Last updated:

Friday, 23 October 2026

GDPR-Compliant Analytics for Recruitment Teams

Recruitment Process

The Recruitify Team

Analytics is GDPR compliant when three things are true at once: you have a lawful basis for each type of processing, you collect only what you need for a stated purpose, and you can prove both. No tool earns that status by itself. Compliance is a state your configuration, contracts and documentation create, whether you are measuring website visits or tracking time-to-hire across a candidate pipeline.

This guide covers both sides of the question that recruiters face: the web analytics on your careers site, and the recruitment analytics (funnel metrics, scoring, sourcing reports) built on candidate data. It is written for agency owners, in-house HR teams and talent acquisition managers, including US-based teams that hire or advertise in the EU.

Key takeaways

GDPR compliance is a setup-dependent state, not a vendor badge. Even a privacy-focused tool can be misconfigured, so the controller (you) carries the responsibility.
Two laws apply to web analytics: the ePrivacy rules govern the cookie or device access, and the GDPR governs what happens to the data afterwards. Both must be satisfied.
Recruitment analytics on candidate data needs a documented lawful basis, data minimization, retention limits and human oversight of any automated scoring.
Run a Data Protection Impact Assessment before you sign a contract for an AI recruitment tool, and keep an audit trail of consent and decisions.
A US company is not automatically exempt: the GDPR can apply when you offer jobs to, or monitor, people in the EU.

What “GDPR-compliant analytics” actually means

The phrase covers two different activities, and mixing them up is the most common source of confusion.

Web and product analytics measure behavior on your website, career page or application form: page views, sources, drop-off on the application form. The main legal question is whether you place cookies or similar identifiers on the visitor’s device.

Recruitment analytics measure the hiring process itself: sourcing channels, conversion between pipeline stages, recruiter productivity, shortlist quality, diversity outcomes. This is almost always personal data about identifiable candidates, so the full GDPR toolkit applies: lawful basis, fairness, minimization, retention, rights requests.

Deloitte describes talent acquisition analytics as the systematic discovery of meaningful patterns in data to support decisions on recruitment and onboarding, measured across efficiency, effectiveness and experience. The GDPR does not prohibit that discovery. It requires that the patterns be found lawfully, fairly and transparently.

Does the GDPR apply if you are a US company?

It can. The GDPR is not limited to organizations established in the EU. The regulation’s text on EUR-Lex sets out its territorial scope, which reaches organizations outside the EU that offer goods or services to people in the EU or monitor their behavior there. A US staffing agency that advertises roles to candidates in Germany, or a software house that tracks applicants from Poland through its careers site, should assume it is in scope and confirm with counsel.

There is no US equivalent of a single federal GDPR. US privacy obligations come from a patchwork of state laws, and hiring has its own rules, such as the EEOC’s adverse impact testing. If you are building one analytics setup for a multinational candidate pool, designing to the GDPR standard is usually the most practical baseline.

Web analytics: cookies, consent and the two-layer test

The EDPB Cookie Banner Taskforce report is the clearest statement of how the two laws interact. Placing cookies, or accessing information on a user’s device, falls under Article 5(3) of the ePrivacy Directive and national implementing laws. Any subsequent processing of the resulting data then has to comply with the GDPR on its own terms.

That gives you a two-layer test for every analytics setup:

Device layer: Does the tool store or read anything on the visitor’s device? If yes, and it is not strictly necessary, you need prior, unambiguous consent.
Processing layer: Once you hold the data, do you have a lawful basis, a defined purpose, a retention limit and a processor agreement with the vendor?

A frequent pitfall is leaning on legitimate interest to justify non-essential cookies. The same EDPB report makes clear that this basis cannot justify placing them: consent is required. Legitimate interest can still be relevant at the second layer, but only with a documented balancing test.

Why “privacy-friendly” is not the same as “compliant”

Many lightweight analytics products avoid cookies, truncate IP addresses or host data in the EU. Those are useful design choices, and they can reduce or remove the consent requirement. But the EDPB’s reasoning points to a harder truth: a tool that is misconfigured, or that is combined with other scripts, can still fall short. Check these points whatever product you use:

Is any identifier stored on the device, and if so, is it strictly necessary?
Where is the data processed, and under which transfer mechanism if it leaves the EU?
Does the vendor use your data for its own purposes? If so, it may be a controller rather than your processor.
Is IP address handling, session recording or cross-site linking switched on by default?
Is there a signed data processing agreement?

Transfers to the United States

For US-hosted analytics, the transfer mechanism matters. In September 2025 the European General Court dismissed a challenge to the EU-US Data Privacy Framework, confirming the framework’s validity on the facts and law at the time of the Commission’s decision. That gives certified US providers a recognized route for transfers, but the ruling can still be appealed and the framework has been challenged before, so keep a fallback such as standard contractual clauses in your records.

What the UK’s 2025 law changes

If you recruit in the UK, note that the Data (Use and Access) Act 2025 brings some nuance. The ICO explains that certain low-intrusion cookies may no longer need explicit consent, such as some that improve website functionality. That is a UK change, not an EU one, and an EU-facing site should still follow the stricter ePrivacy position.

Recruitment analytics: where candidate data is the product

Web analytics is the visible part. The larger exposure for agencies sits in the applicant tracking and CRM data that feeds your reports.

Pick and document a lawful basis

The ICO’s guidance on using AI to assist recruitment is the most practical reference available. Its logic, in summary: behavioral tracking and profiling cannot be justified as necessary for a contract, so you must identify another basis. The realistic options are consent (Article 6(1)(a)) or legitimate interests (Article 6(1)(f)). Legitimate interests requires a documented balancing test showing that your interest does not override the candidate’s rights and freedoms.

The EDPB’s guidelines on Article 6(1)(b) explain why the contract basis is narrower than most teams assume. Special category data, such as health or racial and ethnic origin, needs an additional condition on top of the lawful basis. Diversity monitoring is where recruiters meet this most often, so decide the condition before you start collecting it.

Minimize, then retain only for a reason

The ICO’s audit of AI recruitment providers found considerable room for improvement in keeping information to a minimum and processing it fairly. It also noted a specific concern: building large databases of candidates without their knowledge. For analytics, that means:

Report on aggregated or pseudonymized data wherever the question allows it.
Set a retention period for unsuccessful candidates and enforce it, rather than keeping everything indefinitely.
Ask candidates for fresh consent if you want to keep them in a talent pool beyond the period you originally told them.
Tell candidates what you analyze and why, in plain language, at the point of application.

This matters for agencies that treat a database as an asset. Re-engaging past candidates is a legitimate and valuable practice, but only when the basis, the notice and the retention period support it.

Automated scoring needs human oversight

Scoring and ranking candidates are forms of profiling. The ICO’s explanation of the 2025 Act states that organizations can make significant automated decisions if they can show a valid reason, but that does not extend to automated processing of special category data. In the EU, Article 22 remains stricter, so the safe operating model is the same everywhere: a recruiter reviews every consequential decision, and the score is an input to that review, not a verdict.

Candidate score routed through human review

The ICO also warns that tools trained on historical hiring data can absorb past bias, such as excluding women from senior roles, and replicate it. Monitoring outputs for fairness is a continuing duty, not a one-time check. If you want a worked method, our own articles on auditing AI recruiting bias and diversity recruiting analytics and the EEOC 80% check show how adverse impact testing fits into a regular reporting cycle.

You are the controller, even when the vendor processes

Agencies often assume that buying compliant software transfers the responsibility. The ICO’s position is that the recruiter, as data controller, stays accountable for the fairness, accuracy and bias of the output even when a vendor processes the data. It recommends completing a Data Protection Impact Assessment before finalizing the contract for an AI recruitment tool, so that risks are identified while you can still change the terms.

A framework for GDPR-compliant recruitment analytics

Process mining research gives a useful structure. The PM 2HR methodology turns event logs from HR systems into performance scorecards, and by analyzing the control flow of recruitment activities, it exposes bottlenecks such as slow stages in time-to-hire. Layer the legal controls onto that approach and you get a six-step framework:

Define the question. Write down what decision each metric supports, for example “which sourcing channel produces placements within 60 days.” A metric with no decision behind it is a candidate for deletion.
Map the data. List every field the metric uses, where it comes from and whether it is personal or special category data.
Assign the lawful basis. Record consent or the legitimate interests balancing test per purpose, and the extra condition for any special category data.
Minimize and aggregate. Report at stage, channel or team level. Drill into named individuals only when a recruiter has a concrete operational need.
Set retention and deletion rules. Match them to what candidates were told, and make the system enforce them.
Keep evidence. Store consent records, DPIA outcomes, bias test results and an audit trail of who accessed or changed what.

Metric	Typical data	Compliance angle
Time-to-hire by stage	Timestamps per candidate	Aggregate by stage and team; pseudonymize where possible
Source-to-placement conversion	Source tag, outcome	Disclose source tracking in the privacy notice
Shortlist match score	Parsed CV data, job requirements	Human review; test for bias; explain logic
Diversity outcomes	Special category data	Extra condition required; keep separate from selection decisions
Talent pool reactivation	Historical candidate records	Check basis and retention before re-contact

The developer-oriented GDPR Developer Guide from France’s CNIL is a good companion at the implementation stage. It runs to 16 thematic sheets and covers everything from project preparation to the use of analytics.

Our perspective: compliance is what makes analytics usable

We build recruitment software for IT agencies and in-house teams, and we see the same pattern: analytics projects stall not because the data is missing, but because nobody can say with confidence that using it is allowed. Scattered spreadsheets are the worst case. Candidate data sits in personal files, consent is unrecorded, and no report can be defended if a candidate asks what you hold.

Our view is that regulation and performance point the same way. When the ATS, the sales CRM and the contracting module share one record, you can attach consent, retention and access history to the candidate once, rather than reconstructing them for every report. That is why our platform includes a GDPR consent management module with a full audit trail, and why we treat CV anonymization and GDPR controls as part of the core workflow rather than an add-on.

We also hold that the customer stays the controller. Software can make the compliant path the easy one: recorded consent, deletion rules, anonymized profiles for client presentation, duplicate detection so one person does not become three records. It cannot replace your DPIA, your balancing test or your judgment on a shortlist. We would rather say that plainly than sell a badge.

- Recruitify Team

What to look for in a platform before you sign

Whatever vendor you evaluate, ask for evidence on these points, and record the answers in your DPIA:

Consent management: can you capture, timestamp and withdraw consent per candidate and per purpose?
Audit trail: can you show who viewed, exported or changed a record, and when?
Retention controls: can deletion or anonymization run on a schedule?
Explainable scoring: can you see why a candidate received a given match percentage, and can a recruiter override it?
Bias evidence: does the vendor document mitigation strategies and accuracy targets, as the ICO recommends asking?
Data location and transfers: where is data hosted, and what mechanism covers any transfer outside the EU?
Processor terms: is there a data processing agreement that limits the vendor’s use of your data?

How Recruitify supports a compliant analytics workflow

Recruitify brings an ATS, a sales CRM and an IT contracting module into one system, so pipeline reporting draws on a single consent-aware candidate record. The platform includes an AI CV parser with duplicate detection, contextual matching with percentage scores, Blind CV AI for anonymized client-ready profiles, and a GDPR consent module with an audit trail. Plans are published on the pricing page: HR Team at 61 EUR per month per user, Agency at 67 EUR per month per user, and Enterprise on request. Agencies can see how the pieces fit in our software for recruitment agencies, and in-house teams in our ATS for HR departments.

FAQ

Is Google Analytics GDPR compliant?

There is no blanket yes or no. Compliance depends on your configuration: consent for the cookies it sets, a valid transfer mechanism for data sent to the US, and a documented lawful basis for the processing. The EDPB’s taskforce makes clear that consent is required for non-essential cookies, so check your banner and your data processing terms before relying on any default setup.

Is GDPR compliance mandatory in the USA?

The GDPR is an EU regulation, not a US law, but it can apply to US organizations that offer goods or services to people in the EU or monitor their behavior there. US-only operations are governed by state privacy laws and sector rules instead. If your candidate pool crosses borders, treat the GDPR as the safer baseline and take legal advice on your exposure.

Can we run analytics without a cookie banner?

Sometimes. If a tool stores nothing on the visitor’s device, the ePrivacy consent requirement for the device layer may not be triggered, but the GDPR still applies to the data you process. You need a lawful basis, a purpose, retention limits and transparency. A privacy lawyer in your jurisdiction should confirm the setup before you remove the banner.

Do we need consent to analyze candidate data in our ATS?

Not always. The ICO says the basis can be consent or legitimate interests, provided you document a balancing test for the latter. Special category data, such as health or ethnic origin, needs an additional condition. Decide the basis per purpose before you start, and record it.

Who is responsible if our AI recruiting tool is not compliant?

You are, as the data controller, even when the vendor processes the data. The ICO expects you to remain accountable for the fairness, accuracy and bias of the tool’s output. Run a DPIA before signing and monitor results after launch.

Sources

By providing your email address within the newsletter sign-up form, you confirm its processing to send marketing information regarding the Administrator’s products and services. The Administrator of your personal data processed for the abovementioned purposes is Recruitify Spółka z o.o., based in Warsaw, Poland (KRS 0000709889). For more information on the principles of personal data processing and the rights of data subjects, please check the Privacy Policy.

Share

Published

23 Oct 2026