Hirebridge & the General Data Protection Regulation (GDPR)
Data protection information for teams using Hirebridge in their recruiting process.
Updated
What is the GDPR, and when did it apply?
The GDPR is the European Union’s General Data Protection Regulation. It has applied since May 25, 2018. It governs the handling of personal data and protects individuals’ data rights. See the European Commission’s guidance on its application date and data protection legal framework.
Who does the GDPR apply to?
It applies to processing in the context of an EU establishment. It can also cover organizations outside the EU when they offer goods or services to individuals in the EU or monitor their behavior there. Citizenship alone does not determine whether it applies. Review the Commission’s guidance on scope and responsibilities for your organization’s circumstances.
What personal data does recruiting involve?
Candidate names, contact details, resumes and interview records can identify individuals. Collecting, reviewing, storing, sharing and deleting these records are examples of processing. Recruiting teams should decide what information they need, why they need it, who can access it and how long to retain it.
What should a recruiting team review?
Review the lawful basis for each use of candidate data, the information provided to candidates, access permissions, retention and deletion practices, and how requests about personal data are handled. Consent is not the only possible lawful basis. The appropriate basis depends on the processing. The Commission explains these principles in its guidance on processing personal data.
Who is the controller or processor?
A controller determines why and how personal data is processed; a processor handles data on a controller’s behalf. Review your Hirebridge agreement and processing arrangements to establish each party’s role and responsibilities. For questions about a Data Processing Agreement or your service configuration, contact legal@hirebridge.com.
Where can I find Hirebridge privacy and subprocessor information?
Read our Privacy Policy and subprocessor list. For account-specific questions about processing locations, security documentation or subprocessors, contact legal@hirebridge.com.
What about international data transfers?
Transfers outside the European Economic Area require an applicable transfer mechanism and safeguards. The European Commission describes these in its international transfer guidance. Ask Hirebridge for the transfer documentation applicable to your agreement and configuration.
Where can I get help?
For Hirebridge privacy questions, contact legal@hirebridge.com. To discuss your recruiting workflow, contact our team. Your organization’s privacy adviser can help assess its obligations; this overview does not replace that assessment or your contractual documentation.