GDPR checklist for recruiting 2026 - clean, step by step

Four cores. One - lawful basis (typically: consent or pre-contract). Two - purpose limitation: application data only for application purposes. Three - data minimisation: don't ask more than needed. Four - retention limit: don't keep data longer than needed.

Plus two procedural duties: information before collection, access on request. The rest are special cases (special categories like health, third-country transfer, etc.). A practical breakdown is in our article GDPR in recruiting - what you actually have to do.

In concrete articles: the lawful basis for the normal procedure is Art. 6(1)(b) GDPR (pre-contract), flanked by § 26(1) BDSG as the employee-data norm. Important in 2026: the ECJ (C-34/21) declared § 26 BDSG partly incompatible with EU law, so the safe footing is directly on Art. 6(1)(b) + Art. 88 GDPR. Special data (photo, health) falls under Art. 9, information under Art. 13/14, access under Art. 15 (deadline: 1 month), erasure under Art. 17, the auto-decision ban under Art. 22, the DPA under Art. 28, the record of processing under Art. 30, the technical/organisational measures under Art. 32.

The most-asked question has a clean answer. A rejected applicant can claim discrimination compensation under § 15(4) AGG within 2 months. If it goes to court you need the application file as evidence - the legitimate-interest basis to keep it beyond the 2 months. Add litigation and postal time and authorities land on 6 months from rejection as the safe default. In Austria it's closer to 7 months because of § 29 GlBG.

It also means: deleting earlier isn't extra safety, it's an evidence risk. And keeping it longer without grounds is the breach authorities cite most. The 6-month window with automatic anonymisation at the end is therefore the calmest path - exactly what KI BMS does per candidate automatically.

Myth 1 - 'We need a consent checkbox for every application.' Wrong. The normal hiring procedure runs on Art. 6(1)(b) GDPR; consent is superfluous and even problematic because it would be revocable at any time. You only need explicit consent for the talent pool (storage beyond the procedure) - and it must be voluntary, time-limited (authorities recommend 1-2 years), and revocable at any time.

Myth 2 - 'Photo and date of birth belong on the application form.' No. Data minimisation (Art. 5) means: ask only what's relevant to the role. A photo, birth date, marital status, religion almost never are - and a required photo is an AGG discrimination risk on top. If a photo arrives in the CV, use it only within the procedure and don't put it in presentations or databases.

Myth 3 - 'Third-country transfer doesn't affect us.' It does, the moment your ATS, sourcing tool, or mail provider mirrors data to the US. Then you need a transfer basis (the EU-US Data Privacy Framework adequacy decision or standard contractual clauses under Art. 44 ff.). The simplest way to avoid the topic entirely: an EU-hosted tool. KI BMS hosts in Germany and provides the Art. 28 DPA on request within one business day.

Six steps. Each takes <5 minutes in a modern ATS. In KI BMS most defaults are already right - you just have to look once.