Know your lawful basis, collect only what you need, control access, retain data appropriately, and fulfill candidate requests quickly.
Recruiting teams handle sensitive personal data (CVs, contact details, notes), so GDPR compliance has to be built into the workflow, not handled in ad-hoc spreadsheets and inboxes.
Processing must have a lawful basis under GDPR Article 6, such as consent or legitimate interests. For many recruiting activities, 'legitimate interests' can apply, but it requires a defensible assessment and must not override the individual's rights and expectations.
Action items
GDPR principles include data minimisation—collect data that is adequate, relevant, and limited to what's necessary for the recruiting purpose. In recruiting practice, avoid collecting sensitive 'special category' data unless there's a clear need and additional conditions are met (often best avoided entirely).
Action items
Under storage limitation, personal data should not be kept longer than necessary for the purpose you stated. If the recruiting purpose ends, you should delete (or anonymize) the data rather than keeping it 'just in case.'
Action items
Candidates can request access to their personal data, and your process must be able to extract and provide it. A DSAR response should cover what data you hold, why you process it, how long you keep it, and other required context.
Action items
Executive search and agency recruiting require controlled visibility (who can see which candidates/searches) because confidentiality is part of the service. Your tooling must enforce this access model so sensitive candidate/client context isn't casually shared across teams.
Action items
If you use vendors (ATS, enrichment tools, email sync, storage), you need clarity on processing terms and where data is stored/processed. Treat 'we are GDPR-compliant' marketing claims as insufficient without operational controls and agreements.
Action items
These work well as gated downloads and align with how agencies actually operate:
Purpose / necessity / balancing template to document your lawful basis
Clear retention periods for applicants vs talent pool
Step-by-step process for handling data subject access requests
Storing data 'because it might be useful later' violates storage limitation unless you can justify ongoing purpose and safeguards.
Using legitimate interests without doing the balancing test and documenting it leaves you exposed in an audit or complaint.
Letting the real workflow live in spreadsheets with contact details and notes weakens access control and auditability.
Yena is positioned as an executive-search-first ATS/CRM for Europe, with GDPR and confidentiality needs considered in product design rather than bolted on later. The most practical message: use a real system of record with controlled access and repeatable workflows, because spreadsheet-first execution is exactly where compliance and operational risk multiply.
Having a clear lawful basis for processing (usually legitimate interests for sourced candidates) and being able to prove it with documentation. Without this, all other compliance work is built on shaky ground.
Only as long as necessary for the stated purpose. For unsuccessful applicants, 6-12 months is common. For talent pools, you need ongoing proof of interest (opt-in, engagement tracking). No indefinite storage 'just in case.'
Not always. For sourcing and initial outreach, 'legitimate interests' can apply if you have a defensible assessment and provide transparency. Consent is one option, but not the only lawful basis under Article 6.
You have 30 days to respond. You must provide: what data you hold, why you process it, how long you keep it, who you share it with, and their rights. Your ATS/CRM must be able to export this quickly—spreadsheet-only tracking makes DSARs painful.
Spreadsheets aren't inherently non-compliant, but they make compliance extremely difficult: no access controls, no audit logs, no automated retention, weak security. For serious recruiting operations, spreadsheets create operational and compliance risk.
A DPA is a contract required when a vendor processes personal data on your behalf (your ATS, enrichment tools, etc.). It defines their obligations, security measures, subprocessors, and your rights. Every vendor handling candidate data needs one.
See how Yena handles GDPR workflows, access control, and data retention—designed for European recruiting agencies.
EU-hosted • DPA included • 14-day free trial