GDPR compliance checklist for recruiters (practical, not theoretical).
Know your lawful basis, collect only what you need, control access, retain data appropriately, and fulfill candidate requests quickly.
Recruiting teams handle sensitive personal data (CVs, contact details, notes), so GDPR compliance has to be built into the workflow, not handled in ad-hoc spreadsheets and inboxes.
Checklist (copy/paste).
Lawful basis
Article 6Processing must have a lawful basis under GDPR Article 6, such as consent or legitimate interests. For many recruiting activities, 'legitimate interests' can apply, but it requires a defensible assessment and must not override the individual's rights and expectations.
Action items
Data minimisation (only collect what you need)
GDPR principles include data minimisation—collect data that is adequate, relevant, and limited to what's necessary for the recruiting purpose. In recruiting practice, avoid collecting sensitive 'special category' data unless there's a clear need and additional conditions are met (often best avoided entirely).
Action items
Retention + deletion (storage limitation)
Under storage limitation, personal data should not be kept longer than necessary for the purpose you stated. If the recruiting purpose ends, you should delete (or anonymize) the data rather than keeping it 'just in case.'
Action items
Candidate rights (DSAR-ready)
Candidates can request access to their personal data, and your process must be able to extract and provide it. A DSAR response should cover what data you hold, why you process it, how long you keep it, and other required context.
Action items
Access control + confidentiality
Executive search and agency recruiting require controlled visibility (who can see which candidates/searches) because confidentiality is part of the service. Your tooling must enforce this access model so sensitive candidate/client context isn't casually shared across teams.
Action items
Vendors + processors (DPAs, subprocessors, data residency)
If you use vendors (ATS, enrichment tools, email sync, storage), you need clarity on processing terms and where data is stored/processed. Treat 'we are GDPR-compliant' marketing claims as insufficient without operational controls and agreements.
Action items
Templates (lead magnets).
These work well as gated downloads and align with how agencies actually operate:
Legitimate Interests Assessment (LIA) template
Purpose / necessity / balancing template to document your lawful basis
Recruiting retention policy template
Clear retention periods for applicants vs talent pool
DSAR response checklist + data export form
Step-by-step process for handling data subject access requests
Common mistakes (what breaks compliance).
Keeping candidate data indefinitely
Storing data 'because it might be useful later' violates storage limitation unless you can justify ongoing purpose and safeguards.
Claiming legitimate interests without documentation
Using legitimate interests without doing the balancing test and documenting it leaves you exposed in an audit or complaint.
Operating from Excel trackers
Letting the real workflow live in spreadsheets with contact details and notes weakens access control and auditability.
Use a real system of record, not spreadsheets.
Yena is positioned as an executive-search-first ATS/CRM for Europe, with GDPR and confidentiality needs considered in product design rather than bolted on later. The most practical message: use a real system of record with controlled access and repeatable workflows, because spreadsheet-first execution is exactly where compliance and operational risk multiply.
Frequently asked questions
Having a clear lawful basis for processing (usually legitimate interests for sourced candidates) and being able to prove it with documentation. Without this, all other compliance work is built on shaky ground.
Only as long as necessary for the stated purpose. For unsuccessful applicants, 6-12 months is common. For talent pools, you need ongoing proof of interest (opt-in, engagement tracking). No indefinite storage 'just in case.'
Not always. For sourcing and initial outreach, 'legitimate interests' can apply if you have a defensible assessment and provide transparency. Consent is one option, but not the only lawful basis under Article 6.
You have 30 days to respond. You must provide: what data you hold, why you process it, how long you keep it, who you share it with, and their rights. Your ATS/CRM must be able to export this quickly—spreadsheet-only tracking makes DSARs painful.
Spreadsheets aren't inherently non-compliant, but they make compliance extremely difficult: no access controls, no audit logs, no automated retention, weak security. For serious recruiting operations, spreadsheets create operational and compliance risk.
A DPA is a contract required when a vendor processes personal data on your behalf (your ATS, enrichment tools, etc.). It defines their obligations, security measures, subprocessors, and your rights. Every vendor handling candidate data needs one.
Built for compliance, not bolt-on compliance.
See how Yena handles GDPR workflows, access control, and data retention—designed for European recruiting agencies.
EU-hosted • DPA included • 10-day free trial