Conformidade RGPD para Recrutamento na Europa.

1. What GDPR means for recruiting

• Controller vs Processor: Agencies and internal talent teams are usually "Controllers" for candidate data. ATS providers like Yena act as "Processors" under a Data Processing Agreement (DPA).
• Lawful Bases: Recruiting typically relies on either "Legitimate Interest" (Art. 6(1)(f)) or "Consent" (Art. 6(1)(a)). You must be clear which you use and document it.
• Special Category Data: Avoid collecting unnecessary sensitive data (health, political views, religious beliefs) unless strictly required and lawfully justified.

Base Jurídica para Tratamento de Dados de Candidatos

• Legitimate Interest: Often used for initial contact and evaluation when sourcing for a specific role. Requires a "balancing test" (LIA) and giving candidates clear information + opt-out options.
• Consent: More appropriate for long-term talent pools, marketing communications, or when required by strict local interpretation. Must be specific, informed, freely given, and withdrawable.
• DACH Nuance: Regulators and Works Councils in DACH often expect a higher bar for long-term storage and reuse of candidate profiles, especially for unsuccessful applicants.

3. Information obligations (Art. 13/14)

• Transparency: You must provide privacy information when collecting data directly (applications) or indirectly (sourcing from LinkedIn). Include: identity of controller, purposes, legal basis, retention, and rights.
• Timing for Sourced Candidates: Information should usually be provided within a reasonable timeframe (e.g., at first contact or within one month max).
• Audit Trail: Keep records of when and how privacy information was provided (e.g., template email sent, link to policy included).

Períodos de Retenção de Dados

• Purpose Limitation: You cannot keep data "forever, just in case". Many DACH employers agree on retention windows (e.g., 6–24 months) for unsuccessful candidates.
• Executive Search Exception: Executive search firms may justify longer retention where long-cycle relationships are documented and candidates are informed and can opt out.
• Deletion Rules: Implement clear rules: automatic anonymisation/deletion after X months without activity, plus manual deletion on request.

5. Works Councils and German Specifics

• Co-determination: In Germany, Works Councils (Betriebsräte) often have co-determination rights on HR systems, including ATS and recruiting processes (under BetrVG).
• Betriebsvereinbarungen: Agreements may specify exact data fields, retention periods, access controls, and transparency obligations for any recruiting software used.
• Proactive approach: Early involvement and clear documentation of how the ATS handles access, logs, and deletion usually speeds approval.

6. Handling data subject rights

• Rights: Candidates can request access, correction, restriction, or deletion ("Right to be Forgotten"), and may object to processing (e.g., talent pools).
• Timelines: Controllers must generally respond within one month. You need internal procedures to identify and act on these requests promptly.
• Coordination: Clear coordination between agency and client is vital when sharing candidate data. Who is responsible for responding and updating systems?

7. Where data lives and where it can go

• EU Hosting: Many DACH recruiters strongly prefer (or require) EU-hosted systems to minimize transfer risks.
• Transfers: Cross-border transfers (e.g., to the US) require safeguards such as Standard Contractual Clauses (SCCs) or the EU-US Data Privacy Framework.
• Documentation: You must document where your ATS hosts data and what subprocessors it uses in your privacy notices.

8. Checklist: making your agency DACH-ready