GDPR in recruitment: “Your data is safe.” The tracker arrived first.

Blue slides. Limitless promises.

Some software presentations make you want to send every data protection officer on holiday immediately.

Everything is safe. Everything is thought through. Everything is, naturally, GDPR-compliant.

The slides are blue, the promises limitless, and somewhere there is a padlock next to a cloud. PowerPoint cannot accommodate any more trust.

Now imagine opening the app for the first time. Before we have even decided whether to work with this provider, its digital entourage welcomes us: analytics tools, embedded third-party services, perhaps a marketing pixel.

We wanted to explore recruitment software. Apparently, our browser needs to do some networking first.

This is a good moment to ask: how much privacy is actually behind that privacy promise?

Cookies do not have an American home address

First, a clarification, so that legitimate criticism does not turn into privacy folklore.

Cookies are stored on the user's device. The question is not whether someone “sets cookies in the USA”. What matters is which services store or read information, which personal data is then transferred where, and on what basis.

An American provider is not automatically unlawful. Equally, a German logo does not make an application compliant.

The EU-US Data Privacy Framework can provide a basis for transfers to appropriately certified US companies. The specific recipient and the scope of its certification must fit. The other data protection obligations do not disappear. [1] [2]

Unfortunately, privacy is slightly more complicated than “Frankfurt server, all good”.

“Technically necessary” does not mean “marketing would like it”

Under section 25 of Germany's TDDDG, storing information on a device or accessing information there generally requires consent. Exceptions exist, particularly for operations strictly necessary to provide a digital service explicitly requested by the user. [3]

That distinction has considerable practical consequences.

A function without which the requested service cannot operate serves a different purpose from finding out whether a prospect visited the pricing page three more times after a demo.

“We want to improve conversion” is an understandable business wish. Wishing very hard does not turn it into a technical necessity.

Nor is the label “essential” in a cookie banner a legal magic spell. The actual function matters. Data protection authorities interpret the strict-necessity exception narrowly. [4]

Candidate data is not an ordinary sales lead

Recruitment involves people looking to change their working lives. Sometimes discreetly. Sometimes from a difficult situation.

CVs, salary expectations, interview notes and video recordings create a detailed picture of a person. Employers should take their choice of recruitment providers seriously.

A pretty dashboard answers surprisingly few questions.

Who can access the data? Which subcontractors are involved? What are recordings used for? What happens when an application process ends? And does “delete” actually mean delete — or merely disappearing from the convenient view?

Anyone responding only with “We take privacy very seriously” has so far delivered, above all, a sentence.

Six questions that make any recruitment demo more interesting

Before uploading candidate data to a new system, employers should ask for specific answers:

• Which data is processed for which purpose? Application handling, product analytics, advertising and AI training are different purposes and need distinct explanations.
• Which services activate as soon as the application opens? Include analytics tools, external content and other third-party services.
• What happens after “Reject”? The technical behaviour should match the choice offered. An attractive button alone protects nobody.
• Who processes the data, and from where? Ask for specific companies, roles, access arrangements and, where applicable, the basis for international transfers.
• How do retention and deletion work? Ask for a clear process. “Our system handles that” opens a conversation; it is not documentation.
• What does the AI actually do? Transcribing, summarising, assessing and deciding are different tasks. “AI-powered” is a remarkably vague description.

Your favourite software must withstand scrutiny too

The most convenient form of privacy criticism is: everyone else is doing it wrong.

The more credible version is: we ask our own providers these questions too.

That applies equally to applicant tracking, video interviews and AI tools. Anyone promising modern recruitment should be able to explain the technology, its benefits and its limitations.

In recruitment, trust is not a decorative brand element. It is part of the service.

Our ambition at SEARCH4 is therefore to examine technical options critically, question unnecessary data collection and explain clearly what happens to people's information. A new feature is progress only when it can be used responsibly.

Trust begins where the slides end

A credible answer can be: “We need to check that technically.”

It can also be: “We do not offer this feature under those conditions.”

Things become more difficult when everything is supposedly perfectly safe, yet nobody can explain what happens on the first page load.

You cannot recognise GDPR-compliant recruitment by counting privacy badges. It has to show in the actual processes.

A reassuring promise is easy to make. The interesting part starts with the first network request.

Reviewing your recruitment processes? Let us discuss which data and tools you actually need to recruit well.