AI recruiting and GDPR: 5 questions to answer before your first test

Before you let AI into your hiring process, sort out these five things. Otherwise your works council will sort them out for you later.

Picture this. Your pilot is all planned. Lots of applications for customer service roles, and the AI is going to run the first-round interviews. You start on Monday.

On the Thursday before, your data protection officer asks: "So where are the recordings stored?"

And nobody in the room really knows.

One thing up front: we're not lawyers, and this isn't legal advice. These are the questions to answer before you start. Get the answers from your data protection team and, if needed, a lawyer.

Why everyone looks closer when AI is used in hiring

Application data is personal. A voice interview adds the candidate's voice and every answer they give.

And it's about something people care a lot about: a job.

That's why the GDPR and works councils pay close attention here. Soon the EU AI Act will too. It classes AI that helps select candidates as high-risk. As things stand, most of those obligations apply from December 2027, but the timeline has shifted before, so check the current status.

The GDPR applies today, though.

Question 1: Where is the data?

Ask the vendor straight out: where are recordings, transcripts and scores stored? And where are they processed?

"In the EU" is a good start. Still, ask about subprocessors. They're usually listed in an annex to the contract.

And ask when the data gets deleted. Nobody needs to keep recordings of people who were turned down months ago.

Question 2: Who makes the final call?

This is the big one.

Under the GDPR, people have the right not to be subject to a decision made only by a machine when it affects them significantly. That's Article 22. Rejecting a job application very likely counts.

In practice, the AI can run the conversation and summarise it. A person has to make the decision.

A real decision, that is. If someone just clicks "confirm" on whatever the AI suggests, that's hardly their own call.

So write it down beforehand: who reviews the results? What do they see? And are they allowed to decide differently from the recommendation?

Question 3: What do candidates know?

Candidates need to know they're talking to an AI, and what happens to their answers.

That goes in your privacy notice. Ideally it also goes in the invitation and at the start of the interview.

Also think about what happens if someone doesn't want to talk to an AI. Is there another route? You should be able to name it.

Question 4: What paperwork do you need?

This part is dry, but you can't skip it.

You'll almost always need these three:

• a data processing agreement (DPA) with the vendor
• an entry in your records of processing activities
• a data protection impact assessment (DPIA). For AI that scores candidates, it's very likely required.

Ask the vendor which documents they already have ready. Then you're not starting from scratch.

Question 5: When do you talk to the works council?

If you have one: early. Before the test.

In Germany, the works council has a say on technical systems that can monitor behaviour or performance (Section 87 of the Works Constitution Act). It also has a say on rules for selecting staff (Section 95).

If they only hear about it once the pilot is finished, the discussion starts from the beginning anyway. Just in a worse mood.

What helps: show them the interview before you start. Let one of them go through it themselves. And agree together on what gets evaluated and what doesn't.

What about fairness?

Worrying that AI might score people unfairly is reasonable. We'll write more about that soon.

One tip for now: ask to see the criteria the AI scores on. Then check that each one actually has something to do with the job.

The checklist

• Where are recordings, transcripts and scores stored, and when are they deleted?
• Who makes the final call, and can they disagree with the AI?
• Do candidates know beforehand that they're talking to an AI?
• Are the DPA, records of processing and DPIA done?
• Has the works council seen the interview?

If you can say yes to all five, you're ready to start your test.

And if you'd like to see how this works with langbox HIRE: we're happy to show you where the data lives and what your recruiters see at the end.