A single recorded interview can hold a candidate’s face, voice, home, and opinions. That makes it one of the most sensitive files your hiring team will ever store. Under GDPR, every one of those recordings comes with legal duties.
This guide covers GDPR and video interviews from the employer’s side of the table. You will learn who is responsible for candidate data, which lawful basis fits, and when you need a risk assessment. We also cover AI scoring rules and what to expect from your vendor. By the end, you will have a clear action plan for screening candidates without creating hidden legal risk.
Why GDPR Applies to Every Recorded Video Interview?
Before you set up a policy, it helps to understand why regulators treat video so seriously. The answer lies in how much information one recording captures.
Recorded Interviews Are Personal Data
GDPR defines personal data as any information that identifies a living person. A video interview identifies someone in several ways at once, through their face, voice, name, and the answers they give.
That means every stage of the process counts as processing. Recording, storing, sharing, reviewing, and deleting are all regulated activities. If your recruiters can watch it, GDPR covers it.
When Video Becomes Special Category Data?
Some information gets extra protection under Article 9 of GDPR. This includes health, ethnicity, religion, and biometric data used to identify someone.
A video can reveal these details without anyone asking. A candidate might mention a disability, wear religious clothing, or have visible health conditions. Tools that analyze facial features can also cross into biometric processing. The safe approach is simple. Design questions that avoid these topics, and never let visible traits influence scoring.
Who Is Responsible for Candidate Video Data?
The employer running the hiring process is the data controller and carries primary responsibility under GDPR. The video interview vendor usually acts as a data processor, handling recordings only on the employer’s instructions. Both parties have duties, but the employer answers to candidates and regulators first.
Many employers assume the software provider handles compliance for them. It does not work that way.
Your Role as the Data Controller
As the controller, you decide why candidate video is collected and how it is used. You choose the questions, the reviewers, and the retention period.
That also makes you accountable for proving compliance. You need a documented lawful basis, a clear privacy notice, and a process for handling candidate requests. If something goes wrong, regulators look to you first. Fines under GDPR can reach 20 million euros or 4% of global annual turnover, whichever is higher.
Your Vendor’s Role as Data Processor
Your video interview platform processes data on your behalf. Article 28 requires a written Data Processing Agreement between you and that vendor.
This agreement should cover where data is hosted, who can access it, how breaches are reported, and what happens to recordings when your contract ends. It should also list any subprocessors, such as cloud hosting providers. Ask for this document before your first campaign goes live, not after.
What Lawful Basis Should Employers Use for Video Interviews?
Most employers rely on legitimate interest or steps taken before entering a contract as their lawful basis for video interviews. Consent is possible but often weak in recruitment, because candidates may feel unable to refuse. Whichever basis you choose, document it clearly and explain it in your privacy notice.
Picking the right basis early shapes how you handle everything else, from notices to deletion requests.
Why Consent Is Rarely the Best Choice?
GDPR consent must be freely given, specific, and easy to withdraw. In hiring, there is a clear power imbalance between employer and applicant.
A candidate who wants the job may tick any box you show them. Regulators question whether that consent is truly free. Consent also creates a practical problem. If a candidate withdraws it midway, you must stop processing their video immediately.
Legitimate Interest and Steps Before a Contract
Legitimate interest works well when you can show a genuine business need for video screening. For example, you may need to assess communication skills across hundreds of applicants efficiently.
You should complete a short Legitimate Interest Assessment that balances your needs against candidate privacy. Steps before a contract is another option, since interviewing is a natural step toward employment.
Do You Need a DPIA Before Using Video Interview Software?
A Data Protection Impact Assessment is required when processing is likely to create high risk for individuals. Video interviewing often meets that threshold, especially at scale or with AI scoring. Completing a DPIA before launch is the safest choice and shows regulators you assessed the risks in advance.
Think of the DPIA as a planning tool rather than paperwork.
Triggers That Make a DPIA Necessary
Certain features push video screening into high risk territory. Watch for these common triggers:
- Automated scoring or ranking of candidate responses
- Large volumes of candidates across several countries
- Any analysis of facial expressions, tone, or emotion
- Transfers of recordings outside the UK or EU
If your process includes even one of these, treat a DPIA as essential.
What a Practical DPIA Covers
A useful DPIA does not need to be long. It describes what data you collect, why you need it, and who can access it.
It then identifies risks such as unauthorized access, biased scoring, or excessive retention. For each risk, you record the safeguard you will use. Review the DPIA whenever you add new features or change vendors, so it stays accurate over time.
AI Scoring, Article 22, and the EU AI Act
AI tools can speed up screening, but they bring the strictest rules in this area. Two frameworks matter most for employers today.
Article 22 and Human Review
Article 22 of GDPR gives candidates the right not to face decisions based solely on automated processing. Rejecting someone for a job counts as a significant decision.
This means an algorithm cannot be the final word. A trained recruiter must review AI scores and have real authority to overrule them.
What the EU AI Act Adds?
The EU AI Act classifies AI systems used for recruitment and candidate evaluation as high risk. Its obligations are being phased in over several years.
High risk status brings duties around transparency, human oversight, and record keeping. It also bans emotion recognition in workplace settings, with narrow exceptions. If your platform claims to read candidate emotions, treat that as a serious red flag and raise it with your vendor right away.
How VidHirePro Supports GDPR and Video Interview Compliance?
Strong policies only work when your tools support them. VidHirePro is built so that compliance happens inside your everyday hiring workflow, not as a separate task.
Clear Candidate Notices Before Recording
Candidates see a plain language notice before any recording begins. It explains what is collected, why, and how long it will be kept.
This meets your transparency duties under Article 13 and builds trust from the first interaction.
Access Controls and Secure Storage
Recordings stay inside the platform with role based permissions, so only assigned reviewers can watch a candidate’s video.
That reduces the risk of clips being downloaded, forwarded, or viewed by people outside the hiring decision.
Retention Rules and Candidate Requests
You can set retention periods that delete recordings automatically once they are no longer needed. This keeps you aligned with storage limitation without manual cleanup.
When a candidate asks for access or deletion, you can locate their data quickly. GDPR gives you one month to respond, and a central platform makes that deadline easy to meet. If you want to see how this works in practice, our team is happy to walk you through it.
Your Next Steps Toward Compliant Video Interviews
Compliance becomes manageable once you break it into clear actions. Start with these priorities this quarter.
Audit Your Current Process
Review your privacy notice, lawful basis, and retention periods. Confirm that you have a signed Data Processing Agreement with your vendor. Check whether any part of your process needs a DPIA.
Train Your Hiring Managers
Policies fail when reviewers do not follow them. Show hiring managers how to score fairly, avoid sensitive topics, and keep recordings inside the platform.
GDPR and video interviews can work together smoothly when responsibility is clear and your tools carry part of the load. The employers who get this right gain more than legal protection. They earn candidate trust, make fairer decisions, and scale hiring without second guessing every recording.
Ready to run video interviews your candidates trust and your legal team approves? See how VidHirePro builds GDPR safeguards into every step of screening. Book your personalized demo today and start hiring faster with complete confidence.