GDPR: CVs, references and recruitment tests
The Data Protection Authority explains how to apply the GDPR to recruitment. Collect only data needed for the role and set rules for references and automated decisions.
Questionnaires and interviews must respect the candidate's privacy. Do not routinely collect health data or criminal records information. The Data Protection Authority notes that consent alone does not authorise the processing of criminal records data covered by Article 10 of Regulation 2016/679.
For reference checks, the Data Protection Authority requires prior information and freely given authorisation specifying the people to be consulted, the data, the reasons and the period. Refusal must not automatically end the selection process. A reference listed on a CV may count as consent.
A hiring decision must not be based solely on an automated test with a significant effect, unless a legal exception and the applicable safeguards apply. Provide for human review and the opportunity for candidates to express their views. For CVs retained after selection, document the purpose, legal basis, necessary retention period and information given to the candidate, in accordance with Articles 5, 6 and 13 of the GDPR. This page sets no universal retention period. The GDPR has applied since 25 May 2018.