Data protection obligations apply the moment you collect a candidate's answers, not just when you store their resume. An assessment platform processes personal data — names, written answers, sometimes video or audio depending on format — on your behalf, which makes your hiring team responsible for how it's handled and the platform responsible for processing it correctly. That relationship comes with specific, checkable obligations. This guide covers the ones that actually show up in how a hiring assessment gets built and run, not the parts that live entirely in a legal contract.
What compliant handling actually requires of a hiring assessment
- A documented basis for processing candidate data — usually legitimate interest or consent, decided before you collect anything.
- Data minimization: collect what the assessment needs to evaluate the candidate, not everything you could plausibly ask for.
- A defined retention period, with data actually deleted or anonymized when that period ends — not kept indefinitely because deleting it is inconvenient.
- The right to erasure: a candidate can ask to have their personal data removed, and you need a real mechanism to honor that without destroying your own hiring records.
- A record of what happened to a candidate's data and when — so if it's ever asked, you can show it, not just claim it.
Where most hiring tools quietly fall short
The right-to-erasure requirement is the one that breaks the most tooling. A candidate asks to be forgotten, and the honest answer for most systems is that you either destroy the record entirely — which wrecks your reporting and audit history — or you quietly ignore the request because deleting it properly is more work than the team has time for. Neither is compliant, and neither is a good position to be in if it's ever checked.
How this actually works on Gradogram
Candidate data can be anonymized on request: identity fields are replaced with tokens, the analytical record stays intact for your reporting, and the person is gone — that satisfies the right-to-erasure requirement without breaking your hiring history. Everything is soft-deleted by default platform-wide, so nothing is lost to a mistaken action, and material actions are written to an immutable audit trail with the actor, the change, and the timestamp. Every workspace is isolated at the infrastructure level, enforced on every database write and query, not by a per-feature check that can be forgotten.
Automation and compliance: where the line actually is
If any part of your hiring funnel automatically routes, advances, or rejects candidates, that's the part of the process worth the most scrutiny — automated decisions with a significant effect on a person carry their own restrictions in most data protection frameworks. The safest and most defensible position is the simple one: automation should handle the busywork — routing a candidate to the next step, sending a notification — while a person makes the actual call on who advances. That's a design decision, not just a compliance checkbox, and it's worth building your process around it rather than retrofitting it later.
This is also why Hiring Policy on Gradogram is built the way it is: rules route candidates and send notifications automatically as assessments are graded, but they never auto-advance or auto-reject anyone — every consequential step waits for a person, and every rule firing is logged. It's designed for human oversight over automated decisions, not to replace the decision itself.
A short practical checklist
- Write down your basis for processing and retention period before the first candidate is assessed — not after someone asks.
- Only collect what the rubric actually needs to grade against; drop optional fields that don't feed a real evaluation criterion.
- Confirm your platform can anonymize a candidate on request without destroying your own reporting — ask, don't assume.
- Keep a real audit trail of who did what and when, so a hiring decision has a record behind it if it's ever questioned.
- Never let automation make the final call — routing and notifications can be automatic, the decision can't.
None of this replaces your own legal counsel — compliance depends on how your organization configures and uses a platform, not the platform alone, so this is a practical starting point, not legal advice. But the mechanics above are the ones an assessment platform either supports or doesn't, and they're worth checking before candidate data is on the line.