GDPR-compliant ATS:
what the software must allow, and what remains your responsibility

A GDPR-compliant ATS is recruitment software that lets the recruiter meet their obligations: informing candidates, limiting retention, answering access and erasure requests, securing data and overseeing processors. The software does not make you compliant on your behalf: you remain the data controller.

This article lists what an ATS must allow, what remains the recruiter's job, and the questions to ask a vendor before signing. It draws on the recruitment guide published by the CNIL, the French data protection authority, on 30 January 2023.

Article checked on 11 November 2026. It does not replace the advice of your data protection officer.

Controller and processor: who does what

In recruitment, the hiring company, the agency or the staffing firm is the data controller: it decides why and how candidates' data is processed. The vendor of an online ATS, which hosts that data on its behalf, is generally its processor. The GDPR splits the obligations between the two.

What stays with the recruiter: choosing the legal basis for each processing activity, informing candidates, setting retention periods, answering requests, keeping a record of processing and, for an employer in France, informing the works council (CSE) of recruitment methods before using them (article L2312-38 of the French Labour Code).

What falls to the vendor: processing data only on instructions, ensuring its security and confidentiality, declaring its own sub-processors, helping the recruiter answer requests, and deleting or returning the data when the contract ends. These commitments are set out in the data processing agreement required by article 28 of the GDPR.

The CNIL notes that an off-the-shelf software publisher with no access to the data is not a processor; an online ATS that hosts it almost always is.

What an ATS must allow under the GDPR

An ATS fit for the GDPR makes possible the steps the law requires of the recruiter: setting a retention period and applying it, finding all of a candidate's data to send it to them or erase it, informing candidates at collection, limiting access to records by role, and keeping a trace of what is done.

1. An adjustable retention period, applied across the whole database, with a list of the records concerned before deletion.
2. Complete deletion of a candidate, CV, notes and exchanges included, and export of their data on request.
3. Candidate information: a notice and a link to your privacy policy on the application form, and an information message for sourced profiles.
4. Role-based permissions: a consultant, a manager or a subsidiary only sees what concerns them.
5. Traceability: who viewed, changed or sent what, and when.
6. Full export of the database at the end of the contract, in a reusable format, then deletion of the data at the vendor's end.

Retention of applications in an ATS

The CNIL recommends not keeping an unsuccessful candidate's file for more than two years after the last contact, unless they have agreed to a longer period. The recruiter sets the period upfront, justifies it, and deletes or anonymises the data when it ends.

The CNIL guide distinguishes the active database, used during recruitment, from intermediate archiving, kept for a specific need such as evidence in a discrimination claim and accessed by authorised people. What to expect from the ATS: that the rule applies by itself across the whole database, and that records linked to an ongoing recruitment stay protected.

For CV databases and talent pools, see also our guide to free CV databases, which covers the information and retention rules.

Informing candidates, including those found on LinkedIn

Every candidate whose data enters the ATS is informed: at collection if they apply, within one month at the latest if they were found elsewhere, or at first contact if that comes sooner. The information says who processes their data, for what purpose, for how long, and how to exercise their rights.

In France, the Labour Code adds that candidates are told in advance about the recruitment methods and techniques used on them, and that no information about them may be collected by a device they do not know about (articles L1221-8 and L1221-9). A recorded interview or a test must therefore be disclosed before it is used.

Candidate rights: access, erasure, objection

A candidate can ask to access their data, have it corrected or erased, and object to certain processing. The recruiter replies without undue delay, within one month at the latest, a period that can be extended in some cases. The ATS must let you find all their data with one search and delete all of it.

The right of access also covers what the recruiter produced about the candidate, such as an interview report or a note. Keeping a trace so as not to contact again someone who asked for erasure amounts to an exclusion list: the CNIL regulates these in sheet 15 of its guide (legal basis, objective criteria, informing the person, data limited to what is strictly necessary and a short retention period).

AI and automatic sorting of applications

An AI feature in an ATS can summarise a CV, search for profiles or draft an interview report. It must not reject a candidate on its own: the GDPR in principle prohibits a decision based solely on automated processing that has significant effects, such as a rejection, except in regulated cases with safeguards.

The CNIL devotes a sheet of its guide to sorting, ranking and assessment software. What to check with the vendor: which data goes to an AI provider, which one and where; whether that data is used to train a model; and whether every suggestion from the tool is still approved by a recruiter, who can explain the decision to the candidate.

Hosting and transfers outside the European Union

The GDPR does not require data to be hosted in any particular EU country, but it regulates transfers outside the European Union. An ATS hosted outside the Union, or that passes data to a processor established outside it, must rely on a recognised mechanism, such as an adequacy decision or standard contractual clauses.

In practice, ask for the vendor's list of sub-processors, with the country where each processes data, AI providers included. That list, more than the address of the vendor's head office, tells you where your candidates' data goes.

Ten questions to ask an ATS vendor

Ask these questions in writing, before signing. The answers should be found in the data processing agreement and its annexes: a verbal commitment protects neither the recruiter nor its candidates. A serious vendor answers them easily, with documents to back them up.

1. Do you have a data processing agreement that complies with article 28 of the GDPR, and can I read it before signing?
2. Where is the data hosted, backups included?
3. Who are your sub-processors, and in which countries, AI providers included?
4. Can we set a retention period and apply it automatically to the whole database?
5. How do we delete all the data of a candidate who asks?
6. How do we export a candidate's data to answer an access request?
7. Are permissions set by role, by team, by subsidiary?
8. Are actions on records traced?
9. Which data goes to AI, and is it used to train a model?
10. At the end of the contract, how do we get the database back, and when is it deleted on your side?

In Marvin

Marvin hosts your data in France, with Scaleway in Paris, with daily backups also in France. Each customer is isolated, permissions are set by role, and secrets and tokens are encrypted with AES-256-GCM. The data processing agreement and the list of sub-processors, AI providers included, are published at a permanent address.

For retention and candidate rights:

• A retention period set by your administrators: they choose a period of inactivity (24 months by default), see the list of records concerned, then confirm. Administrators are notified 30 days in advance and can extend a profile; a record linked to an ongoing application, an active process, an assignment or an invoice is never deleted.
• Rejected applications: you choose whether to keep the application or delete it along with the record it created, and you can block the candidate's email address. After an erasure request, the block list keeps out their new applications.
• Consent at application: the form on your careers site accepts a checkbox you write yourself, which you can make mandatory, and shows the link to your privacy policy.

Details are on the security and GDPR page, and what Marvin brings to an HR team is on the Marvin for in-house recruitment page.

FAQ

Sources

• CNIL, Guide Recrutement : les fondamentaux en matière de protection des données personnelles, published on 30 January 2023 (sheets 3, 8, 9, 13 and 15).
• CNIL, Recrutement : un employeur peut-il conserver mon dossier ?, consulted on 11 November 2026.
• GDPR: articles 12 to 14, 15 to 22 and 28 of Regulation (EU) 2016/679.
• French Labour Code: articles L1221-8, L1221-9 and L2312-38.