GDPR has been in force since 2018. That does not mean everyone has it under control.
In most companies I work with, there are gaps. Simply because other things took priority — and nobody quite knew whose responsibility it was.
The problem is that it is often the HR function that is responsible. And the HR function does not always know it.
Three common GDPR mistakes in the recruitment process
- Candidate data is stored longer than permitted
You are entitled to process a candidate's details during the recruitment process — typically on the basis of legitimate interest. What most people miss is that storing data beyond that, for example in a candidate database, requires a new and documented legal basis. And consent is rarely a valid option here. Because of the power imbalance between employer and candidate, consent in a recruitment context can seldom be considered genuinely voluntary.
Do you have a data retention policy for candidate information? If the answer is no — that is a problem. - No clear purpose for data collection
GDPR requires a specific and documented purpose for every piece of data you collect. 'Recruitment purposes' is not specific enough.
Why are you collecting this particular information? What is it used for? How long do you need it? You should be able to answer all of these. - Candidates are not properly informed of their rights
Kandidater har rätt att veta hur deras uppgifter behandlas. Det innebär en integritetspolicy anpassad för recruitment, information om hur länge data lagras och vart kandidaten kan vända sig med frågor.
Finns det på er karriärsida eller i er rekryteringsprocess? Det borde det göra.
What you should do now
• Review your data retention policy for candidate information
• Check that your privacy policy covers the recruitment process
• Audit what personal data you actually collect and why
• Make sure everyone who handles candidate data knows the rules
It does not have to be complicated. But it does have to be done.
One final thought
GDPR i HR handlar i grunden om respekt. Respekt för kandidaternas integritet. Respekt för deras uppgifter. Respekt för att de delar med sig av personlig information i en situation där de är sårbara.
Compliance is a minimum. The right attitude is the goal.
If you have thoughts, questions, or simply want to talk something through — feel free to get in touch. I am happy to have an initial conversation with no agenda.
Magdalena Hagström Ståhl
By M Consulting AB
Right person. Right place. Everything changes.
Sources:
IT-Juridik.se — HR data, recruitment and GDPR – specific rules 2025
it-juridik.se/hr-data-rekrytering-och-gdpr
Bakgrundsanalys.se — GDPR and the legal basis for background checks in recruitment (January 2026)
bakgrundsanalys.se/lagstiftning-for-bakgrundskontroller
Simployer — Are you recruiting? Do you have a legal basis under GDPR?
simployer.se/artiklar/du-som-rekryterar-har-du-en-laglig-grund-enligt-gdpr
Swedish Authority for Privacy Protection (IMY) — Data protection in recruitment
imy.se