GDPR bans AI interviews — true or false?

The regulation contains no article specifically banning AI in hiring. It governs personal data processing regardless of tool — ATS, paper form, or voice AI.

The issue is implementation quality: candidate information, DPA with the vendor, updated processing register, and realistic retention policy.

Blanket refusal for GDPR reasons without documented analysis paradoxically leaves informal, less traceable processes in place.

For pre-screening in a recruitment process, the most common basis is Article 6.1.b — steps at the applicant's request prior to a contract. The candidate applies or accepts the invitation: they ask to be assessed for a role.

Legitimate interest (6.1.f) may apply in some internal or mobility contexts but is harder to justify in external hiring. Avoid consent (6.1.a) as the primary basis: it must be freely given, and candidates cannot be forced to accept under threat of elimination.

Document the chosen basis in your register and candidate privacy notice.

Before the candidate starts, they must receive Article 13 mandatory information — ideally in the invitation email and on the interview landing page.

• Controller identity and DPO contact.
• Purposes: pre-screening for role X, job ref.
• Legal basis: Art. 6.1.b GDPR.
• Recipients: HR, hiring manager, processor HiLucy (EU hosting if applicable).
• Retention: e.g. 6 months after process closure.
• Rights: access, rectification, erasure, restriction, objection, CNIL complaint.
• Automated evaluation existence and logic used (see Art. 22).

Article 22 restricts decisions based solely on automated processing with legal or similarly significant effects — except contractual necessity, member-state law, or explicit consent.

AI interviews producing summaries and scores for human review are generally not purely automated decisions: recruiters read, can override scores, and decide. That is decision support.

Legal risk appears if you configure automatic rejection below a threshold without human review — prohibit that contractually and in ATS settings.

Recommended retention: 6–12 months after the recruitment process ends for recordings and transcripts, unless legal hold or dispute. Beyond that, delete or anonymize.

Your AI vendor DPA must cover: subject and duration, data nature, documented instructions, DPIA assistance, breach notification, sub-processors, end-of-contract data return or deletion.

A DPIA is recommended — and often required — for high-risk processing: systematic large-scale candidate evaluation, potential sensitive data, or significant access-to-employment decisions.

A template entry your DPO can adapt:

Processing name: AI voice pre-screening interviews (HiLucy). Purpose: assess candidate fit against job criteria before manager interview. Legal basis: Art. 6.1.b GDPR. Data categories: identity, contact details, audio, transcript, criteria-based evaluation. Data subjects: external applicants. Recipients: HR team, hiring manager, HiLucy (processor). Retention: 6 months post-process. Security measures: encryption in transit and at rest, restricted access, logs. Transfers outside EU: none / or documented mechanism if applicable.