Does GDPR apply to AI resume parsing if our company is headquartered outside the EU?

Yes. GDPR applies to any organization that processes personal data of individuals located in the EU, regardless of where the company is based. If you recruit EU-based candidates using AI parsing tools, GDPR governs that processing.

What is the maximum GDPR fine for mishandling candidate data?

The highest tier of GDPR fines reaches €20 million or 4% of global annual turnover, whichever is greater. Lesser infringements carry fines up to €10 million or 2% of global turnover.

Do candidates have the right to opt out of AI resume parsing entirely?

Under Article 22 GDPR, candidates have the right not to be subject to solely automated decisions that produce significant legal or similarly significant effects. A meaningful human review option must be operationally available - not just disclosed.

Is a DPIA always required before deploying AI resume parsing?

A DPIA is required under Article 35 GDPR when processing is likely to result in high risk to individuals' rights and freedoms. Large-scale AI-based candidate screening meets this threshold in virtually all supervisory authority guidance.

Does the EU AI Act change GDPR obligations for HR teams using AI parsing?

The EU AI Act classifies AI systems used for recruitment and candidate screening as high-risk AI, creating conformity assessments, transparency requirements, and human oversight mandates that layer on top of existing GDPR obligations - not replace them.