GDPR Compliant Recruiting Software: 12 Tools Compared (2026)

The GDPR compliant recruiting software that fits most European small and mid-size teams is an ATS that keeps data in the EU and deletes candidates on a schedule without anyone remembering to do it. Recruitee, Teamtailor, Personio and SmartRecruiters all host in the EU and automate deletion or anonymisation. US companies hiring in Europe usually pick Greenhouse, Lever or Workable, which publish strong certificates and give detailed retention controls. Agencies on a budget look at Zoho Recruit or Manatal. Whichever ATS you choose, the screening tool that feeds it needs the same checks, and Hirevire covers that layer with a public DPA, candidate video stored in Germany, SOC 2 Type II and a 90-day default retention.

Hirevire passes screened candidates to every ATS below, natively or through Zapier and Make. To add that screening step, try Hirevire free for 7 days, no credit card needed.

This guide compares 12 applicant tracking systems and 6 screening tools on the facts a data protection officer asks for: where data is stored, whether the DPA is public, which certificates the vendor holds, how deletion works, and whether AI features can be switched off. Every fact comes from the vendor's own security, legal, help or pricing pages, checked in November 2026.

Key takeaways

"Public DPA" means the Data Processing Agreement can be read before you sign up. "On request" means you ask sales or support for it.

Why do recruiting teams look for GDPR compliant software?

Recruiting holds more personal data than almost any other team: CVs, contact details, interview notes, test results, video, and sometimes right-to-work documents. GDPR fines reach 20 million euros or 4% of worldwide turnover, whichever is higher (GDPR Article 83). Three situations push teams to check their software.

A candidate asks for their data and nobody can find all of it

The CV is in the ATS, the video answers sit in the screening tool, the test score is in an assessment platform, and the interview notes are in a shared drive. A data subject access request has a one-month deadline, and every tool that holds a piece of the candidate is part of the answer. Software that can export or delete one candidate's full record in a few clicks turns a week of searching into a morning.

Talent pools quietly go out of date

Keeping rejected candidates for future roles needs a lawful basis and a time limit. Consent given two years ago for "future opportunities" does not last forever. Without automatic consent renewal and deletion, a talent pool becomes a pile of data you can no longer justify keeping. Candidates know their rights here: a reply in an r/careerguidance thread on deleting video interviews reads, "If you're in Europe then you can use gdpr."

The DPA arrives after the contract

Article 28 requires a written contract between you as controller and the vendor as processor. Some vendors publish theirs. Others send it only after the purchase, when it is too late to walk away from a bad retention or breach clause.

AI adds a fourth pressure. Greenhouse surveyed 2,950 job seekers in May 2026: 70% of those who had an AI-assisted interview were not told upfront, and 26% trust AI to evaluate them fairly (Greenhouse, 2026 Candidate AI Interview Report). The EU AI Act's transparency duties for AI in hiring apply from 2 August 2026, and the high-risk obligations for recruitment tools apply from 2 December 2027 (European Commission).

What should a GDPR compliant ATS do?

A GDPR compliant ATS gives you five things you can check before you buy. A "GDPR ready" badge on the homepage proves none of them.

Hosting region and transfer mechanism

Find out which country holds the data and which sub-processors touch it. If anything sits outside the EEA, the vendor should name the transfer mechanism: an adequacy decision, the EU-U.S. Data Privacy Framework, or Standard Contractual Clauses. EU hosting removes most of the questions, though US hosting with a clear transfer mechanism is still lawful.

A DPA you can read before purchase

Read the retention clause, the breach notification window, the sub-processor change process and the audit rights. Your own deadline to report a breach to the regulator is 72 hours, so a vendor that gives itself 72 hours to tell you leaves you no time at all.

Retention and anonymisation that run on their own

Look for a retention period per country or per job, automatic deletion or anonymisation when it ends, and consent renewal emails sent to candidates before their consent expires. A tool that only reminds an admin to delete still depends on someone doing it.

Tools for access and deletion requests

You should be able to export everything held on one candidate and delete it everywhere, including attachments and notes. The best tools let candidates make the request themselves through a link.

AI features you can switch off

Many ATS products now score, rank or summarise candidates. Check that each AI feature can be turned off for the whole account and per job, that candidates are told, and that a person makes the decision. Article 22 of the GDPR restricts decisions based only on automated processing.

Which applicant tracking systems are GDPR compliant?

All twelve below offer the basic GDPR features. The differences are where data sits, how much of the retention work runs by itself, and what you pay.

1. Recruitee

Recruitee, part of Tellent, is a European ATS that keeps customer data in the EU by default. Main data runs on Google Cloud in Frankfurt and Berlin, files and backups on AWS Frankfurt, and video answers on AWS in Ireland (Recruitee data center and GDPR). The DPA sits inside Tellent's public terms, and Recruitee holds ISO 27001 with a SOC 2 Type II report on request.

Retention is the strongest part. Recruitee deletes candidates automatically when their retention period ends, deletes candidates who never gave consent after 30 days, and sends consent extension emails before expiry (automate consent requests and deletions). Its Screening Assistant can be switched off for the whole company or per job.

Price: quote based on plan and company size, with a one-year minimum and 20% off for annual billing. Best for: EU small and mid-size businesses that want deletion handled for them. Hirevire connects to Recruitee natively through the Recruitee integration.

2. Teamtailor

Teamtailor is a Swedish ATS built around employer branding, with an EU region on AWS in Ireland alongside North America and Asia-Pacific regions (sub-processors). It holds ISO 27001, ISO 27701, ISO 42001 for AI management, and SOC 2 Type 2. The DPA is listed in its trust center.

Teamtailor deletes candidates automatically when permission is missing or has expired, and candidates can ask to be removed from their own data and privacy page (automatic removal). AI features sit in the Co-pilot add-on, which an admin activates feature by feature.

Price: quote only. Best for: European employers that care about their careers site and want EU hosting. The Teamtailor review covers the product in more detail.

3. Personio

Personio is an HR platform with recruiting built in. Data is stored in Frankfurt on AWS, and its public DPA is linked from the terms page. It holds ISO 27001:2022 and ISO 27017 (Personio trust center).

Personio anonymises candidates automatically a set number of days after they are rejected or withdraw, and admins can anonymise in bulk (Personio help). Talent pools need the candidate's permission. AI features such as the Talent Screening Agent can be turned off in the account settings.

Price: quote only. Best for: EU companies that want HR and recruiting in one system with Frankfurt hosting.

4. SmartRecruiters

SmartRecruiters hosts in Frankfurt by default, with Sydney and Ohio as options. It publishes a pre-signed GDPR DPA and holds SOC 2 Type 2, ISO 27001:2022, ISO 42001 and ISO 22301 (SmartRecruiters trust center).

Data purging runs automatically and can be set per country, which matters for employers hiring across many EU states. Its Winston AI features are deployed at the customer's choice under a separate AI addendum.

Price: quote only. Best for: enterprises hiring at volume in many countries.

5. Greenhouse

Greenhouse publishes its DPA in full and holds ISO 27001:2022, ISO 27701, ISO 42001, and SOC 1 and SOC 2 Type 2 (Greenhouse security). Its trust portal lists AWS hosting in the US, Germany and Australia.

The GDPR toolkit alerts admins when a retention period expires, sends consent extension emails automatically where consent is the lawful basis, and exports or deletes candidates singly or in bulk (GDPR features overview). AI features such as Talent Matching can be switched off for the whole company, by office, department or job, and candidates can opt out of AI processing.

Price: quote only. Best for: mid-size and enterprise teams running structured, scorecard-based hiring. The Greenhouse MCP guide shows how AI agents connect to it.

6. Lever

Lever, now part of Employ, lists AWS regions in the US and EU-Central and holds SOC 2 Type 2 and ISO 27001 (Lever security). Its own DPA is available to customers on request.

Retention settings anonymise candidates automatically when their period ends, configured per country, with a reminder to the account owner a month before. Consent refresh links extend the period when a candidate agrees (Lever GDPR settings). Candidate Insights and Interview Intelligence can be switched off by an admin, and candidates can opt out of AI interview recording.

Price: quote only. Best for: teams that want ATS and candidate CRM together with detailed per-country rules.

7. Workable

Workable publishes a downloadable DPA, holds ISO 27001 and ISO 27017, publishes a SOC 3 report and shares SOC 2 Type II on request (Workable security). The DPA lists processing in the UK, US and Greece.

For jobs in GDPR locations, Workable deletes candidate profiles automatically after a set number of months, and deletes sourced candidates who were never contacted after 30 days. Candidates can withdraw and delete their own data through a link in the confirmation email. One account-wide switch turns AI off, and the Screening Agent can also be switched off per job.

Price: from $299 a month for the Standard plan (companies with 1 to 20 employees). Best for: small and mid-size businesses that want an all-round ATS with published pricing.

8. Breezy HR

Breezy HR hosts EU and UK customers in EU data centres. Its DPA is the public data protection addendum of its parent company LTG, and the certificates (ISO 27001:2022, ISO 27701 and SOC 2 Type II) are held at group level (LTG trust center).

Consent lasts 24 months by default, Breezy can send automatic renewal requests, and an "Auto-Remove Expired Candidates" setting deletes candidates whose consent has lapsed (Breezy consent settings). AI scoring is part of a paid add-on with a company and position level toggle.

Price: Startup plan $157 a month billed yearly or $189 monthly. Best for: small businesses that want simple consent automation and EU hosting.

9. Zoho Recruit

Zoho Recruit accounts created in Europe live in Zoho's EU data centres in Amsterdam and Dublin. Zoho holds ISO 27001, 27701, 27017 and 27018, plus SOC 2 Type 2 (Zoho compliance). The DPA is requested by an admin through Zoho Accounts.

A data deletion consent setting deletes candidates automatically after a waiting period, and candidates can make access and deletion requests through a data request link or the candidate portal (Zoho Recruit data subject rights).

Price: a free plan with one active job; Standard from $25 per recruiter a month billed yearly. Best for: budget teams and staffing agencies. See the Zoho Recruit reviews for user feedback.

10. Ashby

Ashby stores and processes data in the United States, relies on the EU-U.S. Data Privacy Framework for transfers, and holds SOC 2 Type 2 and SOC 1 Type 2 (Ashby GDPR). The DPA is available on request.

Retention rules based on inactivity or consent flag candidates for review, and Ashby sends consent extension emails before expiry. Deletion happens once someone acts on the flag (Ashby data privacy docs). Each AI feature can be switched on or off by an admin.

Price: from $400 a month for companies up to 100 employees. Best for: fast-growing tech companies that want ATS, scheduling and analytics in one product. Hirevire connects natively through the Ashby integration.

11. Manatal

Manatal stores customer data in the US on AWS, publishes its DPA in full (effective 7 September 2026) and holds SOC 2 Type II (Manatal security). Admins can export and permanently delete candidate data on request, and consent requests can go to new candidates automatically.

Price: $15 per user a month billed yearly. Best for: recruitment agencies and small teams that want a low per-seat price with AI matching. Hirevire connects natively through the Manatal integration.

12. JazzHR

JazzHR, part of Employ, hosts on AWS in the US and covers EU transfers with Standard Contractual Clauses and the Data Privacy Framework. It holds SOC 2 Type 2 and ISO 27001, and Employ's DPA is published in full (JazzHR security). The DPA says customers can configure automatic anonymisation or deletion by region. Its Talent Fit AI matching is off by default.

Price: from $1,000 a year on the Hero plan, for companies up to 250 employees. Best for: US small businesses that hire some EU candidates and want a low yearly price.

Which screening and assessment tools are GDPR compliant?

The ATS is usually your main record of each candidate. Screening tools, video interviews and skills tests add data to that record, so they need the same checks. A screening tool with short default retention and a clean hand-off to the ATS keeps the copy of the data that lives outside your main system small.

Hirevire

Hirevire is one-way video and audio screening for teams that want documented GDPR handling at a small-business price. Its DPA is public and takes effect at signup, with EU Standard Contractual Clauses, the UK Addendum and Swiss wording. Candidate video is stored with Bunny.net in Germany. Video and audio answers are kept for 90 days by default and deleted within 30 days after that, with another 90 days available for $9 a month. Breach notification to you is within 48 hours. Hirevire holds SOC 2 Type II, with 25 policies and 47 monitored controls listed at trust.hirevire.com.

AI transcripts in 90+ languages and AI scorecards are on every plan. Scoring runs only when you switch it on, uses OpenAI under Zero Data Retention, and stays advisory: scores never sort, hide or reject a candidate. Candidates record in the browser with no account, and you can link your own privacy notice on the application page. Recruiters can delete one application, every candidate on a job, or a whole job.

Hirevire connects natively to Ashby, Recruitee, Manatal and Loxo, and to other systems through Zapier, Make and Pabbly Connect. The DPA treats those connections as destinations you control, so a screened candidate's answers move into your ATS under your own retention rules.

Price: $39 a month billed yearly ($49 monthly). Best for: teams that want a GDPR-documented screening step in front of any ATS. To see it on a live role, try Hirevire free for 7 days, no credit card needed.

Hireflix

Hireflix is a one-way video interview tool that states SOC 2 compliance and deletes candidate video automatically. Candidates do not need an account. Price: $75 a month billed yearly for companies under 50 employees. Best for: teams that want unlimited recruiter seats. See the Hireflix review.

Willo

Willo is a Glasgow-based video screening tool with ISO 27001 certification and 12 or more months of data retention on both plans. Price: $59 per live role a month with no contract, or Enterprise from $3,799 a year. Best for: teams that hire a few roles a year and want a certified vendor.

Recright

Recright, from Finland, hosts all personal data in EU data centres in Dublin and Frankfurt and holds ISO 27001:2022. Price: quote based. Best for: European employers whose DPO wants EU residency and an ISO certificate before anything else.

Spark Hire

Spark Hire offers one-way and live video interviews with a SOC 2 Type II report available on request and tools for candidate deletion and information requests. Price: from $249 a month billed yearly. Best for: teams that want live and one-way interviews from one vendor.

TestGorilla

TestGorilla runs pre-employment skills tests and lists GDPR compliance and SOC 2 Type II on its pricing page. Its hosting region is not stated publicly, so ask before you sign. Price: a free assessments plan with 10 credits a month; paid plans from $215 a month billed yearly. Best for: teams adding skills tests before interviews.

For a deeper look at video tools on storage, retention and AI, read the GDPR compliant video interview software comparison.

Which combination fits your situation?

Most teams need one ATS and one screening tool. These pairings cover the common cases.

An EU small business with no DPO

Pick an ATS that deletes on its own: Recruitee, Teamtailor or Personio. Add a screening tool with a public DPA and short default retention, such as Hirevire, so the video copy disappears after 90 days while the decision lives in the ATS.

A US company hiring candidates in the EU

Greenhouse, Lever or Workable give strong certificates and per-country retention settings. Check that the EU retention rules are switched on for EU jobs, since most defaults follow US practice. Use a screening tool with EU video storage and a DPA that covers EU and UK transfers.

An agency screening for several clients

Zoho Recruit and Manatal keep per-seat costs low. Hirevire Agency gives each client its own branded organisation, so candidate data for one client stays apart from another. Agree retention periods with each client in writing.

An enterprise with a procurement team

SmartRecruiters and Greenhouse bring the widest certificate sets, including ISO 42001 for AI management. Procurement will ask for SOC 2 Type II reports from every tool in the stack, the screening tool included. Hirevire shows its SOC 2 Type II status and controls on its Trust Center.

Whichever ATS you pick, the screening step can start today: try Hirevire free for 7 days, no credit card needed. The DPA applies from the moment you sign up.

This walkthrough shows how a Hirevire screen works from the recruiter's side:

For the legal side of AI screening, read AI hiring laws for HR leaders and compliant AI hiring. To add a screening step to an existing ATS, see how to automate candidate screening in your ATS.

Frequently asked questions

What makes recruiting software GDPR compliant?

A published or easily obtained Data Processing Agreement, a clear hosting location with a lawful transfer mechanism, retention periods with automatic deletion or anonymisation, tools to export and delete a candidate's data, and AI features you can switch off. The software supports compliance; your own privacy notice, lawful basis and retention policy complete it.

Which ATS stores candidate data in the EU?

Recruitee, Teamtailor, Personio and SmartRecruiters host in the EU by default or by region. Breezy HR hosts EU and UK customers in EU data centres, and Zoho Recruit accounts created in Europe live in Amsterdam and Dublin. Ashby, Manatal and JazzHR host in the US and rely on transfer mechanisms.

What is the best ATS for GDPR compliance?

For EU small and mid-size teams, Recruitee and Teamtailor automate the most: EU hosting, automatic deletion and consent renewal emails. For enterprises, SmartRecruiters and Greenhouse bring the broadest certificates and per-country retention settings.

How long can you keep candidate data under GDPR?

GDPR sets no fixed number. You must set a period you can justify and tell candidates what it is. Many EU employers keep unsuccessful applicants for six months to cover discrimination claims, and keep talent pool candidates longer only with consent that is renewed.

Is a GDPR compliant ATS enough on its own?

No. Every tool that holds candidate data needs a DPA and a retention period, including video screening, assessments, scheduling and email. List each tool in your record of processing and in your candidate privacy notice.

Do AI features in recruiting software affect GDPR compliance?

Yes. Candidates must be told when AI processes their application, a person must make the hiring decision, and the EU AI Act adds transparency duties now and high-risk obligations for recruitment tools from 2 December 2027. Choose tools where each AI feature can be switched off and scores stay advisory.

Sources

1. GDPR, Regulation (EU) 2016/679, EUR-Lex
2. European Commission, AI Act regulatory framework
3. Greenhouse, 2026 Candidate AI Interview Report
4. ICO, recruitment and selection guidance
5. Recruitee, data center and GDPR
6. Teamtailor, sub-processors
7. Personio trust center
8. SmartRecruiters trust center
9. Greenhouse security
10. Lever security
11. Workable security
12. LTG trust center (Breezy HR)
13. Zoho compliance
14. Ashby GDPR
15. Manatal security
16. JazzHR security
17. Hirevire DPA
18. Hirevire Trust Center
19. TestGorilla pricing