GDPR and AI Act compliant recruitment software does not make the agency compliant for it: it gives the agency the means to be. Before signing, check six points: hosting and sub-processors, retention periods, informing candidates and their rights, AI features, traceability, and reversibility.
This checklist lists the questions to ask the vendor and what a good answer contains. The rules behind each question are set out in our two articles: GDPR in recruitment and the AI Act and recruitment.
Article checked on 11 November 2026. It is not a substitute for advice from your DPO or legal adviser.
1. Hosting and sub-processors
The GDPR does not require data to be hosted in a particular country, but it regulates every transfer outside the European Economic Area and requires a contract between you and the vendor. The useful question is less about where the server sits than about the whole chain: the vendor, its sub-processors, and the countries where each processes your data.
| Question to ask | A good answer |
|---|---|
| Where is the data hosted, backups included? | A named country and host, with the same answer for backups. |
| Do you have a data processing agreement (DPA, Article 28)? | A signable document, provided before the contract is signed. |
| Who are your sub-processors, and where do they process data? | A named list, with the country and the safeguard for each transfer outside the European Economic Area. |
| Are your AI providers on that list? | Yes, named, with what is sent to them. |
2. Retention periods
Regulators expect a limited period for rejected candidates; in France, the CNIL recommends no more than 2 years after the last contact, with consent or after informing them. A rule the tool does not apply remains an intention. The vendor should show where the period is set and what happens to a profile when it ends.
| Question to ask | A good answer |
|---|---|
| Can you set a retention period for inactive candidates? | Yes, set by an administrator, with a preview of the affected profiles before switching it on. |
| What happens when the period ends? | The candidate is asked before removal, or the profile is removed, depending on your setting. |
| Are profiles linked to a live recruitment protected? | Yes, a profile linked to an active process or an assignment is not removed. |
3. Informing candidates and their rights
The GDPR requires you to inform every candidate, at collection (Article 13) or one month later at the latest if the profile came from elsewhere (Article 14), then to answer their requests within a month. A good tool carries part of the work: the form, the information email, finding all the data about one person.
| Question to ask | A good answer |
|---|---|
| Does the application form show your information and a consent checkbox? | Yes, written by you, with a link to your privacy policy. |
| How is a sourced profile informed? | An information email that lets them object, sent by the tool or prepared for you. |
| Does an erasure request cover notes, exchanges and documents? | Yes, the whole profile, and the person does not come back through a new application if they objected. |
| How do you find everything about one person for an access request? | A single profile that brings together the CV, notes, exchanges and documents. |
4. AI features and the AI Act
From 2 December 2027, an AI system used to analyse, filter or evaluate applications is high-risk under the AI Act. The vendor is its provider, you are its deployer. Ask the vendor for the list of its AI features and, for each one, what it does to a candidate.
| Question to ask | A good answer |
|---|---|
| Which AI features evaluate, rank or filter candidates? | A precise list, separate from the features that write or summarise. |
| How do you classify these features under the AI Act? | A written assessment per feature, and a timeline for the high-risk ones. |
| Can a feature reject a candidate without human involvement? | No, or only through an explicit setting that you switch on. |
| Do you provide instructions for use and logs? | Documentation of each feature and a record of what it did. |
| Does my data train your models or your providers’ models? | No, by contract, with each provider’s offer cited. |
| Does any tool analyse a candidate’s emotions in interviews? | No: that has been prohibited in recruitment since 2 February 2025. |
5. Access, traceability and reversibility
The GDPR requires security suited to the data, and the AI Act asks the deployer to monitor what the tool does. Both mean knowing who sees what and who did what. Reversibility, finally, decides whether you can change tools without losing data or keeping it too long.
| Question to ask | A good answer |
|---|---|
| Are access rights set by role? | Yes, down to limiting a user to their team’s profiles. |
| Is there a record of actions on a profile? | Yes, with the author and time of each action. |
| Can another of the vendor’s clients see our data? | No, isolation per client, described in the security measures. |
| Can we export all our data when we leave? | Yes, in a reusable format, with no hidden fees. |
In Marvin
Here are Marvin’s answers to this checklist, as they stand in the product and in the Trust Pack, the compliance file we give to our clients’ legal teams. Marvin helps you meet your obligations; it does not make you compliant on your behalf.
- Hosting and sub-processors. Data and daily backups hosted in France, with Scaleway in Paris. The DPA (Article 28) and the list of sub-processors, AI providers included, are part of the Trust Pack, with the security measures and the continuity plan.
- Retention periods. An administrator sets the period without activity (24 months by default, from 6 to 120 months) and sees the affected profiles before switching it on. When the period ends, the candidate receives an email asking whether they agree to you keeping their profile; a profile linked to an active process, an assignment or an invoice is never removed by this setting.
- Informing candidates. Once retention is switched on, sourced profiles saved afterwards receive an information email with a button to object. The careers site form accepts a consent checkbox that you write.
- Rejection and erasure. In the application settings, you choose what happens on rejection. After an erasure request, the block list (email address, domain or IP address) keeps out the person’s new applications.
- AI. Marvin does not use your data to train AI models. The AI providers and the AI system sheet are part of the Trust Pack, and are presented on the responsible AI page. An automation based on a score can move a candidate forward above a threshold you set, never reject them.
- Access and traceability. Permissions by role, strict isolation per agency, a history of actions on each profile with their author and time. You remain the owner of your data and can export it.
The Trust Pack can be requested on the security and Trust Pack page; a member of the team sends it to you.
FAQ
Can recruitment software be “GDPR compliant”?
Software does not make an agency compliant: the way it is used is compliant or not. The vendor, a processor under Article 28 of the GDPR, commits through a data processing agreement and provides the settings that let the agency meet its obligations: retention, information, rights, security.
Which documents should you ask a recruitment software vendor for?
The data processing agreement (DPA), the list of its sub-processors with their country, its security measures, its continuity plan and, if it offers AI, the list of its AI providers and a description of each feature that evaluates candidates, with its instructions for use.
Must candidate data be hosted in the EU?
No. The GDPR does not require data to be hosted in a given country. It regulates transfers outside the European Economic Area. Hosting in the EU simplifies the question, but the vendor’s sub-processors, AI providers included, may process data elsewhere: ask for the list.
What should you check about the AI features of recruitment software?
Which ones evaluate, rank or filter candidates, and so fall under the AI Act’s high-risk rules from 2 December 2027; what the vendor provides for human oversight and logs; whether a feature can reject a candidate without human involvement; and whether your data trains models.