GLOSSARY

GDPR in Recruiting

GDPR applied to recruiting imposes strict rules on collection, processing, retention and deletion of candidate data. Max retention: 2 years after last contact.

IN DEPTH

GDPR (General Data Protection Regulation, 2018) applies to all personal data processing in recruiting in Europe. Main rules: 1) Clear legal basis (consent or legitimate interest), 2) Transparent candidate information (privacy policy), 3) Max 2-year retention after last contact (unless explicit consent for pool), 4) Right of access, rectification, erasure, portability, 5) European hosting preferable (or standard clauses), 6) Processing register, 7) DPO mandatory above certain threshold. Sanctions up to 4% of worldwide revenue. In 2026, non-GDPR-compliant ATS platforms (US hosting without clauses) expose companies to risks. Cobalt is GDPR-native: AWS/Scaleway EU hosting, DPA included, automated export and erasure, complete audit trail.

Frequently asked questions

Maximum 2 years after last contact with the candidate, unless explicit consent for longer retention in a pool. Beyond that, CVs must be anonymized or deleted. The candidate can request erasure anytime (right to be forgotten).

Not strictly mandatory, but strongly recommended. US hosting requires standard contractual clauses (SCC) and impact analysis. Non-EU transfers are increasingly scrutinized by data protection authorities. Cobalt (AWS/Scaleway EU hosting) drastically simplifies compliance.

Related terms

Ready to upgrade to an AI-first ATS?

Book a 30-min Cobalt demo to see how these concepts apply to your staffing firm or agency.

Book a demo