Recruiting software privacy checklist: what to review before you start

Recruiting software can bring order to a busy hiring process. It collects CVs, structures profiles and makes selection criteria easier to compare. It also handles sensitive personal data. A CV can include contact details, work history, certificates, salary expectations and sometimes health or family information.

That is why you should not choose a tool only by its feature list. Privacy belongs in the buying decision from the start. This is even more important when AI reads CVs, prioritises candidates or creates scores. You need clear rules, suitable contracts and human oversight.

This checklist helps you review recruiting software before rollout. It is not legal advice. It gives your team the practical questions to ask before candidate data enters the system.

Why hiring data needs extra care

Application data is not the same as ordinary marketing data. It describes a person’s career, qualifications and future plans. Candidates share it for a specific purpose. They want to apply for a particular role.

The GDPR and UK GDPR require careful processing. Core principles include lawfulness, fairness, transparency, purpose limitation, data minimisation, storage limitation and security. Your team should know why data is processed. It should also be able to explain how long that data remains stored.

Hiring workflows can create privacy risks quickly. A manager downloads CVs to a laptop. An old spreadsheet keeps circulating. Candidate details are discussed in a chat tool. Or an AI feature uses documents in a way your privacy notice never explained.

A good privacy check catches these gaps early. It turns privacy into a design step, not an emergency fix.

1. Define responsibility first

Start with one basic question. Is the provider a processor, or does it act as a controller for some activity? In many recruiting setups, the vendor processes data on your behalf. Then you need a suitable data processing agreement.

Do not review that agreement only by title. It should describe the categories of data, the purpose, the duration, security measures and subprocessors. If those details are missing, the agreement is too weak for a serious review.

Set internal ownership too. HR, the hiring manager, leadership, IT and privacy stakeholders should work from the same facts. Otherwise, different teams make different assumptions.

Practical questions:

Who decides the purpose and means of processing?
Is there a data processing agreement?
Which subprocessors does the vendor use?
Where are hosting, support and backups located?
Who can export or delete candidate data?

Write the answers down. A short internal note is enough at first. The important point is traceability.

2. Map the data flow before uploading CVs

Many privacy problems come from unclear data flows. So sketch the journey of an application before launch. Start with the form, email inbox or upload route. Follow the data until deletion.

List every system involved. This can include the careers page, email inbox, recruiting platform, storage provider, AI analysis feature and export destination. Include notifications too. Some tools send personal data in email subjects or chat messages.

Pay attention to handovers. Every integration can become a control gap. A clean workflow needs clear access rules. Not everyone in the company needs every CV.

A useful data-flow map answers these questions:

Which data enters the tool?
Which fields are extracted automatically?
Which new data does the system create?
Which people can see the data?
Which exports are possible?
When is the data deleted?

If you cannot answer these questions, the workflow is not ready.

3. Collect only what you need

Data minimisation can sound abstract. In hiring, it is very practical. The less unnecessary data you collect, the lower your risk. It also keeps screening fairer.

Review every field in the application form. Do you really need date of birth, photo, full address or family status? For many roles, name, contact details, CV and a few role-related questions are enough.

AI screening should follow the same logic. A score should be based on job-related criteria. It should not rely on irrelevant signals. Avoid criteria that indirectly point to age, background or private circumstances.

HireSift is built around role-specific criteria. Your team defines what matters for the job. The assessment follows those criteria and remains reviewable.

4. Be transparent about AI support

If software analyses or prioritises CVs, candidates should understand the role of that software. A hidden clause in a long privacy notice is rarely enough in practice. Add a short explanation in the application flow.

A safer wording can look like this:

We use software to structure applications and identify relevant experience faster. The assessment is based on criteria for this role. Invitations and rejections are not decided by the software alone.

This wording is clear and cautious. It explains the function. It mentions the criteria basis. It also states that people remain involved.

That matters because the GDPR includes specific rules for decisions based solely on automated processing. The EU AI Act also treats certain AI systems in employment as high-risk. That can include systems used for recruitment, selection or candidate evaluation.

Avoid absolute claims. Do not say: “Our AI makes fair decisions”. A better line is: “AI supports screening, while people review hiring decisions”.

5. Set access rights with care

Privacy often fails in everyday use, not in the vendor contract. Too many people get access. Old users stay active. Exports are not controlled. A simple permissions model can prevent these problems.

Define roles inside the tool. Recruiters may need broad access. Hiring managers may only need candidates for their own roles. External interviewers may need interview notes, but not full application files.

Check whether the tool offers audit logs. You should be able to see who viewed, changed or exported important data. That helps with accountability and internal control.

At minimum, review:

roles and rights per job
two-factor options for admins
separation between admins and regular users
export permissions for candidate data
logs for important actions
deactivation of former users

These checks are not glamorous. They prevent real incidents.

6. Define deletion and retention rules

Candidate data should not remain in a system forever. You need clear retention rules. The right period depends on country, legal basis and internal process. The key point is to define it deliberately.

Set a rule for rejected applications. Decide when they are deleted or anonymised. Also decide when someone may move into a talent pool. For that, you need proper information and a suitable legal basis. In many practical cases, a voluntary and specific opt-in is the cleanest route.

Ask about backups and exports. Data is not truly gone just because it disappeared from the user interface. The vendor should be able to explain how deletion works technically.

7. Ask vendor questions before signing

Good vendors answer privacy questions clearly. Weak vendors stay vague. Ask direct questions before buying.

Use this checklist:

Is hosting in the EU, UK or another clearly explained location?
Which subprocessors are involved?
Are customer documents used for model training?
Is there a data processing agreement?
How does deletion work, including backups?
Which security measures are documented?
Which roles, permissions and logs are available?
How does the product support human review?

If a vendor avoids these questions, treat that as a warning sign.

8. Build privacy into the hiring workflow

A privacy review should not be a document that disappears after purchase. It needs to fit the working process.

Create a short internal routine for each new role. Your team reviews the criteria. It checks required fields in the form. It confirms who needs access. It sets a retention date. It decides whether a talent pool option is used.

This keeps privacy practical. It does not slow the team down. It becomes a normal part of a controlled hiring process.

A simple launch checklist

Before the first live application, confirm these points:

The purpose of processing is clear.
The vendor role is documented.
The contract covers security and subprocessors.
The application form avoids unnecessary fields.
AI support is explained in plain language.
Human review remains part of the decision.
Access rights match real job needs.
Retention and deletion rules are defined.
Exports and backups are understood.
The team knows who owns the process.

If one of these points is missing, fix it before launch.

Conclusion: privacy is a selection criterion

Recruiting software should reduce manual work. It should not create a new black box for candidate data. The best tools make data flows, criteria and decisions easier to understand.

Review contracts, data flows, permissions, deletion and AI transparency before launch. Keep compliance claims cautious. Favour processes that can be checked.

HireSift helps teams analyse applications in a structured way. Criteria stay visible. People keep the decision. That makes automation easier to control, and safer to explain.