Choosing a GDPR-compliant ATS: a checklist for EU and UK teams

When you're choosing an applicant tracking system, it's easy to spend the whole demo looking at job listings, interview scheduling, and the candidate pipeline. Data protection often gets a quick question at the end: “You're GDPR compliant, right?”

It's worth giving that conversation a little more time. Your ATS will hold CVs, contact details, interview notes, and sometimes sensitive information. You need to understand how the vendor handles that data and what your team will need to manage.

A useful way to assess a GDPR-compliant ATS is to work through a few everyday situations. A candidate asks for a copy of their information. An old application reaches its retention deadline. A hiring manager leaves the company. Can the software help you deal with each one properly?

This guide covers the questions to ask before you commit, with a few distinctions for teams hiring in the EU and the UK.

Who is responsible for candidate data?

For the applications you manage in an ATS, your company will usually be the data controller. You decide what information to collect, why you need it, and how it will be used. The ATS vendor generally acts as your data processor, handling that information on your behalf. The European Data Protection Board explains the distinction.

Both have responsibilities. Choosing a vendor doesn't remove yours, and the vendor has its own obligations too.

Start by asking for its data processing agreement, or DPA. Article 28 requires binding terms covering the processing. These must be in writing and can be agreed electronically; a separately signed PDF isn't the only way to do it.

Look for clear terms on security, subprocessors, help with candidate requests, and what happens to your data when you leave. The ICO's contract guidance is a useful reference for UK teams.

Your own hiring process matters just as much. You need an appropriate lawful basis for using candidate information, a clear privacy notice, and application forms that collect only what you need. These are part of the basic GDPR principles, whatever software you choose.

Where is the data stored, and who can access it?

Ask where the vendor stores applications, attachments, and backups. Then ask which other companies help process them, including providers used for email, support, and AI features.

EU hosting can simplify some of these questions, but the server location doesn't tell you everything. You also want to know which legal entities handle the data and where their teams can access it from.

GDPR doesn't require all personal data to stay in the EU. Transfers outside the European Economic Area need a valid route under the transfer rules. That may be an adequacy decision or appropriate safeguards, such as standard contractual clauses, with any necessary assessments and additional protections. The EDPB's international transfer guide explains the options.

UK teams need to check the UK rules separately. For example, EU standard contractual clauses alone aren't sufficient for a restricted transfer under UK GDPR. Where contractual safeguards are needed, the UK IDTA or UK Addendum may be relevant.

Ask the vendor for its subprocessor list and an explanation of any international transfers. You should be able to follow the answer without having to piece it together from several sales emails.

What happens when a candidate asks for their data to be deleted?

Suppose someone applied for a role six months ago and now asks you to remove their information. During a demo, ask the vendor to walk through that request using a test candidate.

Find out what gets deleted: the CV, attachments, interview notes, messages, and any AI-generated assessments. Ask what happens to copies in connected tools and backups, too.

The right to erasure isn't an unconditional right to immediate deletion. Some information may need to be retained for a legal obligation or the defence of legal claims. Requests generally require a response without undue delay and within one month, with limited grounds for an extension. The EDPB explains the EU position, and the ICO covers erasure under UK GDPR.

Backups may follow a separate deletion cycle. The vendor should explain how deleted information is kept out of use until those copies expire.

Also test an access request. Can you gather the relevant personal information held about a candidate, including notes, for review and disclosure? Downloading their original CV may cover only a small part of it.

How long will you keep unsuccessful applications?

It's easy to leave old applications in an ATS because someone might be suitable for a future role. Over time, that can turn into years of records nobody has reviewed.

GDPR doesn't set a universal six-month or twelve-month retention period. You need to choose and document periods that fit your purposes, applicable local requirements, and any relevant legal claims. The ICO's retention guidance explains why one period won't necessarily suit every type of record.

Keeping someone in a talent pool also needs a clear purpose, an appropriate lawful basis, and an explanation to the candidate. Consent may be suitable in some circumstances; it isn't a blanket requirement for every longer retention period.

Look for settings that support your policy: automatic deletion, review reminders, and a way to record justified exceptions. Ask when the retention clock starts and what happens if the person applies again.

Can you control who sees candidate information?

A hiring manager may need access to applications for their own team. An interviewer may only need information about the people they're meeting. Check whether the ATS lets you make those distinctions.

Ask about account security, encryption, access logs, and how quickly you can remove someone's access. Have the vendor explain how it detects and handles a data breach, including how it would notify and support your team.

Certifications can be useful evidence. If a vendor mentions one, check what it covers and whether it applies to the ATS provider itself or only to its hosting supplier.

What changes if the ATS uses AI?

AI features deserve a few extra questions. Which candidate information do they use? Where is it processed? Is it used to train models? Can your team inspect and challenge the results?

For screening and ranking tools, ask for help assessing the privacy risks before you enable them. A data protection impact assessment, or DPIA, is required where processing is likely to create a high risk to people's rights and freedoms. The ICO's AI recruitment guidance recommends addressing this during procurement.

The EU AI Act is a separate consideration. AI used to analyse applications or evaluate candidates can fall within its high-risk category. The classification depends on the feature and its intended use; having a person make the final decision doesn't, by itself, settle the question.

As of November 2026, the European Commission lists 2 December 2027 as the application date for the high-risk rules covering areas such as employment. Some AI Act obligations already apply, and existing data protection duties continue in the meantime. UK teams should assess whether their activities fall within the EU Act's scope rather than assuming the same rules automatically apply to all UK hiring.

In a demo, ask the vendor to show you how a reviewer checks a recommendation, disagrees with it, and records their decision. Ask what documentation it provides about the feature's limitations and the responsibilities your team takes on by using it.

A checklist for your next ATS demo

Use these questions to compare vendors and keep their answers alongside the documents they provide.

How to assess PontaHR

You can use the same checklist when talking to us.

Our security page covers EU hosting, encryption, candidate rights, and our subprocessors. A DPA is available on request. Our privacy policy provides more detail about the services and optional integrations involved in processing data.

If you're considering candidate summaries and AI shortlisting, ask us to walk you through those features as part of the demo. Bring your retention policy and any questions from the person responsible for data protection at your company. We can work through what PontaHR supports and what your team will need to manage.

That gives you a much better basis for choosing an ATS than a yes-or-no answer to “Are you GDPR compliant?”