Guides
GDPR checklist for recruiting 2026 - clean, step by step
An honest mandatory checklist for German HR teams. No lawyer language, no 'might possibly' - just: do this, don't do that.
Key takeaways
Set retention
Default 6 months from rejection. Per candidate you can extend with consent. Anonymisation at end of window is automatic.
GDPR notice on the form
Plain language: 'Your data is stored for the application, anonymised after 6 months. KI pre-sorting is used; a human always decides.' No 14 pages, one paragraph is enough.
Data minimisation pass
Look at your application form. Do you really need date of birth, photo, marital status? If no, remove. For every field you ask, you must be able to justify why.
Right-to-information process
If someone asks 'what data do you have on me?', it must be answered in 30 days. One-click export on the candidate detail page suffices.
Turn on audit log
On by default in KI BMS. Who changed what when - the only answer that holds under anti-discrimination law to 'who decided this?'.
Rejection template with concrete reason
A concrete, factual rejection is legally safer than a vague one. Template: 'For this role we need 3+ years Python backend; your focus is frontend.' Concrete > nice.
What GDPR really requires in recruiting
Four cores. One - lawful basis (typically: consent or pre-contract). Two - purpose limitation: application data only for application purposes. Three - data minimisation: don't ask more than needed. Four - retention limit: don't keep data longer than needed.
Plus two procedural duties: information before collection, access on request. The rest are special cases (special categories like health, third-country transfer, etc.).
What to do in the first 30 minutes
Six steps. Each takes <5 minutes in a modern ATS. In KI BMS most defaults are already right - you just have to look once.
FAQ
Frequently asked
Try KI BMS
Free plan, no credit card. We host in Germany. You can export and delete everything self-serve.
Read next
GDPR in recruiting - what you actually have to do (and what you don't)
Six duties, three myths - and how a modern ATS handles half of it for you.
Read
Recruiting with KI - a practical guide
A practical guide, not hype - with clear legal limits and concrete step-by-step instructions.
Read
AI Act 2026 for recruiting - high-risk checklist for German HR teams
Eight concrete duties + three myths + the question 'does this even apply to our small HR team?'
Read