GDPR compliant candidate sourcing with the paperwork done per role
GDPR compliant candidate sourcing means you can show a lawful basis for every person you find, tell them within a month who you are and why, honor opt outs and delete data you no longer need. RecruitingBot builds each of those duties into the pipeline.
- GDPR built in
- Human approves every shortlist
- No hiring fees
- Lawful basis
- Legitimate interest, assessment v2 attached
- Source
- Public professional profile
- Article 14 notice
- Included in first message
- Opt out
- One click, suppression list
- Retention
- Deletes in 30 days without reply
Why sourcing is the hard part of recruiting under the GDPR
Inbound applicants hand you their data on purpose, so the legal picture is fairly simple. Sourcing is different. When you find someone through public professional profiles or open web sources, that person never asked to hear from you, and the GDPR treats this as indirect collection. You still need a lawful basis, you still owe them a notice, and you still have to respect storage limits, even though they have no idea you exist yet.
Most recruiting teams handle this with good intentions and a shared spreadsheet. That falls apart the first time a candidate writes in asking where you got their email address, or a regulator asks to see your legitimate interest assessment for a specific role. RecruitingBot was designed so that the answer to both questions is a click away rather than an afternoon of digging.
A short note before the detail: this page explains how the product supports your compliance work. It is not legal advice, and the right setup for your organization depends on your sector, countries and internal policies. Talk to your counsel or data protection officer when you set your retention windows and review the assessment template.
Lawful basis recorded for every candidate and source
For sourced candidates, the usual lawful basis is legitimate interest under Article 6(1)(f). Relying on it requires a balancing test: your interest in filling the role, whether contacting this person is necessary for it, and whether their reasonable expectations and rights outweigh that interest. RecruitingBot gives you a legitimate interest assessment template for each role, prefilled from the intake brief, so the reasoning is written down before the first profile is pulled.
Every candidate record then stores the source it came from and the lawful basis that applies to it. A person imported from your own talent database, an applicant who came through the hosted apply page and a profile found on the open web each carry a different basis and a different origin. When someone asks, you can show exactly where their data came from and on what grounds you hold it.
- Assessment per role. The template asks about purpose, necessity and balancing, and stays attached to the role for later review.
- Basis per candidate. Each record shows legitimate interest, consent from an application, or your existing relationship, along with the source.
- Source trail. The specific origin of each record is stored so you can answer a where did you get my data question accurately.
The Article 14 notice in the very first message
Article 14 says that when you collect personal data indirectly, you must inform the person within a reasonable period and no later than one month, and if you use the data to contact them, no later than that first contact. Since outreach is the first contact, RecruitingBot places the notice inside every initial email so the deadline is met by design rather than by memory.
The notice is short and plain, sitting below the personalized message instead of hiding behind a link. It states who is contacting them (your organization as the controller), why (a specific role), what source their details came from, how long the data will be kept if they do not respond, and what rights they have, including access, erasure and objection. You can adjust the wording to match your privacy policy, while the required elements stay in place.
-
Day 1
First messageSent
Personal note on their payments work, role facts, salary range, opt out link
-
Day 4
Follow upSent
Short nudge with one new detail about the team
-
Day 9
Last noteScheduled
Polite close, door left open
One click opt out and a suppression list that sticks
The right to object under Article 21 only means something if exercising it is easy. Every outreach email carries a one click opt out link. When a candidate uses it, the sequence stops immediately, their record is marked as opted out, and a hashed copy of their email address goes onto the global suppression list for your workspace.
That suppression list is checked before any future outreach from any role in the workspace, including roles opened months later by a different recruiter. This closes a common gap where a person opts out of one campaign and is contacted again by the next one. Storing only a hash means you can recognize the address without keeping a readable copy of data you were asked to stop using.
Data minimization and retention by default
Article 5 asks you to collect only what is relevant to the purpose and keep it no longer than necessary. RecruitingBot collects professional data tied to the role (name, headline, location, work history, skills and a contact address) and nothing about private life, family or protected characteristics. Scoring uses only the criteria in the rubric, which keeps the analysis focused on what the job requires.
Retention runs on a clock. Sourced people who never respond are deleted automatically after 30 days by default, and you can set the window anywhere from 30 to 180 days for each workspace. Applicants who came in through the apply page follow the retention policy you configure for them. Deletion is automatic, so data does not quietly pile up across dozens of old roles.
Access and erasure requests in one click
Candidates have the right to see the data you hold about them and to ask for it to be erased. In RecruitingBot, each candidate drawer has an export action that produces their full record, including source, lawful basis, scores, messages and test results, and a delete action that removes it. Each request is logged with the date it was completed, which helps you show you met the one month response window.
Deletion respects the suppression list. If someone asks to be erased and also does not want to be contacted again, their hashed address stays on the list so a future import or sourcing run cannot bring them back by accident. That is the difference between deleting a row and actually honoring what the person asked for.
Who is the controller and who is the processor
For candidate data, your organization is the controller. You decide which roles to fill, which sources to use, what the rubric measures and how long data is kept. RecruitingBot acts as your processor, handling that data on your instructions to run the pipeline. For an agency, the picture can include your clients too, which is one reason client workspaces keep each client's candidates separate.
On the Agency plan, the data processing agreement is available as a download inside the account. It sets out the subject matter and duration of processing, the categories of data and data subjects, our confidentiality and security obligations, assistance with data subject requests, deletion or return of data at the end of the service, and how sub-processors are engaged. Sub-processors are described by category (a hosting provider in the EU, an AI model provider, a mail delivery provider, a payment operator and a people data provider for contact reveals), and candidate data is hosted in the EU. Security measures are covered on our recruiting software security page.
No solely automated decisions about people
Article 22 gives people the right not to be subject to decisions based solely on automated processing that significantly affect them, and a hiring rejection can qualify. RecruitingBot scores and ranks, but a person approves or rejects every shortlisted candidate, and recruiters approve the rubric, screening questions and test. Scores come with written evidence per criterion, so the reviewer can see and challenge the reasoning instead of rubber stamping a number. The full sequence of steps is laid out in how AI recruiting works.
| GDPR article | What it asks | How RecruitingBot supports it |
|---|---|---|
| Article 5(1)(c) | Data minimization | Only professional data relevant to the role is collected and scored |
| Article 5(1)(e) | Storage limitation | Non responders deleted after 30 days by default, configurable 30 to 180 |
| Article 6(1)(f) | Legitimate interest as lawful basis | Assessment template per role and lawful basis logged per candidate |
| Article 14 | Notice when data is collected indirectly | Who, why, source, retention and rights in the first message |
| Article 15 | Right of access | One click export of the full candidate record |
| Article 17 | Right to erasure | One click delete with a logged completion date |
| Article 21 | Right to object | One click opt out and a workspace wide suppression list |
| Article 22 | No solely automated decisions | A human approves every shortlist and sees evidence per score |
| Article 28 | Processor terms | DPA download on the Agency plan, sub-processors listed by category |
Questions buyers ask
Anything else goes to [email protected] or the help panel inside your dashboard.
Is sourcing candidates from public profiles legal under the GDPR?
It can be, when you rely on a documented legitimate interest, limit the data to what the role needs, send an Article 14 notice at first contact, honor opt outs and delete data you no longer need. Being public does not remove those duties. RecruitingBot records each of them per candidate so you can show your work. Your counsel should confirm the setup for your context.
What exactly does the first email tell the candidate?
Below the personal message, a short notice states who is contacting them, the role it concerns, where their details came from, how long the data is kept if they do not reply, and their rights, including access, erasure and objection. A one click opt out link sits in the same block. You can adjust the wording but not drop the required elements.
Can I change the 30 day retention window?
Yes. The default deletes sourced non responders after 30 days, and you can set any window from 30 to 180 days per workspace. Shorter is easier to justify. Longer can make sense for hard to fill roles you reopen regularly, as long as your legitimate interest assessment supports it and the notice states the period.
Where is candidate data stored?
Candidate data is hosted in the EU by our hosting provider. Other sub-processors, such as the AI model provider and the mail delivery provider, are described by category in the DPA. Outreach itself is sent from your own connected mailbox, so replies land in your existing email account as they always have.
Which plan includes the DPA?
The DPA download is part of the Agency plan, together with single sign on, roles and an audit log. Every plan includes the compliance features in the pipeline itself: lawful basis logging, the Article 14 notice, one click opt out, the suppression list, automatic retention and one click export and delete. Plan details are on the AI recruiter pricing page.
Does this page replace advice from a lawyer?
No. It describes how the product helps you meet common GDPR duties when sourcing candidates. Your obligations depend on where you operate, who you hire and your own policies, so review the legitimate interest template, notice wording and retention settings with your counsel or data protection officer before your first campaign.
Keep reading
Give it a role and see the shortlist it builds
Type a job title on the homepage. The demo runs instantly without an account and shows an example pipeline, job post and shortlist for that role.