GDPR/LOPDGDD in recruiting: a practical guide without jargon

Updated on 17 October 2026. We added what has changed since 2025 and what has not, what the Spanish LOPDGDD adds to GDPR, automated screening, and the real deadlines for answering a candidate.

If you hire in the EU, GDPR asks five things of your recruitment process: a legal basis for each way a candidate reaches you, clear information for that candidate, answers to their rights requests on time, control over any automated decision, and keeping their data only while it serves a purpose. If you hire in Spain, the LOPDGDD adds a few rules on top. Neither law has changed on the points this guide covers since we first published it in 2025, but the context around them has: the CJEU has clarified when an automated score counts as a decision, the AI Act now has a fixed timeline for recruitment, and the Commission has proposed reforming GDPR.

Each point comes with the article behind it. This is not legal advice: we cite the law so you can check it.

What has changed since 2025 and what has not

The two omnibus packages are easy to mix up. The AI one is already in the Official Journal; the Digital Omnibus that touches GDPR (COM(2025) 837) can still change or fail. Until it is published, Article 22 and the definition of personal data stay as they are.

Legal basis: one for each way a candidate reaches you

Agencies have a question to answer first: are you a controller, with your own candidate database, or a processor, handling data on behalf of the client company? What decides it is who actually sets the purposes and means of the processing, not only what the contract says. If you put forward candidates from your database to a client, that disclosure needs its own legal basis and the candidate has to know about it.

Data you should not ask for

Collect only what you need to assess the application (Art. 5(1)(c) GDPR). The special categories in Article 9 GDPR, such as health, religion or trade union membership, are prohibited unless an exception applies. In Spain, Article 9(1) LOPDGDD goes further: the candidate's consent alone is not enough to process data whose main purpose is to identify their ideology, trade union membership, religion, sexual orientation, beliefs or racial or ethnic origin. On an application form, the practical answer is not to ask about any of it. Psychometric tests, according to the AEPD's guide on data protection at work, require the candidate's consent.

The same goes for a photo, age or marital status when the role does not require them: if you do not need it to decide, do not ask for it.

How to inform the candidate

GDPR separates two moments:

• If the candidate gives you the data when applying, the Article 13 information is due at that moment.
• If you get the data from another source, such as a professional network or a database, Article 14 gives you a reasonable period of one month at most, and if you use the data to contact them, at the latest at first contact. In Spain, the LOPDGDD adds that in this case the first layer must also say which categories of data you hold and where they come from (Art. 11(3)).

In Spain, the LOPDGDD lets you do this in layers (Art. 11): a short first layer with who you are, what you use the data for and how to exercise rights, plus a link to the full information. In the first message of an outbound search, one line with those three things, which categories of data you hold and where they come from, and a link to your privacy notice covers the first layer. If you profile candidates, say so and mention their right to object to automated decisions (Art. 11(2)).

The full information includes:

• The legal basis and, if it is legitimate interest, which interest you pursue.
• Recipients, and any transfers outside the European Economic Area with their safeguards.
• The retention period.
• The rights, including withdrawing consent and complaining to the data protection authority.
• The source of the data, if the candidate did not provide it.
• If there are automated decisions, meaningful information about the logic involved and its consequences.

Candidate rights and response deadlines

Candidates can exercise their rights of access, rectification, erasure, restriction and objection, and portability where you process their data on the basis of consent or contract and by automated means. You have one month from receiving a request to answer (Art. 12(3) GDPR), extendable by two further months if it is complex or you receive many, provided you tell the candidate why within the first month.

The question recruiters hear most is "why was I rejected?". If the decision was automated, the right of access includes meaningful information about the logic involved (Art. 15(1)(h)). In February 2025 the CJEU clarified (Case C-203/22) that this means explaining in an understandable way the procedure and principles actually applied to that person's data. Claiming the algorithm is a trade secret is not enough to refuse: according to the same judgment, that information goes to the supervisory authority or the court, which weighs the rights at stake.

Automated screening, scores and AI

The AI Act's high-risk obligations do not apply until December 2027, but GDPR already applies to screening.

• Automated decisions (Art. 22 GDPR). A candidate has the right not to be subject to a decision based solely on automated processing that significantly affects them. Rejecting applications that no person ever looks at is exactly that, whether you use AI or fixed rules such as a years-of-experience filter. It is allowed only when necessary for the contract, when authorised by law, or with explicit consent, and in the contract and consent cases with safeguards: at a minimum, the candidate must be able to ask for a person to review it, give their point of view and contest the decision.
• Scores. In 2023 the CJEU held (Case C-634/21, SCHUFA) that automatically generating a probability value about a person is an automated decision when a third party draws strongly on that value to decide. The case was about creditworthiness, but the reasoning fits a job-match score that recruiters almost always follow.
• Impact assessment (Art. 35 GDPR). A systematic and extensive evaluation of personal aspects based on automated processing, on which decisions with significant effects are based, requires a data protection impact assessment before you start. In Spain, the LOPDGDD lists evaluating personal aspects to create or use profiles among the higher-risk cases (Art. 28(2)(d)), and the Article 35(4) list of the Spanish data protection authority (AEPD) includes evaluating people's performance, personality or behaviour and automated decisions that prevent access to a contract. According to the AEPD, where two or more of its criteria apply, an assessment will be needed in most cases.
• Worker representatives. In Spain, the Workers' Statute (Art. 64(4)(d)) gives the works council the right to be informed of the parameters, rules and instructions behind algorithms or AI systems that affect decisions on access to and retention of employment, including profiling. If your company screens with an algorithm, the works council can ask you how it works.

In practice, the safeguard that works is a person with judgment and authority reviewing each rejection, one by one, before it happens. For what the AI Act adds from December 2027, see our guide to the AI Act in recruiting.

How long to keep a CV

Neither GDPR nor the LOPDGDD sets a number of months. The principle is Article 5(1)(e) GDPR: data is kept only while it serves the purpose it was collected for. In practice:

1. During the process, you keep what you need to decide.
2. When it closes, if you did not hire the person and have neither their consent nor a documented legitimate interest to continue, their data is deleted. Anything you must keep for possible claims is, in Spain, blocked. Blocking (Art. 32 LOPDGDD) means setting the data aside and preventing any use, including viewing it, except making it available to courts, prosecutors or authorities for possible liabilities arising from the processing, and only for the limitation period of those liabilities. After that, it is destroyed.
3. To keep the CV for other vacancies you need consent, with a period the candidate knows. When it expires, you renew it or delete the data.
4. Interview recordings and technical tests usually justify shorter periods than the CV.

Set the period for each case, write it into your record of processing activities and your candidate notice, and check that your software actually applies it.

International transfers

If a vendor processes candidate data outside the European Economic Area, check in this order:

1. Whether the country has a Commission adequacy decision (Art. 45 GDPR).
2. For the US, whether the company is certified under the EU-US Data Privacy Framework (Implementing Decision (EU) 2023/1795). The General Court dismissed the action to annul it on 3 September 2025 (Case T-553/23); the appeal before the Court of Justice is still pending, so it is worth having a fallback.
3. If there is no adequacy, standard contractual clauses (Implementing Decision (EU) 2021/914) with a transfer impact assessment and supplementary measures where the risk calls for them.

Keep a simple record of which vendor transfers which data, where, and under which safeguard.

The contract with your recruitment software vendor

Any vendor processing data on your behalf is a processor and needs a contract with the content of Article 28(3) GDPR: subject matter, duration, nature and purpose, types of data and categories of data subjects; processing only on your documented instructions, including for transfers, and telling you if an instruction breaches the law; staff confidentiality; security measures; rules for sub-processors; help with candidate rights, breaches and impact assessments; return or deletion of the data at the end; and audits, including inspections.

Red flags:

• The vendor reserves the right to use your candidates' data for its own purposes, such as training its models, without that appearing in the contract or in the candidate notice.
• Vague uses such as "service improvement" with no limits.
• No list of sub-processors or processing countries.
• It refuses audits or will not commit to telling you about a breach without undue delay. You have 72 hours to notify the authority (Art. 33 GDPR), and you cannot meet that if your vendor takes a week to tell you.

Checklist

1. Write down the legal basis for each entry route: application, talent pool, outbound search, legal checks.
2. Remove from your forms any question you do not need in order to decide.
3. Prepare the first information layer for applications and for the first message of an outbound search.
4. Decide who answers rights requests and how you meet the one-month deadline.
5. Review which rejections happen without real human review and fix them, or document which Article 22 case they fall under.
6. If you score or filter automatically, carry out the impact assessment before going further and prepare the explanation you will give a candidate.
7. Set retention periods by type of data and block or delete data when each process closes.
8. Review each vendor's processor contract, sub-processors and transfers.

What to ask your recruitment software vendor

• Where is my candidates' data processed and which sub-processors are involved?
• Is my candidates' data used to train models?
• How does the system apply retention periods and deletion?
• Which decisions does the system take without human involvement, and how can someone on my team review or override a recommendation?
• What logs does it keep and how do I export them to answer a candidate or a regulator?

If you work with Mainder, ask your contact the same questions. On our platform the AI recommends and a person decides, your candidates' data is never used to train models, and every AI interaction is logged. We can also help you review your recruiting workflow with a practical, compliance-by-default approach. The details are on our security and compliance page.

Sources

• Regulation (EU) 2016/679, GDPR: Articles 5, 6, 7, 9, 12 to 15, 21, 22, 28, 33, 35 and 45.
• Spanish Organic Law 3/2018, LOPDGDD: Articles 8, 9, 11, 28 and 32.
• Spanish Workers' Statute: Article 64(4)(d).
• Spanish Organic Law 8/2021 on the Comprehensive Protection of Children and Adolescents against Violence: Article 57.
• CJEU judgment of 7 December 2023, Case C-634/21 (SCHUFA).
• CJEU judgment of 27 February 2025, Case C-203/22 (Dun & Bradstreet Austria).
• Digital Omnibus proposal, COM(2025) 837, and its procedure, checked on 17 October 2026.
• Implementing Decision (EU) 2023/1795, EU-US Data Privacy Framework.
• Implementing Decision (EU) 2021/914, standard contractual clauses.
• AEPD: list of processing operations that require an impact assessment (Art. 35(4) GDPR), in Spanish.
• AEPD: data protection in employment relationships, in Spanish: sections on recruitment, automated decisions and retention.