Six GDPR-compliant AI resume extraction practices protect HR teams from fines up to €20 million by establishing lawful basis, minimizing extracted data, enforcing retention limits, and honoring candidate subject-access rights. Deploy all six before your first production AI screening run — not after.

Practice 1: What Is the Lawful Basis for AI Resume Extraction Under GDPR?

The lawful basis for processing candidate resumes is Article 6(1)(b) — processing necessary for steps prior to entering a contract (i.e., the employment contract). This basis is self-activating when a candidate applies for a role. You do not need explicit consent for processing resume data under this basis, but you must document the basis in your processing register before the first AI extraction runs. Do not use consent as your basis — it creates a withdrawal right that disrupts automated workflows.

Practice 2: How Do You Apply Data Minimization to AI Resume Extraction?

Configure your AI parser to extract only the fields required for the specific role’s scoring rubric. If a job does not require a driving license, do not extract or store that field. The OpsMap™ field-mask pattern defines extraction templates per job category — each template includes only the fields in the scoring rubric for that category. Teams using per-role field masks store significantly less candidate data without reducing screening accuracy.

Practice 3: What Retention Limit Applies to AI-Extracted Resume Data?

Extracted resume data must be deleted within 12 months of the candidate’s last active application for unsuccessful applicants, or at the end of the employment relationship for hires. Set automated deletion jobs — not manual processes — for both timelines. Make.com scheduled scenarios work well for this: run nightly, query candidate records older than the retention threshold, and delete via ATS API. Log every deletion with timestamp and record ID for compliance evidence.

See the resume parsing automation guide for additional ATS deletion workflow details.

Practice 4: How Do You Respond to a Candidate Subject Access Request (SAR)?

You have 30 days to respond to a SAR under GDPR. Build a SAR response workflow in Make.com that, on receipt of a verified request: (1) queries your ATS for all records linked to the candidate’s email, (2) exports the data to a structured PDF, (3) sends the PDF to the candidate’s verified email address, and (4) logs the response in your compliance record. Automate steps 1-4 entirely — manual SAR processes take 8-12 hours; automated ones take under 5 minutes.

Practice 5: How Do You Document AI Decision-Making for GDPR Transparency?

GDPR Article 22 restricts fully automated decisions with significant effects. Screening scores that advance or reject candidates without human review qualify as automated decisions. Mitigate Article 22 risk by ensuring a human reviews every automated rejection before it is communicated to the candidate. Document the human review step in your process map. This also satisfies the “meaningful human involvement” standard in the EU AI Act’s high-risk AI provisions that take effect in 2026.

Practice 6: How Do You Transfer AI-Extracted Resume Data Outside the EU?

If your ATS, parsing service, or Make.com data centers process data outside the EU, you need a transfer mechanism: Standard Contractual Clauses (SCCs), an adequacy decision, or Binding Corporate Rules. Greenhouse ATS operates under SCCs. Most major AI parsing vendors have SCCs in place — verify the current version against the EC’s 2021 SCC update before routing EU candidate data to non-EU servers. Document the transfer mechanism in your processing register alongside the lawful basis entry.

Expert Take

The GDPR fines making headlines are not for teams that tried and got something slightly wrong — they are for teams that deployed AI screening without any documented lawful basis, retention policy, or SAR process. The six practices above are not the full legal picture, but they are the difference between demonstrating good faith and demonstrating negligence. Get these in place before your first production AI screening run.

Key Takeaways

• Use Article 6(1)(b) — contractual necessity — as your lawful basis; avoid consent for automated screening.
• Apply per-role field masks to extract only the data the scoring rubric actually uses.
• Automate deletion at 12 months for unsuccessful candidates; log every deletion with record ID.
• Build a Make.com SAR workflow that responds in under 5 minutes with a structured data export.
• Ensure human review of every automated rejection to satisfy GDPR Article 22.
• Document SCCs for every vendor processing candidate data outside the EU.

Frequently Asked Questions

Does GDPR apply to AI resume parsing for non-EU candidates?

GDPR applies if your organization is based in the EU, if candidates are EU residents, or if the processing occurs on EU infrastructure. UK-based organizations follow UK GDPR, which mirrors the EU standard. For global hiring, applying GDPR standards to all candidates is the most defensible approach.

Can you store AI-extracted resume data in the US under GDPR?

Yes, with a valid transfer mechanism. The EU-US Data Privacy Framework (DPF), adopted in 2023, provides an adequacy decision for certified US organizations. Verify your ATS and parsing vendor are DPF-certified or covered by SCCs before routing EU candidate data to US servers.

What is the fine for an unlawful AI screening deployment under GDPR?

Up to €20 million or 4% of global annual turnover, whichever is higher, for violations of core GDPR principles — lawful basis, data minimization, retention. For most SMBs, the DPA’s enforcement focus is on demonstrated negligence — documented practices reduce both the likelihood of investigation and the severity of any finding.