Using AI in recruitment without losing control of candidate data: a practical privacy checklist

HR teams are adopting AI quickly: CV parsing, candidate matching, chat assistants, voice screening. The question I hear next is almost always the same: “Is this allowed under data protection law?”

The good news is that data protection laws don’t ban AI in recruitment. They ask the same things of an AI system that they ask of a recruiter with a filing cabinet. The details differ between jurisdictions, but the core principles are remarkably consistent. This checklist maps those principles to the questions you should ask about any AI tool. It reflects how we approach these issues at Talenda, and it is not legal advice; check the rules that apply to you with your adviser.

Six principles, applied to AI hiring

1. Purpose and manner of collection

• Do you collect only what you need to assess a candidate for the role?
• Do candidates know, at or before collection, what their data will be used for, including AI screening or AI interviews?
• If you want to keep a candidate for future roles, have you asked separately?

2. Accuracy and retention

• Can recruiters review and correct AI-extracted profiles and summaries?
• Do you have a retention period for unsuccessful candidates? Keep their data long enough to answer questions or complaints about the decision, and no longer than you need it.
• Are interview recordings deleted automatically when they are no longer needed?

3. Use of data

• Is candidate data used only for recruitment, or a directly related purpose?
• Does your vendor use your data to train its models, or share it with other customers? Get the answer in writing.

4. Security

• Is each organisation’s data isolated from every other customer’s?
• Do AI features run with the permissions of the user, or with broad system access?
• Are AI provider keys kept on servers, never in the browser?

5. Openness

• Does your privacy notice explain which AI features you use, what data they use and how people stay in control?

6. Access and correction

• Can you find and export everything held about a candidate, including AI-generated summaries, when they ask for it?

When AI starts taking actions

Regulators are paying growing attention to “agentic” AI: assistants that don’t just answer questions but create records, send messages and change data. For recruitment, the practical implications are clear:

• Keep people responsible for decisions that significantly affect a candidate.
• Require human confirmation for actions that are high-risk or hard to reverse, such as deleting records or sending data outside your workspace.
• Limit what AI can access to what the task needs.
• Keep records of what the AI did, so you can review it.

How Talenda handles these points

Our privacy policy sets out each of these safeguards, so you can check the points above against it. In summary:

• People make hiring, rejection, offer and HR decisions. High-risk or irreversible AI actions need an explicit human confirmation.
• AI runs with the signed-in user’s permissions, inside that organisation’s workspace only.
• Provider keys stay on our servers and are never sent to the browser.
• We do not use organisations’ data to train AI models, and one organisation’s data is never used for another.
• Each AI call is logged with the feature, model, time, organisation and user.
• Matches show their reasons, and staff can review and correct AI output.
• Voice recordings expire automatically under the configured retention policy, and pre-employment documents can be deleted automatically on a schedule HR controls.

The rest of the safeguards, and why we chose them, are in “Human in the loop” is not a slogan.

Before you sign with any AI recruitment vendor

1. Map each AI feature to the personal data it uses.
2. Confirm which actions need human confirmation.
3. Agree retention periods for CVs, transcripts and recordings.
4. Get written confirmation on model training and data sharing.
5. Update your candidate privacy notice to describe the AI you use.

Done well, privacy and AI are not in tension. The same discipline that keeps you compliant (clear purpose, human decisions, good records) also makes AI-assisted hiring fairer and easier to explain.