GDPR Compliant Video Interview Software: 10 Tools (2026)

The GDPR compliant video interview tool for most hiring teams is Hirevire: a published DPA with EU Standard Contractual Clauses, candidate video stored in Germany, 90-day default retention, and $39 a month billed yearly. Teams that need an ISO 27001 or SOC 2 Type II certificate on file today should look at VidCruiter, Jobma or Recright, and enterprises already running HireVue will find its regional hosting and FedRAMP status adequate at a far higher price.

Key takeaways

Prices, certifications and ratings checked on each vendor's own site and G2 on 21 September 2026. Confirm against the vendor before you sign.

Why do hiring teams need a GDPR compliant video interview tool?

A recorded interview is personal data in its most identifiable form: a face, a voice, an accent, a bedroom in the background. Three problems come up again and again when teams pick a tool without checking how it handles that data.

1. Nobody knows where the video actually lives

Most vendors say "secure cloud storage" and stop there. Under GDPR you need to know the country, the sub-processor, and the transfer mechanism, because a data protection officer or a candidate can ask. A recruiter at a Swiss law firm told us the reason they chose a tool was that the answer to "where is the video?" was one sentence long:

"All you can look for in a video interview and candidate screening tool: simple, intuitive, and stable. The GDPR compliance gave us confidence for our European hiring." Yusuf Mansur Özer, Grape Law Firm

Candidates ask the same question from the other side. One applicant who had been asked to record answers for an employer wrote on Reddit:

"I don't have any idea what they will do with recording and with all the uncertainty of AI technology, I'm not super comfortable with this. Can I ask what they do with these videos or how can I protect myself?" r/jobs, "Employer wants a video recording of my interview answers"

If your vendor cannot give you a one-sentence answer, you cannot give the candidate one either.

2. Recordings outlive the hiring decision

Video files sit in vendor storage for years unless something deletes them. Under the storage limitation principle you need a retention period you can defend, and a way to prove deletion happened. The Illinois Artificial Intelligence Video Interview Act adds a hard rule for US employers: delete a candidate's video within 30 days of their request (820 ILCS 42).

Candidates do ask for deletion, and the answer they get depends on what your tool can do. A thread on r/careerguidance is titled simply "Can I request that my video interviews be deleted?", and the top reply gives the legal position in one line:

"If you're in Europe then you can use gdpr as that video contains your personal information and they need to delete it" Reply on r/careerguidance

When that email arrives, a recruiter with a delete button answers it in a minute. A recruiter whose vendor treats deletion as a support ticket is now running a data subject request with a 30-day clock.

3. Candidates are not told what happens to them

Greenhouse surveyed 2,950 job seekers in five countries in May 2026: 70% of those who had an AI-assisted interview were not told upfront, and only 26% trust AI to evaluate them fairly (Greenhouse, 2026 Candidate AI Interview Report). GDPR's transparency articles make that a legal problem as well as a candidate-experience one. Candidates notice the gap. One senior tech applicant asked to record a one-way interview on Spark Hire put it this way:

"I have some serious concerns around privacy and consent with this medium." r/recruitinghell, "One-way interviews via Spark Hire?"

The tool has to let you put your own privacy notice in front of the candidate before they press record, and it has to tell you whether any AI touches the recording.

What should you check before signing with a video interview vendor?

Five checks cover most of the risk. Ask for the documents; do not accept a badge on a homepage.

1. Where the video is stored, and under which transfer mechanism

Ask for the sub-processor list with countries. If the vendor or any sub-processor sits outside the EEA, ask which mechanism covers the transfer: an adequacy decision, the EU-U.S. Data Privacy Framework, or Standard Contractual Clauses. For UK candidates you also need the UK Addendum or an IDTA. A vendor that cannot answer this in writing has not done the work.

2. A DPA you can read before you buy

Article 28 requires a contract between you (controller) and the vendor (processor). The good vendors publish it. Read the retention clause, the breach notification window, the audit rights and the sub-processor change process. A DPA "available on request" from sales is a yellow flag; one that appears only after signature is a red one.

3. Default retention and what deletion covers

Get the default retention period in days, whether you can shorten or extend it, and whether deletion reaches backups, transcripts and caches. Ask how long deleted data persists in backups. Then check the product: can a recruiter delete one candidate, or every candidate on a job, without filing a ticket?

4. What the AI does with the recording

Since 2 August 2026 the EU AI Act's transparency duties apply to AI used in hiring (DLA Piper, 2026), and the AI Omnibus, in force since 27 July 2026, moved the Annex III high-risk obligations for recruitment tools to 2 December 2027 (European Commission, AI Act regulatory framework). Whatever the deadline, you need to know today: is transcription or scoring on by default, can you switch it off, does the AI provider retain or train on the transcripts, and does any score sort or reject candidates without a person looking? Article 22 of the GDPR restricts decisions based solely on automated processing, so "advisory only" has to be true in the product itself.

5. Breach notice, support access and audit rights

Your own obligation is 72 hours to the supervisory authority. If the vendor's DPA gives itself 72 hours to tell you, you have no time left. Look for 48 hours or less. Ask whether vendor staff can open your workspace, whether that access is read-only and logged, and whether you can see the log. Confirm you have an audit right, even if you never use it.

Which video interview platforms are GDPR compliant in 2026?

1. Hirevire

Hirevire is asynchronous video screening for teams that hire in the EU, UK and US without a compliance department, and it publishes the documents the five checks above ask for.

Features

• Video, audio, text, file upload and screen recording answers, with no candidate login
• Candidate video stored at Bunny.net in Germany; database and files at Supabase in Mumbai; media delivery and transcription through Cloudflare, which is certified under the EU-U.S. Data Privacy Framework (DPA, Annex III)
• 90-day default video retention on every plan, deletion within 30 days of the period ending, and a $9 a month add-on for 90 more days; the application page shows the deletion date
• Delete a single application, every candidate on a job, or a whole job with its templates and scorecards, from the product
• Backups age out within 7 days; deletion is confirmed in writing on request
• AI transcripts run inside Cloudflare Workers AI, which does not train on customer data; AI scorecards are opt-in per workspace and run on OpenAI with Zero Data Retention
• AI scores are advisory and display-only. They never sort, hide or reject a candidate (DPA §4.4)
• Link your own privacy policy on the application page; disable email collection for marketplace hiring
• Share links with expiry, optional password and noindex; role-based access with Admin and Billing Admin roles; OTP-only login
• Audit log of stage changes and candidate-detail edits on every application
• Breach notification to you within 48 hours; support access is read-only and logged, and you can request the log (Privacy Policy §13)
• Published DPA with EU SCCs (Module Two), UK Addendum and Swiss FADP wording, effective on signup, countersigned copy on request
• Trust center with 25 policies and 47 monitored controls at trust.hirevire.com

Pros

• Every retention, location and transfer question has a published, specific answer
• Cheapest paid plan in this list, with AI transcripts and scorecards included on every tier
• Native integrations with Ashby, Recruitee, Manatal and Loxo, treated in the DPA as destinations you control, not as Hirevire sub-processors

Cons

• No ISO 27001 or SOC 2 certificate yet; SOC 2 Type 1 is in progress
• The company is incorporated in India, so the DPA relies on SCCs rather than an adequacy decision
• Asynchronous only; no live interview mode

Pricing: Essentials $39 a month billed yearly ($49 monthly, 1 user), Professional $99 a month billed yearly (5 users, custom domain, custom SMTP), Agency $199 a month billed yearly (15 users, 5 organisations). 7-day free trial, no card.

Rating: G2 4.6/5 from 30 reviews; Capterra 5.0/5 from 26 reviews.

Best for: teams of one to fifteen recruiters, and agencies, that want documented GDPR handling at a small-business price.

2. VidCruiter

VidCruiter is the enterprise option: structured interviewing, live and pre-recorded, with dedicated EU hosting for European customers.

Features

• Dedicated EU data hosting for European clients
• SOC 2 Type II, ISO 27001, ISO 27017 and ISO 27018 certifications; GDPR, PIPEDA, CCPA and TX-RAMP programmes
• Consent workflows per processing activity and configurable retention with audit trails
• Structured interview builder, 20+ interface languages, workflow customisation

Pros

• The strongest certification set on this list
• EU residency is a contract option, not a promise
• Deep configuration for regulated industries

Cons

• No public pricing; every quote goes through a sales form
• Setup needs IT involvement and training
• Too heavy for a team hiring a few roles a quarter

Pricing: custom quote only. Rating: G2 4.8/5 from 276 reviews. Best for: large enterprises, public sector and healthcare with a procurement process to satisfy.

3. Willo

Willo is a Glasgow-based screening tool with ISO 27001 certification, a pay-as-you-go plan for occasional hiring and an annual Enterprise contract for volume.

Features

• ISO 27001 certified, with MFA and SSO on both plans
• 12 or more months of data retention on both plans
• Anti-cheat and employer verification
• Async video, email and SMS invites, 18+ candidate languages, custom scorecards

Pros

• No contract on the Lite plan
• Certificate on file for procurement
• Long list of ATS integrations on Enterprise

Cons

• Lite is priced per live role, so five open roles cost $295 a month
• Enterprise starts at $3,799 a year on a contract
• No free plan on the pricing page as of September 2026

Pricing: Lite at $59 per live role per month, pay as you go, up to 5 roles and 5 users; Enterprise from $3,799 a year. Rating: G2 4.6/5 from 275 reviews. Best for: teams that hire a few roles a year and want a certified vendor without a contract.

4. HireVue

HireVue is the enterprise assessment platform, and its AI scoring is exactly what the EU AI Act and Illinois law regulate most tightly.

Features

• SOC 2 Type II, ISO/IEC 27001 and FedRAMP, with multi-region hosting
• Granular access controls and audit reporting
• AI-scored video assessments and game-based assessments
• Deep ATS and HRIS integrations

Pros

• Established compliance team and documentation
• Regional hosting for global programmes
• Scales to very high volume

Cons

• No public pricing; enterprise contracts with professional services attached
• AI scoring brings NYC Local Law 144, Illinois and EU AI Act obligations onto you as the deployer
• Candidates need accounts and the process is long

Pricing: enterprise only, custom quote. Rating: G2 4.1/5 from 255 reviews. Best for: Fortune 500 hiring at volume with legal review already budgeted. Read the HireVue review before committing.

5. Hireflix

Hireflix is a minimal one-way interview tool with SOC 2 compliance, automatic candidate video deletion and no candidate login.

Features

• SOC 2 compliant, SSO, audit logs
• Automatic candidate video deletion
• No login for candidates; candidate pages in 17 languages
• Unlimited users, positions and responses on every plan; GraphQL API and webhooks

Pros

• Predictable pricing with no per-seat fees
• Simple for candidates
• API for custom integrations

Cons

• No native AI scoring, which is either a con or a compliance advantage depending on your view
• Fewer response formats than Hirevire
• The pricing page says SOC 2 without stating the report type

Pricing: $75 a month billed yearly for companies under 50 employees, $150 a month billed yearly for 50 to 250, custom above; first month free. Rating: G2 5.0/5 from 440 reviews. Best for: teams that want many recruiter seats without per-user pricing. See Hireflix alternatives.

6. Jobma

Jobma is AI video interviewing with proctoring, certified to SOC 2 Type II and ISO 27001, with GDPR and CCPA programmes.

Features

• SOC 2 Type II and ISO/IEC 27001 certified; GDPR and CCPA programmes
• AI scoring, summaries, proctoring and candidate verification
• Live and on-demand interviews
• 25 ATS integrations plus Zapier; 14 candidate languages

Pros

• Two certificates on file
• Proctoring for roles where identity matters
• Multi-jurisdiction documentation

Cons

• No public pricing; quote form only
• AI scoring and proctoring bring Illinois and EU AI Act obligations onto you
• Heavier than a small team needs

Pricing: custom quote. Rating: G2 4.7/5 from 169 reviews. Best for: high-volume employers that want proctored interviews and two certificates. See Jobma reviews.

7. Teamdash

Teamdash is an Estonian recruitment platform built around EU consent rules, with automatic consent renewal and anonymisation after expiry.

Features

• ISO/IEC 27001 certified
• Consent expiry tracking with automatic renewal emails and anonymisation once consent lapses
• Talent pool management and bulk candidate communication
• Asynchronous video interviews as a paid add-on

Pros

• Consent handling is the best in this list
• EU-based company and hosting
• Good for long-term talent pools

Cons

• Custom pricing with annual contracts
• Video interviewing is a paid add-on, not the core product
• Two reviews on G2, so little independent feedback

Pricing: custom quote, three tiers. Rating: G2 5.0/5 from 2 reviews; Capterra has 51. Best for: European employers that keep candidates on file for years and need consent to stay valid.

8. Recright

Recright is a Finnish video screening and structured interview platform that hosts every byte in the EU and publishes its ISO 27001 certificate, which makes it the cleanest answer on this list for a European DPO.

Features

• All personal data hosted in EU data centres in Dublin and Frankfurt
• ISO/IEC 27001:2022 certified, with the certificate downloadable from its site; annual third-party penetration tests and Red Team exercises
• Regular DPIAs, documented data subject request handling, and a security whitepaper, DPIA and incident response procedure available on request
• Async video screening, structured interview guides, a light ATS, and an AI pre-screening assistant (Tove); 25 candidate languages

Pros

• EU hosting is the default, not an enterprise option
• The strongest published security documentation among the mid-market tools here
• Free trial available

Cons

• No public price list; Capterra shows a starting price of 265 euros a month
• Only two reviews on G2, so most independent feedback sits on Capterra
• Built around structured interviewing, so heavier than a pure screening tool if video is all you need

Pricing: from 265 euros a month per Capterra, quote-based, free trial. Rating: Capterra 4.8/5 from 54 reviews; G2 4.8/5 from 2 reviews. Best for: European employers whose DPO wants EU residency and an ISO certificate before anything else.

9. Spark Hire

Spark Hire is the long-established one-way and live video interview platform, now sold alongside its own ATS, with a SOC 2 Type II report available on request.

Features

• SOC 2 Type II audit report on request; candidate deletion and information request tooling
• Unlimited one-way and live interviews, unlimited jobs and users
• AI transcription in 50+ languages, AI summaries and scoring
• 40+ ATS integrations plus Zapier

Pros

• Mature product with years of reviews
• Wide integration coverage
• Good collaboration tools

Cons

• $249 a month billed annually, more than six times Hirevire's entry price
• Price varies by company size, so the quote can go higher
• API access and SSO are paid add-ons

Pricing: video interviews from $249 a month billed annually, priced by company size; the ATS is sold separately from $335 a month. Rating: G2 4.7/5 from 706 reviews. Best for: teams that want live and one-way interviews from one established vendor and have the budget. See Spark Hire alternatives.

10. Breezy HR

Breezy HR is an ATS with built-in video interviewing, so GDPR controls apply across the whole pipeline rather than only the video step.

Features

• GDPR compliance tooling listed on every plan, including the free one
• Multi-factor authentication and custom portal domain from the Startup plan
• Full applicant tracking, pipeline automation, team roles
• One-way candidate video and live interviews inside the hiring workflow

Pros

• One vendor for ATS and video
• Free tier to start
• Role-based permissions across the pipeline

Cons

• $157 a month on the annual plan for the Startup tier; $273 for Growth
• Video interviewing is lighter than dedicated tools
• No SOC 2 or ISO certificate published

Pricing: free Bootstrap tier with one active position; Startup $157 a month, Growth $273, Business $439, all on annual billing. Rating: G2 4.4/5 from 695 reviews. Best for: small companies that want one system and are willing to accept a simpler video step.

How do the ten tools compare on GDPR?

Which GDPR compliant video interview tool fits your situation?

• If you hire 1 to 20 roles a year with one or two recruiters, and you want the DPA and storage locations in writing today: Hirevire Essentials.
• If you are an agency screening for several clients with separate branding and domains: Hirevire Agency, or Teamdash if your clients demand consent renewal on long-lived pools.
• If procurement will not sign without an ISO 27001 or SOC 2 Type II certificate on file: VidCruiter or Jobma, Recright if EU hosting is the deciding factor, or Willo Lite at the small end.
• If you already run AI-scored assessments at enterprise scale and have counsel for NYC Local Law 144, Illinois and the EU AI Act: HireVue.
• If you hire a handful of roles a year and refuse an annual contract: Willo Lite at $59 per live role, or Hirevire monthly at $49.
• If you want ATS and video from one vendor and can accept a simpler video step: Breezy HR.
• If you need the video step to be free while you test: Breezy HR's Bootstrap tier, then compare on the checks above before you scale.

What does GDPR compliant video interviewing cost over three years?

Subscription differences compound. Using each vendor's entry paid plan, billed as they publish it:

Hirevire's AI transcripts and scorecards are included at every tier, so the comparison does not change when you add AI. VidCruiter, HireVue, Jobma, Teamdash and Recright quote per customer and are left out; expect onboarding and training on top of the licence.

How does Hirevire handle candidate data under GDPR?

This is the section to send to your DPO. Every line comes from the DPA (effective 21 August 2026), the Privacy Policy or the changelog.

Roles. The employer is the controller, Hirevire (Craftwell Studios Private Limited, Mumbai) is the processor. Because India has no adequacy decision, the DPA incorporates EU SCCs Module Two under Irish law, with the UK International Data Transfer Addendum and Swiss FADP wording. Hirevire keeps an Article 30(2) record and will share it, answers security questionnaires, and allows one audit per year on 30 days' notice.

Where data lives. Candidate video at Bunny.net in Germany. Database, authentication and uploaded files at Supabase in Mumbai. Media delivery, web application firewall and transcription at Cloudflare in the US and its global edge, certified under the EU-U.S. Data Privacy Framework. Transactional email through Brevo and SMS through Telnyx, both US, under SCCs. AI scoring, only when you switch it on, through OpenAI in the US under Zero Data Retention: transcripts are not stored by OpenAI and are not used for training. Your ATS, Zapier, Make, Pabbly, Google Drive and any webhook you configure are destinations you choose, not Hirevire sub-processors.

How long it is kept. Video and audio answers: 90 days from upload by default, deleted within 30 days after that, extendable in 90-day blocks. Everything else on a candidate (profile, text answers, files, transcripts, AI output, your ratings): until you delete the record or the account. Backups age out within 7 days. On account termination, all data is deleted across every store and sub-processor.

How you delete. From the product: one application, every candidate on a job, or the whole job with its templates and scorecards. Share links can be deleted manually and carry an expiry and optional password. Deletion propagates to database, media storage, transcripts and caches, and Hirevire confirms it in writing if you ask.

What candidates see. You can link your own privacy policy on the application page. Candidate pages use no analytics cookies. Candidates do not create accounts. Hirevire records the candidate's IP address and inferred city on apply and shows it to the recruiter; you can hide that column per job, and it belongs in your privacy notice.

Automated decisions. AI scorecards are opt-in, advisory and display-only: they do not sort, filter, hide or reject anyone, and the DPA makes you responsible for human review and Article 22 notices. Auto-disqualification, where you use it, is a rule you write (a must-have criterion such as work authorisation), not a model, and it does reject automatically, so tell candidates it exists and keep a review path.

Security. TLS 1.2 or higher in transit, encryption at rest on every store, no public buckets, files served through signed URLs, Cloudflare WAF, tenant isolation, role-based access. Login is by one-time code only. Support staff can open your workspace read-only; each access is logged and you can request the log. Breach notification to you within 48 hours.

Certifications. GDPR programme with published DPA; SOC 2 Type 1 audit started; 25 policies and 47 monitored controls listed at trust.hirevire.com. No ISO 27001.

Try Hirevire free: 7 days, no card, and the DPA applies from the moment you sign up.

Frequently asked questions

Basics

What makes a video interview platform GDPR compliant?

A published Data Processing Agreement under Article 28, a sub-processor list with countries and transfer mechanisms, a default retention period with working deletion tools, a breach notification window shorter than your own 72 hours, and a way to put your privacy notice in front of the candidate. A badge on a homepage is not evidence of any of those.

Is a recorded video interview personal data?

Yes. A face and a voice identify a person directly, and the content of the answers usually adds more. Treat the recording, the transcript and any AI output as personal data with the same retention and deletion rules.

Do candidates need to consent to a video interview?

Consent is one lawful basis, but most employers rely on legitimate interests or steps prior to a contract for the screening itself, and use consent only for optional extras. Whatever basis you pick, the candidate must be told before recording who processes the video, where, for how long, and whether AI is involved.

Comparisons

Which video interview tools store video in the EU?

Hirevire stores candidate video at Bunny.net in Germany on every plan. Recright hosts all data in Dublin and Frankfurt. VidCruiter offers dedicated EU hosting on enterprise contracts. Teamdash is EU based. The other vendors on this list either offer regional hosting as an option or do not state a location publicly; ask before you sign.

Which tools have an ISO 27001 or SOC 2 certificate?

VidCruiter holds SOC 2 Type II plus ISO 27001, 27017 and 27018. HireVue holds SOC 2 Type II, ISO 27001 and FedRAMP. Jobma holds SOC 2 Type II and ISO 27001. Willo, Teamdash and Recright hold ISO 27001. Spark Hire has a SOC 2 Type II report on request and Hireflix states SOC 2 compliance. Hirevire's SOC 2 Type 1 audit is in progress and it has no ISO certificate; it competes on published specifics instead.

Is HireVue GDPR compliant?

HireVue publishes SOC 2 Type II, ISO 27001 and FedRAMP certification and multi-region hosting. The compliance work falls on you as deployer of its AI scoring: NYC Local Law 144 bias audits, Illinois consent and deletion rules, and EU AI Act obligations for recruitment tools. Read the HireVue review for the detail.

Pricing

How much does GDPR compliant video interview software cost?

From $39 a month billed yearly (Hirevire) to $249 a month billed annually (Spark Hire) for published plans, with Willo Lite at $59 per live role and Willo Enterprise from $3,799 a year. VidCruiter, HireVue, Jobma, Teamdash and Recright quote per customer. Breezy HR has a free tier.

Does GDPR compliance cost extra?

It should not. On Hirevire the DPA, EU video storage, retention controls and deletion tools are on every plan, including Essentials. Some enterprise vendors price EU hosting or extended audit support as add-ons; ask.

What does extended video retention cost on Hirevire?

$9 a month for an additional 90 days on top of the 90-day default. The application page shows the date each video will be deleted.

Compliance

How fast must a vendor tell me about a data breach?

You have 72 hours to notify your supervisory authority, so the vendor's window has to be shorter. Hirevire's DPA commits to 48 hours from becoming aware. Check the number in each vendor's DPA rather than its marketing.

Can candidate video be used to train AI?

Only if the candidate was told and a lawful basis covers it, which in practice means a separate consent. Hirevire's transcription runs in Cloudflare Workers AI, which does not train on customer data, and its optional scoring uses OpenAI under Zero Data Retention. Ask every vendor the same question in writing.

Does the EU AI Act apply to video interview software?

Transparency duties for AI used in hiring have applied since 2 August 2026. The AI Omnibus, in force since 27 July 2026, moved the high-risk obligations for recruitment tools listed in Annex III to 2 December 2027. Tools that only record and display answers for a human reviewer sit outside the high-risk category; tools that score candidates do not.

What happens to candidate data when I cancel?

On Hirevire, jobs and applications are deleted 30 days after cancellation, and all data is deleted across every store and sub-processor on account termination, with deleted data persisting in backups for at most 7 days. Export candidate data before you cancel if you need it.