AI recruiting agents handle personal data at every step, from resumes and screening answers to messages and interview recordings, so privacy compliance depends on knowing exactly what data the agent touches, why, for how long, and who can see it. Rules to watch include the GDPR’s limits on solely automated decisions, the EU AI Act’s obligations for high-risk hiring systems, and California’s regulations on automated decision-making technology. This article maps data to risk and gives a checklist. It is general information, not legal advice.
What Candidate Data Do AI Recruiting Agents Touch?
| Stage | Data the agent may handle | Privacy consideration |
|---|---|---|
| Job advertising | Audience signals, click and apply events, device data | Cookies, tracking consent, targeting limits |
| Application | Resume, contact details, work history, screening answers | Purpose limitation, minimization |
| Screening | Scores, rankings, notes, knockout answers | Automated decision rules, fairness |
| Communication | Texts, emails, call recordings and transcripts | Consent for recording, retention |
| Scheduling | Calendar availability, location | Access scope on calendars |
| Memory and learning | Preferences, outcomes, candidate history | Retention and editability; see agent memory in recruiting |
| Reporting | Aggregated and individual funnel data | Access control, de-identification |
Which Rules Apply?
GDPR and automated decisions
Under GDPR Article 22, people generally have the right not to be subject to a decision based solely on automated processing, including profiling, that has legal or similarly significant effects, with limited exceptions and safeguards such as human intervention and the ability to contest. In SCHUFA Holding (Scoring), decided December 7, 2023, the Court of Justice of the EU held that an automated probability score can itself be an automated decision where a third party relies on it in a determining way. The practical lesson for recruiting: a ranking that recruiters follow almost automatically may be treated as a decision, so human review needs to be real. Also keep in mind the storage limitation principle: do not keep identifiable data longer than needed for its purpose.
EU AI Act
The EU AI Act lists AI systems used for recruitment or selection, including targeted job ads, filtering applications, and evaluating candidates, as high-risk. Deployers must assign competent human oversight, monitor operation, keep system logs for at least six months, inform workers’ representatives and affected workers before workplace use, and inform individuals subject to certain decisions that the system is being used. Under the Digital Omnibus amendments, the Annex III high-risk requirements apply from December 2, 2027.
California
California’s privacy regulator finalized regulations on automated decision-making technology (ADMT), risk assessments, and cybersecurity audits. They took effect January 1, 2026, with ADMT requirements for significant decisions applying from January 1, 2027. Separately, California Civil Rights Council regulations effective October 1, 2025 address automated-decision systems in employment and require employers to keep related records for at least four years.
New York City
Local Law 144 requires a bias audit within one year before using an automated employment decision tool, a public summary of results, and notice to candidates 10 business days before use. A December 2025 audit by the New York State Comptroller found weak enforcement, which does not change employers’ obligations.
Colorado
Colorado replaced its original AI Act with SB26-189, signed May 14, 2026, with a January 1, 2027 effective date listed by the Attorney General. Confirm how the final rules apply to employment decisions before relying on a summary.
What Should a Privacy Checklist Include?
- Data map. List every data source the agent reads and writes, and every system that receives data from it.
- Purpose and minimization. Collect only what the hiring purpose requires. Avoid inferring or storing sensitive characteristics.
- Retention. Set retention periods for applications, transcripts, recordings, and agent memory. Delete on schedule.
- Notice and consent. Tell candidates when AI is used and obtain consent where recording or other processing requires it.
- Human review. Make human oversight of consequential decisions real and documented. See human-in-the-loop recruiting.
- Access control. Give the agent the minimum permissions needed and review them regularly.
- Vendor diligence. Review data processing terms, sub-processors, model-provider data use (including whether your data trains models), and security certifications. See security and compliance at Joveo.
- Candidate rights. Be able to access, correct, and delete data on request, including data in agent memory and logs.
- Logging. Keep records that support audits and candidate inquiries.
- Bias testing. Monitor outcomes by stage. See adverse impact.
Frequently Asked Questions
Does GDPR apply to AI recruiting?
Yes, when you process personal data of people in the EU or when otherwise in scope. Automated decision rules and data protection principles apply to AI-assisted hiring.
Is it legal to use AI to screen candidates?
In many places yes, subject to requirements such as notice, human oversight, bias testing, and non-discrimination law. Rules vary by location, so confirm with counsel.
Do we have to tell candidates we use AI?
Often yes. The EU AI Act requires informing people subject to certain decisions, and New York City requires advance notice for automated employment decision tools.
How long can we keep candidate data?
Only as long as needed for the purpose and permitted by law and your retention schedule. Set and enforce periods, including for agent memory.
What should we ask an AI recruiting vendor about privacy?
Where data is stored, who can access it, whether it trains models, what sub-processors are used, how deletion requests work, and what logs and audit support exist.
