For COOs, HR leaders, and operations teams scaling international remote teams, this is not a legal technicality. It is a practical risk with real consequences: regulatory fines, candidate trust erosion, and contractual liability with staffing partners.

This guide gives you a clear, decision-ready framework for GDPR compliance in remote hiring — covering what applies to your situation, what you must put in place, and where most employers get it wrong.

What Is GDPR Compliance for Remote Hiring?

GDPR compliance for remote hiring is the legal obligation to process job candidate personal data in accordance with the General Data Protection Regulation (EU) 2016/679 — at every stage of the recruitment lifecycle, regardless of where your company is headquartered.

In practice, this means any data you collect from a candidate — CV, interview notes, assessment results, identity documents, background check reports, or email exchanges — must be handled lawfully, transparently, and with clearly defined retention limits.

The complexity for remote hiring lies in GDPR's extraterritorial reach (Article 3). The regulation extends to any organisation that targets or employs individuals in the EU/EEA, irrespective of the employer's location. That is the clause that catches most non-EU employers off guard.

Does GDPR Apply to Your Company? A Practical Breakdown

The answer depends on your candidate pool, your systems, and your hiring model. Here is how to assess your exposure by scenario:

• US company hiring an EU-based remote employee: GDPR applies to that candidate's data throughout and after the hiring process. See regional breakdown for US-specific obligations.
• Australian company using a European-hosted ATS: If the platform stores data on EU servers, data processing obligations apply — regardless of candidate location.
• UK company post-Brexit: UK GDPR applies. If you also process EU-resident candidate data, EU GDPR applies simultaneously. Transfer mechanisms differ between UK and EU frameworks.
• Global company hiring a contractor in India: GDPR does not automatically apply to Indian nationals located in India — but EU-hosted systems or EU-resident decision-makers can re-trigger it. See the cross-border transfers section for staffing agency obligations.
• No EU nexus at all: GDPR technically does not apply. However, most scaling SMEs cannot guarantee this indefinitely — and GDPR-aligned practices are now a global hiring standard.

GDPR Lawful Basis for Recruitment: Legitimate Interest vs Consent

Every act of processing candidate data must be justified by a lawful basis under GDPR Article 6. In recruitment, the two most relevant bases are legitimate interest and consent. Most employers get this wrong — and that mistake creates operational risk throughout the process.

Legitimate Interest: The Right Default for Active Recruitment

Legitimate interest (Article 6(1)(f)) allows you to process candidate data without explicit consent when you have a genuine, documented business reason, the processing is necessary, and it does not override the candidate's fundamental rights.

This applies to:

• Reviewing CVs and applications from candidates who actively applied
• Conducting structured interviews and reference checks
• Assessing candidates against defined role criteria
• Communicating application status updates

To rely on legitimate interest, document a Legitimate Interests Assessment (LIA) — a short internal record confirming the business purpose, necessity, and balanced consideration of candidate rights. This is item 2 in your compliance checklist.

Consent: Narrow, Specific, and Often Misused

Consent under GDPR must be freely given, specific, informed, and unambiguous. No pre-ticked boxes. No bundled agreements. No implied acceptance.

Consent is appropriate only for:

• Retaining a candidate's CV beyond the active hiring process for future roles — governed by talent pool retention rules
• Adding candidates to a talent pool or job alerts list
• Processing sensitive personal data (health, disability, criminal convictions) where no other basis applies

What Personal Data Can You Legally Collect?

GDPR's data minimisation principle is clear: collect only what is adequate, relevant, and limited to what is necessary for the recruitment purpose. Anything beyond that must be disclosed in your candidate privacy notice.

Permissible Candidate Data

• Full name, email address, phone number, city/country
• Work history, education credentials, professional qualifications
• Skills, languages spoken, portfolio or work samples
• Interview notes and structured assessment scores
• References (with appropriate prior notice to referees)
• Right-to-work status (where legally required — see regional obligations)

Special Category Data — Strict Controls Required

GDPR Article 9 imposes stricter obligations on health/disability status, racial or ethnic origin, religious beliefs, sexual orientation, and criminal conviction records. Only collect this data when there is a clear, documented legal basis. If in doubt, rely on the lawful basis guidance above.

Data You Should Not Collect

• Date of birth (unless legally required for the specific role)
• Marital status or nationality (unless legally necessary)
• Photographs (unless operationally justified)
• Social media profiles unrelated to the role

What Must Your Candidate Privacy Notice Include?

A recruitment-specific candidate privacy notice is a legal requirement under GDPR Articles 13 and 14. It must be provided at the point of data collection — on your application form or careers page. A general website privacy policy does not satisfy this obligation.

Your notice must include:

1. Identity of the data controller — your company's legal name and registered address
2. DPO contact details — if a Data Protection Officer is required or appointed
3. Purposes of processing — recruitment assessment, background checks, talent pooling
4. Lawful basis for each processing activity — see the lawful basis section
5. Categories of personal data collected — aligned to your data collection policy
6. Data retention periods — refer to the retention framework table
7. Third-party sharing — recruiters, ATS providers, background check firms — all governed by a Data Processing Agreement
8. International data transfers — see cross-border transfer mechanisms
9. Candidate rights — access, rectification, erasure, restriction, portability, objection
10. Right to complain — to the relevant supervisory authority (ICO, DPC, etc.)
11. Consequences of not providing data — e.g., inability to progress the application

How Long Can You Keep CVs and Interview Notes?

GDPR does not set a fixed retention period. The storage limitation principle (Article 5(1)(e)) requires data be kept no longer than necessary. Most Data Protection Authorities consider 6 to 12 months reasonable for unsuccessful candidates. Talent pool retention requires separate consent and a documented renewal process.

Can You Record Remote Video Interviews?

Yes — with prior informed consent from the candidate. The consent must be given before the recording begins, not collected mid-session. This is distinct from the legitimate interest basis used for the interview itself.

• Include a recording notice in the interview invitation email
• Verbally confirm and record consent at the session start
• State the specific purpose — using recordings to train AI models requires separate explicit consent
• Set a retention limit: delete recordings within 30–90 days of the hiring decision
• Ensure your video platform (Zoom, Teams, Google Meet) has a signed DPA with your organisation

Cross-Border Data Transfers: What's Required

When EU/EEA candidate data moves outside the EEA — to the US, Australia, India, or Canada — GDPR Chapter V safeguards are required. For most SMEs, the primary mechanism is Standard Contractual Clauses (SCCs). Any staffing agency handling this data also requires a signed Data Processing Agreement.

Post-Schrems II (2020), signing SCCs alone is not enough. You must also complete a Transfer Impact Assessment (TIA) to evaluate whether the receiving country's surveillance laws undermine SCCs. This is step 8 in the compliance checklist.

Data Processing Agreements: A Mandatory Requirement

GDPR Article 28 mandates a written DPA with every third party that processes personal data on your behalf. In remote hiring, this includes recruitment agencies, ATS platforms, background check services, video interview tools, and any HR system touching candidate data.

A valid DPA must specify:

• Subject matter, duration, and nature of the processing
• Types of personal data and categories of data subjects
• Processor obligations: act only on instructions; implement appropriate security; support your compliance obligations
• Sub-processing restrictions: processor must obtain your authorisation before engaging sub-processors — see mistake #8
• Data deletion or return requirements — tied to your retention schedule
• Audit rights for you as the data controller

GDPR Risk Profile: Remote Hiring Models Compared

Different hiring models carry different compliance complexities. Understanding your model's risk profile helps you build the right infrastructure from the start — and informs how thoroughly to apply the compliance checklist.

The 8 Most Common GDPR Mistakes in Remote Hiring

• Defaulting to consent as the lawful basis for all recruitment data. Use legitimate interest for active hiring; reserve consent for talent pooling only.
• No recruitment-specific candidate privacy notice. Your general privacy policy does not satisfy Article 13. See what the notice must include.
• CVs stored indefinitely in shared folders with no deletion schedule. Implement automated retention rules in your ATS.
• No DPAs with recruitment agencies, ATS providers, or HR platforms. Audit your vendor contracts immediately. Review the DPA requirements.
• Recording interviews without advance disclosure. Consent must precede the recording. See the full recording guidance.
• Not responding to erasure requests within one month. Assign a named owner. This is step 9 in the compliance checklist.
• Relying solely on SCCs without a Transfer Impact Assessment. Post-Schrems II, the TIA is mandatory. See the cross-border transfer guide.
• No sub-processor audit of ATS or HR platforms. Your platforms may embed third-party AI tools that constitute sub-processors — covered under your DPA obligations.

GDPR Compliance Checklist for Remote Hiring

Regional Considerations: US, UK, Australia & Canada

GDPR sets the global benchmark. Each major hiring region layers its own framework on top of it.

Recommendations by Company Stage

Last updated February 2026. General informational purposes only. Not legal advice — consult a qualified data protection professional for your specific circumstances.