What GDPR covers in hiring
The General Data Protection Regulation applies to processing personal data of people in the EU, and the UK GDPR applies the same principles in the United Kingdom. Resumes, screen transcripts, code written in a round, recordings and assessments are all personal data.
In hiring, the employer is usually the controller, deciding why and how candidate data is processed. A hiring platform that processes that data on the employer's behalf is a processor. SynergicHire acts as a processor for candidate data and as a controller for its own customers' and visitors' data, as its privacy policy explains.
Rules that matter most for AI in hiring
| Rule | What it means for AI screening |
|---|---|
| Article 22: automated decisions | Candidates have the right not to be subject to a decision based solely on automated processing that significantly affects them, except in limited cases and with safeguards such as human intervention. |
| Articles 13 and 14: transparency | Candidates must be told what data is processed and why, and given meaningful information about the logic involved in automated decision-making. |
| Article 5: principles | Data must be limited to what is necessary, accurate, and kept no longer than needed. |
| Article 28: processors | Processing on the employer's behalf needs a contract with the terms Article 28 sets out. |
| Article 35: impact assessments | AI that evaluates people systematically is likely to need a data protection impact assessment. |
| Data subject rights | Candidates can request access to their data and its erasure, among other rights. |
How SynergicHire supports GDPR compliance
- No solely automated decisions: a named person signs off every round and records every outcome, and nothing is rejected automatically.
- Transparency: candidates are told what an AI reads, what is recorded and who decides, before they apply and before a screen or round starts.
- Explainable assessment: every score cites the answer or edit it rests on.
- Minimisation: no camera, no facial or emotion analysis, and voice audio kept only if you turn it on.
- Storage limitation: recordings are erased on a schedule you set.
- Erasure: candidates can ask to be deleted, and the audit log records who acted and when.
- Processor terms: a Data Processing Agreement at /dpa and a published list of subprocessors at /subprocessors.
This is general information, not legal advice
This page summarises the law at a high level as we understand it on the date below. Laws, regulations and official guidance change, and how they apply depends on your circumstances. Speak to your own counsel before relying on it.
Using SynergicHire does not make an employer compliant on its own. As controller, the employer chooses the lawful basis, writes its candidate privacy notice, carries out any data protection impact assessment, and answers data subject requests. SynergicHire provides the tools and processor commitments that support those duties.
Questions
Is AI candidate screening allowed under GDPR?
Yes, with a lawful basis, transparency and safeguards. A decision with significant effects should not rest solely on automated processing; meaningful human involvement is the usual safeguard.
Is SynergicHire a controller or a processor?
For candidate data, SynergicHire is the employer's processor. For data about its own customers' staff and website visitors, it is the controller.
Does SynergicHire offer a DPA?
Yes. The Data Processing Agreement is published at /dpa, and the subprocessors that handle data are listed at /subprocessors.
How long does SynergicHire keep candidate recordings?
As long as the retention schedule your workspace sets. Recordings are erased on that schedule, and candidates can request deletion sooner.