies to any organization processing personal data of EU residents, regardless of where your company is based. If you post jobs globally, you have EU candidates. GDPR compliance is mandatory.

Key GDPR requirements for recruiting:

• Collect only data necessary for recruiting (legitimate purpose)
• Provide clear, transparent privacy notices to candidates
• Document the legal basis for processing (consent, legitimate interest, contract, etc.)
• Store data securely with encryption
• Delete data within specified timelines (30-90 days after decision is common)
• Respect candidate rights: access ("tell me what you have on me"), rectification ("fix my data"), erasure ("delete my data")
• Report data breaches to regulators within 72 hours and notify affected candidates

Penalties: Fines up to €20 million or 4% of annual global revenue, whichever is higher. For a company with €100M revenue, that's €4M. Non-compliance is expensive.

CCPA and CPRA (California)

The California Consumer Privacy Act (CCPA) and its successor, the California Privacy Rights Act (CPRA), grant California residents rights to:

• Know what personal information you collect about them
• Request deletion of their data
• Opt out of data sales or sharing
• Limit use of sensitive personal information

CPRA (effective 2024) adds stricter requirements around AI and automated decision-making. If your AI makes a recruiting decision that significantly impacts someone's rights, candidates can request human review.

Other Jurisdictions and the Global Patchwork

Privacy law is fragmenting globally:

• UK: UK GDPR (similar to EU GDPR, post-Brexit)
• Canada: PIPEDA (Personal Information Protection and Electronic Documents Act)
• Australia: Privacy Act requiring handling of personal information responsibly
• South Africa: POPIA (Protection of Personal Information Act)
• Brazil: LGPD (Lei Geral de Proteção de Dados)
• India: Digital Personal Data Protection Act (DPDP)

Practical approach: Most organizations adopt GDPR as the baseline standard because it's the strictest. If you comply with GDPR, you typically comply with other frameworks. Use that as your floor.

Data Security Risks Specific to AI in Recruiting

Risk 1: Cloud Storage and Geographic Data Residency

When you use an AI tool, candidate data often moves to the vendor's cloud servers. This creates questions: Where exactly is data stored? In which country or region? Is it encrypted in transit (from your ATS to their servers) and at rest (stored on their servers)?

GDPR restricts transferring EU personal data outside the EU without strong safeguards. If your AI vendor stores data on US servers, you need a Data Processing Agreement (DPA) with standard contractual clauses (SCCs) to comply. Failure to do this is a compliance violation.

Questions to ask vendors:

• Where is our data stored geographically?
• Can we restrict data to specific regions (EU, US, etc.)?
• How is data encrypted in transit and at rest?
• What encryption keys are used, and who controls them?

Risk 2: Data Retention and Deletion

How long does the vendor keep candidate data? Some vendors have vague retention policies: "until you delete it" (puts burden on you), "indefinitely" (huge compliance risk), or "as long as your account is active" (what about after you close the account?).

GDPR requires you to delete personal data within reasonable timeframes. Best practice: develop a data retention schedule. Example: "Delete rejected candidate data after 90 days. Delete hired candidate data after 3 years (employment contract completion plus statute of limitations for hiring disputes)."

Require vendors to contractually agree to your retention policy. Get it in writing. "We will delete all candidate data 30 days after you instruct us to delete it."

Risk 3: Unauthorized Use of Data for Model Training

Some AI vendors use customer data to train or improve their models. This means your candidates' resumes, interview feedback, and hiring decisions are feeding training data for a commercial AI product—without candidate consent.

This is a GDPR violation if you haven't informed candidates and obtained consent. And it's an ethical violation even outside the EU. Candidates didn't apply to your company to have their data used to train AI models sold to other companies.

Check vendor terms carefully: Does the vendor use your data for model improvement? Can you opt out? Get it in writing.

Risk 4: Third-Party Access and Subprocessors

Does the vendor share data with other companies (subprocessors)? For analytics? Compliance? Benchmarking? The more companies that touch candidate data, the greater the risk of exposure.

GDPR requires you to approve subprocessors. If a vendor adds a new subprocessor without your approval, you're in breach. Require a Data Processing Agreement that limits subprocessor use and gives you visibility.

Risk 5: Lack of Transparency and Audit Capability

Can you audit how a vendor uses your candidate data? Can you see logs of who accessed what data and when? Transparency is critical for managing risk and responding to candidate data requests.

A vendor that can't tell you "we processed 5,000 candidate records this month with zero unauthorized access" is a transparency risk.

Vendor Security Assessment Framework

Due Diligence Checklist Before Adopting a Tool

Your Data Protection Strategy: Seven Steps

Step 1: Map All Candidate Data You Collect

Document exactly what candidate data you collect and where it lives. Resume? ATS? Email? Phone number? Video interview recordings? Competency assessments? LinkedIn connections? Create a data inventory.

Data inventory example:

• Resumes: stored in [ATS NAME], backup in [CLOUD STORAGE]
• Phone numbers: ATS, plus Workable, plus recruiting CRM
• Interview notes: Google Docs, ATS, email
• Video interviews: [PLATFORM NAME] servers
• Reference checks: email, spreadsheet
• Offer details: ATS, email, offer letter tool

This inventory helps you understand where data is, who can access it, and what needs protection.

Step 2: Execute Data Processing Agreements with All Vendors

Before using a recruiting tool, require a DPA. This is a legal contract specifying:

• What data the vendor can process (be specific)
• How long they'll retain it (implement your deletion schedule)
• What they can use it for (recruiting only, not model training)
• Where they store it (geographic restrictions)
• How they protect it (security standards)
• Who their subprocessors are (transparency)
• Your right to audit (can you verify compliance?)
• Breach notification requirements (72 hours)

Don't skip this. Many vendors have DPAs available; ask for them. If not available, that's a red flag.

Step 3: Limit Data Collection to Necessity

Collect only candidate data you actually need. GDPR's "data minimization" principle applies: don't ask for information you won't use. Examples of unnecessary data:

• Social Security number (until offer stage)
• Age/date of birth (use a general age confirmation if needed)
• Marital status or number of children
• Religion, ethnicity, or political affiliation
• Criminal history (unless required for the role)
• Credit history (unless required for the role)

The less data you collect, the less risk you have if it's breached.

Step 4: Be Transparent with Candidates

Tell candidates how their data will be used. If AI is involved, say so. Examples:

Good transparency: "We use AI to help screen resumes for role fit. Artificial Intelligence will not make the final hiring decision; humans will review all candidates who advance. Your resume may be analyzed by [TOOL NAME] running on [VENDOR NAME] servers located in [REGION]. We delete rejected candidate data after 90 days."

Poor transparency: (hiding AI use, vague about data handling)

Transparency builds trust and ensures compliance. Add it to your privacy policy and job postings if you use AI tools.

Step 5: Create a Data Retention and Deletion Schedule

Develop a documented schedule for when you delete candidate data:

Candidate Status	Retention Period	Reason
Rejected, initial screening	90 days	Brief follow-up period, then delete per GDPR
Rejected, after interviews	1 year	Potential hire if position reopens; also statute of limitations for hiring disputes
Rejected, final candidate pool	1 year	Defend hiring decisions if challenged
Hired, employee onboard	3-7 years	Employment records, tax compliance, potential disputes
Video interviews (not hired)	90 days	GDPR minimization; no need to retain
Reference checks (not hired)	1 year	Supporting documentation for hiring decision

Document this schedule, tell your team, and have a process for automated deletion (not manual—manual deletion is easy to forget).

Step 6: Monitor Access and Create Audit Logs

Know who can access candidate data within your organization and with vendors. GDPR requires you to demonstrate who accessed what data and when. This means:

• Role-based access control: only recruiters, hiring managers, and HR staff access candidate data
• No "free for all" access to your ATS
• Audit logs: "Admin accessed 500 candidate records on 3/12/26 at 2:15 PM"
• Regular access reviews: quarterly check of who has access and why

Your ATS should provide access logs. If it doesn't, that's a gap. Request this feature.

Step 7: Have a Data Breach and Incident Response Plan

When (not if) a security incident happens, you need to respond quickly and correctly. GDPR requires notification within 72 hours. Your plan should include:

• Discovery: How do you know if a breach occurred? (monitoring, vendor notification, etc.)
• Scope Assessment: How many candidates affected? What data was exposed?
• Vendor Notification: Alert vendors to confirm scope and impact
• Regulator Notification: Contact relevant data protection authorities (GDPR requires this for serious breaches)
• Candidate Notification: Send candidates a clear explanation of what happened and what they should do (e.g., monitor credit, reset passwords)
• Remediation: Fix the underlying vulnerability so it doesn't happen again
• Documentation: Document everything for regulatory inquiries

Having a plan before a breach happens means you'll respond correctly, minimize harm, and demonstrate good faith to regulators.

Building Candidate Trust Through Privacy Respect

Privacy Is a Competitive Differentiator

Candidates are increasingly asking about privacy and data security. Companies that handle candidate data respectfully and transparently attract better talent. They build reputation for fairness. Employers that lose candidate data or use it irresponsibly face public backlash and talent drain.

Key Trust-Building Practices

Be Transparent About AI: If AI screens resumes, tell candidates. Not in fine print. Actually communicate it: "We use AI to help our team screen resumes quickly. Every candidate who advances will be reviewed by a real recruiter." This honesty builds more trust than hiding the AI use.

Keep Humans in High-Stakes Decisions: Use AI for efficiency (screening, scheduling). Keep humans for relationship-heavy decisions (interviews, offers, rejections). Candidates want to talk to people about whether they'll get the job, not just bots.

Explain Decisions, Even Rejections: When rejecting a candidate, explain why. Not a generic "we went with a stronger candidate," but something real: "Your technical skills are strong, but we're looking for someone with more experience in [specific area]." This explanation shows respect and helps them improve for future applications.

Respect Candidate Time: Don't make candidates fill out long forms that duplicate their resume. Don't ghost them. Don't leave them hanging for weeks without updates. Candidates experience your recruiting process as a reflection of your company culture.

Consistent Treatment: Treat all candidates similarly. If you're more responsive to referrals than cold applications, that signals bias. If you interview some candidates thoroughly but give others 15-minute phone screens, that's inconsistency. Consistency signals fairness.

Building Your Incident Response Plan

Pre-Breach Preparation (Do This Now)

Before a breach happens, document:

1. Incident Response Team: Who is responsible? Data Protection Officer (if you have one)? Legal? CISO? HR Director? Have clear roles.
2. Contact Information: Get contact info for relevant data protection authorities (in your jurisdiction and candidates' jurisdictions)
3. Notification Templates: Draft candidate notification letters and regulator notifications in advance. When a breach happens, you don't want to write these from scratch.
4. Documentation Process: How will you track what happened? Decisions made? Communications sent?
5. Recovery Procedures: How will you fix the underlying vulnerability?

Post-Breach Response Timeline

GDPR gives you 72 hours to notify regulators. Here's a realistic timeline:

Hours 0-4 (Discovery & Initial Assessment)
Incident team convenes. Scope the breach: how many candidates affected? What data exposed? Secure affected systems. Begin documentation.

Hours 4-24 (Deep Investigation)
Work with IT/security to understand root cause. Contact vendors if their system was breached. Determine regulatory requirements (is this a "serious" breach requiring notification?).

Hours 24-48 (Regulator Notification Preparation)
Draft regulator notification. Consult legal if needed. Prepare for questions regulators will ask.

Hours 48-72 (Regulator Notification Sent)
Send regulator notification before the 72-hour deadline.

Days 3-7 (Candidate Notification)
Send candidates clear, honest notification explaining what happened, what you're doing, and what they should do. Include information about monitoring their credit/identity if relevant.

Days 7-30 (Remediation)
Fix the underlying vulnerability. Implement additional security controls. Review vendors' remediation plans.

Frequently Asked Questions

Must we comply with GDPR if we don't recruit in Europe?

Yes, if you have any EU candidates. GDPR applies to processing personal data of EU residents, regardless of where your company is based or where your servers are. If you post jobs on a global job board (LinkedIn, Indeed, Glassdoor), you have EU candidates. Comply with GDPR. It applies to you.

Do we need explicit consent to use AI to screen resumes?

It depends on what "AI screening" means. If AI extracts qualifications from a resume for a recruiter to review (a normal recruiting task), you may not need explicit consent. But if AI makes predictions about personality, likelihood to stay, or cultural fit, you likely need consent. If the vendor uses data to train their AI model, you definitely need consent. When in doubt, ask and be transparent. It builds trust and ensures compliance.

How do we respond to candidate requests for data access or deletion?

Under GDPR and CCPA, candidates have data subject rights. Create a process: (1) Document the request, (2) Gather data from ATS and all vendors, (3) Provide access or delete as requested, (4) Confirm completion. Respond within 30 days. This is legally required and demonstrates respect for privacy. Slow or non-response can result in regulatory fines.

Are vendor certifications (SOC 2, ISO 27001) sufficient for security assurance?

Certifications are good indicators but not sufficient alone. You're responsible for assessing risk. Ask vendors detailed security questions: How is data encrypted? Who has access? What's the incident response process? How long is data retained? A vendor with SOC 2 but vague retention policies is still risky. Use certifications as a baseline and supplement with detailed vendor assessments and contracts.

What's our liability if a vendor's system is breached?

You're liable. You're responsible for candidate data even if a vendor handles it. If a vendor's system is breached, you must notify affected candidates and regulators. Liability includes regulatory fines (up to 4% of revenue under GDPR), candidate lawsuits (class actions are common), and reputational damage. This is why vendor due diligence, contracts, and monitoring are essential. You cannot fully outsource this responsibility.