Pre-employment assessment platforms can process a broad range of candidate information, including contact details, assessment responses, employment history, psychometric information, and evaluation results. For organisations subject to the General Data Protection Regulation (GDPR), procurement teams should treat privacy and security controls as core selection criteria, alongside assessment quality and integration capability.
A compliant procurement review should establish how the platform creates a lawful basis for processing, protects information throughout the data pipeline, governs automated scoring, manages retention, and exchanges records with an applicant tracking system (ATS). This article provides an evaluation framework, not legal advice. Organisations should obtain advice appropriate to their processing activities and jurisdictions.
The regulatory urgency of candidate data protection
Recruitment data is sensitive because it can affect an individual’s access to employment. Digital assessments may collect information beyond a conventional CV, such as responses to role-based scenarios, psychometric indicators, scoring outputs, and demographic information used for monitoring or anonymisation. Depending on the data collected and the purpose of processing, some information may also fall within GDPR special-category protections or otherwise create a heightened privacy risk.
Before a platform collects or receives candidate information, the employer and vendor should be able to identify the relevant lawful basis for processing. Where special-category data is involved, an additional condition for processing may be required. Procurement documentation should clearly distinguish the organisation’s responsibilities as controller from the vendor’s responsibilities as processor, including the instructions under which the vendor handles candidate data.
For GDPR compliant recruitment software, transparency is equally important. Candidates should receive clear information about what data is collected, why it is used, how long it is retained, whether automated processing is involved, and how they can exercise their rights. A privacy notice should reflect the actual assessment workflow rather than describe recruitment processing only in general terms.
Core security infrastructure for assessment platforms
Recruitment software data security should be assessed across the full lifecycle of a candidate record: collection, transmission, storage, access, integration, retention, and deletion. Encryption is one important safeguard, but it is not a substitute for access controls, governance, monitoring, and documented incident processes.
Procurement teams should ask vendors how data is protected both in transit and at rest. AES-256 is a widely used encryption standard for protecting stored data and can form part of an encrypted data architecture. The vendor should explain how encryption is applied, how keys are managed, which systems can access decrypted information, and how encrypted data moves between the assessment platform and connected systems.
Candidate data protection also depends on limiting access to people with a legitimate business need. Evaluation should cover role-based permissions, authentication controls, audit logs, administrative access procedures, and the vendor’s process for responding to a security incident. These details help establish whether sensitive records are protected in practice, not merely described as secure in product materials.
Questions for a vendor security review
- Which candidate data fields are collected, stored, and transferred?
- How is data encrypted in transit and at rest?
- Who can access candidate records, scores, and administrative controls?
- What audit trails are available for access and changes to records?
- What incident-response, backup, and recovery procedures apply to candidate data?
- Where is data stored, and how are international transfers governed where relevant?
Compliance benchmarks for automated processing and AI
Automated scoring can make recruitment more consistent, but it also raises additional data protection questions. Procurement teams should determine what inputs the system uses, what outputs it produces, whether those outputs are used to make or support decisions about candidates, and what human review remains available.
A Data Protection Impact Assessment (DPIA) is required under the GDPR where processing is likely to result in a high risk to individuals’ rights and freedoms. Automated evaluation of candidates may warrant a DPIA because employment decisions can have significant effects on applicants and assessment data may be sensitive. The DPIA should be completed before the relevant processing begins and should document the purpose, necessity, risks, safeguards, and any remaining risks.
The Information Commissioner’s Office guidance on AI-assisted recruitment states that employers considering these tools should ask key data protection questions and consider a DPIA to ensure lawful processing. This makes DPIA review a practical procurement checkpoint rather than a task to defer until after deployment.
Transparency should extend to automated processing. Vendors and employers should be able to explain, in clear terms, the categories of data used for evaluation, the role of automated scoring in the hiring process, the safeguards in place, and the points at which a person reviews or can challenge a decision. Procurement records should also identify how the organisation will monitor outcomes and address concerns about unfair or inaccurate results.
Data retention, minimization, and candidate rights
Candidate records should not be retained indefinitely because they may be useful in the future. GDPR data minimization and storage limitation principles require organisations to collect data that is relevant to the stated purpose and retain it only for an appropriate, documented period.
Assessment platforms should therefore support retention schedules that correspond to the employer’s recruitment process and legal obligations. Automated deletion or anonymisation mechanisms can reduce the risk of outdated candidate records remaining accessible after the retention period expires. Procurement teams should confirm whether deletion also applies to backups, exports, test environments, and connected systems, or whether separate processes govern those locations.
The platform should also make it practical to locate and provide a candidate’s data when a Data Subject Access Request (DSAR) is received. This may require searchable records, export functions, clear ownership of data fields, and procedures for handling correction, deletion, objection, or access requests. The employer remains responsible for responding to applicable rights requests, but a processor must provide sufficient support under the contractual arrangement.
Retention controls to evaluate
- Configurable retention periods for assessment records and scores.
- Documented deletion, anonymisation, and backup-handling procedures.
- Data exports that identify the relevant candidate record and assessment information.
- Access logs and processing records that support internal investigation.
- Clear procedures for processor assistance with candidate rights requests.
Securing the ATS integration layer
An assessment platform rarely operates alone. Candidate data may move between the assessment system and an ATS, creating additional points at which information must be protected. A secure integration review should consider what data is transferred, which system is authoritative for each record, how identities are matched, and whether the connection exposes more information than the workflow requires.
Open API integrations should use documented authentication and authorisation controls, encrypted communications, scoped permissions, and logging that helps organisations trace data transfers. The procurement team should also confirm how an integration behaves when a candidate is deleted, a retention period expires, or a DSAR requires data to be retrieved across systems. Compliance depends on the full recruitment pipeline, not solely on the security of one application.
SectorPro documents GDPR compliance, end-to-end AES-256 encryption, and an Open API for ATS integrations including Workday, Greenhouse, and Lever. These capabilities are relevant to an enterprise review, but procurement teams should still validate the specific configuration, data flows, contractual terms, and internal controls that apply to their own deployment.
For related context on enterprise use of assessment data, organisations can review predictive psychometrics in hiring for enterprise.
What procurement teams should require before approval
A defensible pre-employment assessment GDPR compliance review combines legal, security, and operational evidence. The vendor should be able to document the data it processes, the safeguards it applies, its support for candidate rights, its approach to retention, and the security of every connected system. Where automated processing presents a likely high risk, the employer should complete and maintain an appropriate DPIA before implementation.
Enterprise HR and procurement teams evaluating SectorPro can schedule a free demo to review how its documented GDPR compliance, AES-256 encryption, and Open API integrations apply to their recruitment workflow.
