The basics
| Duty | What it means for hiring |
|---|---|
| Legal basis | Processing an application is usually based on steps before a contract or on legitimate interest. Consent is needed for extras, such as keeping someone in a talent pool. |
| Transparency | A candidate privacy notice linked from the application form: who you are, what you collect, why, how long, who receives it, and their rights. |
| Data minimization | Ask only what you need to assess the application. No date of birth, photo or marital status on the form. |
| Storage limitation | A defined retention period, and deletion when it ends. |
| Rights | Access, correction, deletion and objection, answered within one month. |
| Security | Limited access, encryption in transit, and no resumes forwarded around by email. |
| Processors | A data processing agreement with your ATS and other vendors that handle candidate data. |
How long to keep applications
GDPR sets no number; it says no longer than necessary. Practice differs by country:
- Germany: commonly up to six months after a rejection, which covers the period in which a discrimination claim can be brought.
- France: the regulator CNIL accepts up to two years after the last contact, if the candidate is told and can object.
- UK: the ICO gives no fixed period; six to twelve months is common.
To keep a promising candidate for future roles beyond that period, ask for consent and record it.
Access and deletion requests
- Access: the candidate may get a copy of their data, including interview notes and scores, within one month.
- Deletion: erase the application when asked, unless you must keep it for a legal claim. That includes copies in inboxes and shared drives.
- Keep a record of the request and what you did.
Interview notes are part of the candidate's data. Write them as if the candidate will read them.
AI screening under GDPR
Article 22 gives people the right not to be subject to a decision based solely on automated processing that significantly affects them. Rejecting applicants by score alone falls under it. The safe pattern: AI ranks and explains, a person decides, candidates are told that AI assists the review, and the reasoning for each score is kept. The EU AI Act additionally classes recruiting AI as high-risk, with duties around human oversight and transparency.
What your ATS should do
| Need | How Evander handles it |
|---|---|
| Privacy notice and consent | A careers page takes applications only after a privacy contact and retention period are set; every form links the notice and records consent. |
| Retention | Candidates whose process has ended are erased automatically after the workspace's retention period. |
| Deletion request | An admin erases a candidate in one step; the request is logged. |
| Access request | Export of a candidate's data as a bundle. |
| Human decision | Scores rank. Rejections proposed by an assistant or automation wait for a person's approval, and an assistant can at most ask to erase a candidate; a screening rule a person wrote can reject on its own, logged and reversible. |
| Audit | Every change recorded with who or what made it. |
| Hosting | United States (US East) today. See security. |
Evander stores data in the United States today. If you need storage in the EU, ask your vendor where data is held and under which transfer mechanism before you sign.
Questions
How long can you keep job applications under GDPR?
GDPR sets no fixed period. Common practice is up to six months after a rejection in Germany, up to two years after the last contact in France if the candidate is informed, and six to twelve months in the UK. Keeping data longer needs the candidate's consent.
Do I need consent to process a job application?
Usually not for the application itself, which rests on steps before a contract or legitimate interest. You need consent for extras such as keeping the candidate in a talent pool after the role is filled.
Can a candidate ask to see interview notes?
Yes. Interview notes and scores are the candidate's personal data and are covered by an access request, which must be answered within one month.
Is AI resume screening allowed under GDPR?
Yes, if a person makes the decision. Article 22 restricts decisions based solely on automated processing, so AI may rank and explain while a person rejects or advances. Tell candidates that AI assists the review.
Does GDPR apply to a US startup hiring in Europe?
Yes. GDPR applies to processing the personal data of people in the EU, and UK GDPR to people in the UK, regardless of where the company is based.