When AI is used to screen a CV, candidates still have rights over how their personal data is collected, processed, and used. Individuals rights under GDPR become especially important when AI is part of the recruitment process. For recruiters, understanding individuals rights under GDPR isn't just about compliance. It also helps ensure AI supports hiring decisions without taking control away from the recruiter.

What Individuals Rights Under GDPR Actually Cover

  • The individuals rights under GDPR give candidates control over their personal data. These are also known as data subject rights.
  • Candidates may have the right to know what information is collected and why, request access to their data, correct inaccurate information, and request deletion in certain situations.
  • For AI screening, automated decision making GDPR rules are particularly important. Article 22 provides protections around decisions based solely on automated processing when they have legal or similarly significant effects.
  • This makes human oversight important when AI is used to screen or rank candidates.

Why Individuals Rights Under GDPR Matter in AI Recruitment

AI hiring software can process hundreds of CVs much faster than a recruiter. But speed doesn't remove data subject rights. A candidate may want to know how their information was used, what data was considered, or why an automated system produced a particular result.

This is where individuals rights under GDPR become important. Recruiters need to understand how their AI recruiting tool handles candidate information and how much human involvement remains in the process. Being GDPR compliant isn't simply about having a privacy policy. Recruiters need to understand what actually happens to candidate data.

What Human Oversight Actually Means

Human oversight isn't simply looking at an AI-generated ranking and clicking approve.

The recruiter should be able to review the recommendation, question it when something looks wrong, and make the final hiring decision.

This is another reason individuals rights under GDPR matter. If a candidate questions an automated outcome, the recruiter needs enough information to properly review what happened.

What Recruiters Should Check in AI Screening Software

If you're evaluating candidate screening software, don't stop when a vendor says it is GDPR compliant.

Ask:

  • Can candidates access their personal data?
  • Can inaccurate information be corrected?
  • Does the system rely entirely on automated decisions?
  • Can a recruiter review an AI recommendation?
  • Where is candidate data processed and stored?
  • Does the vendor explain its data protection by design approach?

These questions make individuals rights under GDPR easier to understand in practice.

How Data Protection by Design Supports GDPR Rights

Data protection by design means privacy is considered when a system is built rather than added later through policies.

Cloud-based recruitment software may involve servers, processors, and other services handling candidate data. Recruiters therefore need to understand the full data flow.

An on-device AI approach works differently. Candidate information can be processed directly on the recruiter's device instead of being sent to an external server.

This doesn't automatically make software GDPR compliant, but it can reduce the amount of external data processing involved.

Where EdgeTal Stands on Individuals Rights Under GDPR

  • EdgeTal takes an on-device approach to candidate data. Its AI runs directly on the recruiter's phone, so CVs don't need to be sent to a cloud server for AI processing.
  • This supports a data protection by design approach by reducing the external processing chain around candidate information.
  • EdgeTal uses a private LLM and on-device AI to process candidate data locally. Recruiters can import CVs through a CSV, URL, or local file, with embeddings generated directly on the device.
  • Semantic search then helps find candidates based on the meaning of their skills and experience rather than only exact keywords.
  • Search results also show a match percentage and the part of the candidate profile that contributed to the match, giving recruiters more visibility than a score alone.
  • For individuals rights under GDPR, this also means candidate data isn't stored in a separate EdgeTal cloud database for processing.

What EdgeTal Doesn't Claim?

On-device processing doesn't automatically satisfy every GDPR requirement. Recruiters still have responsibilities around how candidate information is collected, used, and handled. The same applies to individuals rights under GDPR. Technology can support privacy, but it doesn't replace the recruiter's responsibility.

A full plain language "why this match" explanation is also not live yet. Currently, recruiters can see the match percentage and the profile information that contributed to it.

Conclusion

Individuals rights under GDPR don't disappear when AI enters recruitment. Candidates still have rights over their personal data, and recruiters remain responsible for how that data is used. I can make sourcing and screening faster, but it shouldn't turn hiring into an invisible automated process. A good recruitment system should support the recruiter, protect candidate information, and keep the final decision with the human.

FAQs

What are individuals' rights under GDPR?

Individuals' rights under GDPR give people control over their personal data, including rights to access, correct, and in certain cases delete their information.

Does GDPR apply to AI recruitment?

Yes. GDPR applies when personal data is processed during recruitment, including when AI is used to screen or evaluate candidates.

Does EdgeTal store candidate data in the cloud?

No. EdgeTal processes candidate data directly on the device, so CVs don't need to be sent to a cloud server for AI processing.

Does AI make the final hiring decision?

AI can help recruiters search, screen, and evaluate candidates, but the recruiter should remain responsible for reviewing recommendations and making the final hiring decision.