GDPR in hiring
Under GDPR, candidate data is personal data and its processing requires a lawful basis, purpose limitation, defined retention, and respect for data subject rights including access and erasure. Interview recordings and AI-generated assessments are all personal data.
Common failure points are keeping rejected candidates' data indefinitely with no retention policy, no record of the lawful basis for processing, and no process for handling an erasure request.
Where AI contributes to a decision, provisions on automated decision-making and profiling may also apply. Take advice on your specific setup.