GDPR for job applications: your rights and what to share

Application data passing into a controlled space

When you apply for a job in Germany, Austria or Switzerland, the employer becomes the controller of your personal data, and the GDPR (in German: DSGVO) sets the rules for what it may collect, why, for how long and what you can demand. This guide explains those rules from the applicant's side: which data is legitimate, what happens to your CV after a rejection, which rights you hold, how automated screening is limited and how to apply to many vacancies without handing out more than necessary.

A note on scope: the GDPR applies in the EU and, through the European Economic Area, in further countries. Switzerland has its own Federal Act on Data Protection, which is similar in structure but not identical. The examples below come mainly from German supervisory authorities.

TL;DR

Employers may process the data they need to judge your suitability (contact details, qualifications, experience), and in general should obtain it directly from you.
Keeping your application for future vacancies (a talent pool) requires your explicit, voluntary and informed consent, which you can refuse or withdraw.
You have rights to access, correction, erasure, restriction and objection, and you do not need a special form to use them.
A decision on your application may not be made solely by automated processing under Article 22 GDPR; a human must have real discretion.
When you apply widely, send only what each role needs and check who receives your documents, including any service that submits for you.

What the GDPR regulates in a job application
Which data an employer may collect
How long your application may be kept
Your rights as an applicant
Automated screening and Article 22 GDPR
Applying to many jobs without oversharing
Our perspective: privacy and automation belong together
How Appliqu fits into a data-conscious job search
Checklist before you click "send"
FAQ
Sources

What the GDPR regulates in a job application

A job application is a bundle of personal data: name, address, work history, certificates, often a photo and sometimes more. From the moment you send it, the receiving company must handle it according to the GDPR's principles. The European Commission lists seven principles: lawfulness, fairness and transparency; purpose limitation; data minimisation; storage limitation; accuracy; integrity and confidentiality; and accountability.

For an applicant, they translate into concrete expectations:

Principle	What it means for your application
Lawfulness, fairness, transparency	The employer needs a legal basis and must tell you what it does with your data (Article 13 GDPR information).
Purpose limitation	Your data is used for the selection process, not for unrelated purposes such as marketing.
Data minimisation	Only data relevant to the role is requested and used.
Storage limitation	Data is deleted once it is no longer needed for the process.
Accuracy	Wrong data can be corrected on your request.
Integrity and confidentiality	Your documents must be protected against loss and unauthorised access.
Accountability	The employer must be able to demonstrate compliance.

The Commission's description of purpose limitation is important for applicants: data collected for a specified purpose may be used further only if the new use is compatible with it. Your application for one vacancy is therefore not a free licence for the employer to use your data for anything else.

In Germany, the Federal Data Protection Act (BDSG) adds employment-specific rules, but the practical guidance from the state authorities and from professional bodies is the most useful reading for applicants.

Which data an employer may collect

The rule of thumb is: what is needed to decide whether you are suitable. The data protection association GDD states in its practical guide to data protection in the application process that employers may process applicant data required to assess suitability and to decide on employment, such as contact information, qualifications and experience.

Collection directly from you

The Hamburg Commissioner for Data Protection and Freedom of Information explains in its 11 June 2024 guidance that applicant information should normally be obtained directly from the applicant. The same document says that private social networks may not be used for background checks. Information from professional networks must still be assessed according to the purpose for which you published it, so a profile being visible does not mean every use of it is permitted.

What should stay out of the process

The guidance points to conventional, job-relevant sources such as interviews, qualifications and references. Information beyond the permissible scope of interview questions, including pregnancy, health data and political affiliation, is to be disregarded. If a form asks for such details without a clear connection to the job, you can leave the field blank or ask why it is needed.

A practical check for each form

Before you submit an application form, ask three questions:

Does this field help the employer judge my suitability for this role?
Is the field marked as optional, and if not, is it plausible that it is required?
Does the privacy notice tell me who processes the data, for what purpose and for how long?

If the answer to the third question is no, that is a transparency gap you can raise with the company before you apply.

How long your application may be kept

After a rejection, the employer needs a reason to keep your documents. In German practice, many employers keep rejected applications for a limited period of around six months, because of possible claims under the General Equal Treatment Act (AGG), and then delete them. Treat that as a common practice, not a fixed statutory deadline that applies to every case, and check the employer's own privacy notice.

Keeping your data for other vacancies is a different matter. According to the Hamburg authority's guidance on applicant data protection and recruiting, adding applicants to a talent pool requires their explicit, voluntary and transparent consent, including the purpose, the data processed and the storage duration. The English version of the guidance adds that consent is not indefinite: if an applicant does not respond to a renewal request, the data should be deleted irretrievably.

What this means for you:

Consent must be a real choice. A pre-ticked box or a sentence hidden in the terms is not enough.
You can say no. Declining the talent pool must not harm your application for the advertised role.
You can withdraw. A typical employer notice, such as the one published by HDP GmbH, says applicants may view, amend or withdraw an application at any time and that withdrawn data is deleted, subject to statutory requirements.

If you want to be considered again, a talent-pool entry can be useful. If you do not, decline it and keep a note of the date you applied, so that you can ask for deletion later.

Your rights as an applicant

The GDPR gives you the same rights as any data subject. The Federal Employment Agency describes them in its own data protection information: access, correction or completion, erasure and restriction of processing, as well as withdrawal of consent and objection. It also states that requests need no specific form and are generally handled within one month, with up to three months for complex requests.

A large German employer's applicant privacy information shows what such a notice usually lists: access, rectification, erasure, restriction, data portability, objection, withdrawal of consent and the right to complain to a supervisory authority. It also notes that consent can be withdrawn at any time with effect for the future, and that you may object, on grounds relating to your particular situation, to processing based on Article 6(1)(f) GDPR (legitimate interests).

How to make a request

Find the contact for data protection in the job advert or the privacy notice (often a data protection officer).
Write a short email naming the application (role, date, reference number if there is one) and the right you are exercising.
Ask for a copy of your data if you want access, or for deletion if you want your documents removed.
Note the date. If there is no answer within a month, send a reminder and, if needed, contact the state data protection authority responsible for the company.

A sample sentence in German-speaking contexts: "Hiermit bitte ich um Auskunft nach Art. 15 DSGVO über die zu meiner Bewerbung vom [Datum] gespeicherten Daten."

Automated screening and Article 22 GDPR

Many companies pre-sort applications with software. The GDPR does not ban that, but it restricts decisions with legal effects that are based solely on automated processing. The Hamburg authority's guidance states that a human decision-maker must have genuine discretion over the outcome, and that automated recruitment decisions with legal effects must include meaningful human involvement in the final selection.

For you as an applicant, this has three practical consequences:

A rejection that was generated entirely by a script, with no human review, is legally problematic.
You can ask the employer how automated tools are used and what information is logged about you.
Regulators enforce information and access duties around automated decisions. In 2025 the Hamburg authority imposed a fine of €492,000 on a financial company for failing to sufficiently meet information and access obligations concerning automated decisions. That case did not involve a recruitment process, but it shows that these duties are taken seriously.

The rules on automated decisions also apply to the other side of the process. If you use a service to prepare or submit applications, the same logic is a good yardstick: you should see and approve what leaves your account. Our article on reviewing every draft before it goes out goes into this in more detail, and the question of whether auto-apply is legal is covered separately.

Applying to many jobs without oversharing

The more applications you send, the more copies of your data exist. These steps reduce that footprint without lowering the quality of your applications.

Keep a lean master CV

Include contact details, work history, education and skills. Leave out information that does not help with the role: marital status, religion, a national ID number or health information. A photo is common in German CVs but not required, and you decide whether to include it.

Share extra documents only when asked

References, certificates and Arbeitszeugnisse are usually needed late in the process. Send them when the employer requests them, or after a first interview, not by default with every application.

Check how documents are transmitted

The state data protection authority in Bremen points out that the potential employer is responsible for appropriate security under Article 32 GDPR, with encryption as one possible technical and organisational measure for online applications. As an applicant, prefer a secure upload portal over an unprotected email attachment where the employer offers the choice, and avoid putting highly sensitive details in the body of an email.

Keep a simple log

For each application, record the company, the date, the channel and whether you agreed to a talent pool. When a company later contacts you, or when you want to request deletion, you will know exactly what you sent and where.

Decline optional processing

Newsletter sign-ups, talent-pool entries and sharing with group companies are typically separate choices. Tick only what you want.

Our perspective: privacy and automation belong together

At Appliqu, we read the GDPR as a design requirement, not as an obstacle. An application tailored to a role contains personal data by definition, and the person it describes should stay in control of it. That is why we separate two things that are often mixed up: preparing an application and sending it.

Our perspective: privacy and automation belong together: overview diagram

Appliqu reads the full job description with semantic analysis, not only keywords, and writes your CV and cover letter for that specific role. The editor is collaborative: you and the AI edit the same document, and every line stays editable and approved by you. You choose between the "on approval" mode, where you review each application before sending, and Autopilot, where Appliqu sends within the settings you define. Both modes rest on the same principle: your documents contain your data, so you decide how much goes where.

We also see a lesson for applicants in how the GDPR treats employers. Purpose limitation and data minimisation are good habits for anyone who applies to many positions. Send what the role needs, and nothing else. If you want to understand how regulation affects automated applications more broadly, our piece on the EU AI Act and auto-apply tools is a good next step.

Alex

How Appliqu fits into a data-conscious job search

The free Explorer plan has no time limit and lets Appliqu write 5 applications, so you can see how a tailored CV and cover letter look before you decide anything. Sending starts with Core at €29.90 per month (100 applications). Pro costs €69.90 per month (300 applications) and includes the Appliqu Job Board. Concierge costs €199.00 per month, with unlimited applications and a session with a senior consultant. Prices include 19% VAT. You can compare the plans on the Appliqu start page.

If you want to apply at volume while keeping control, our guide to supervised bulk applications in Germany explains how review steps and automation work together.

Checklist before you click "send"

Have I read the privacy notice, or at least found who is responsible and whom I can contact?
Does the form ask only for data that is relevant to the role?
Did I decline the talent pool, or accept it knowingly, with a storage period I understand?
Do I know how the documents are transmitted (portal, encrypted email, or a service acting on my behalf)?
Have I noted the date, company and channel in my application log?
Do I know whom I would write to for access or deletion?

FAQ

Does the GDPR apply to my job application if I am not an EU citizen?

Yes. The GDPR applies to the processing of personal data by employers established in the EU, and your nationality does not change that. If you apply to a company in Germany or Austria from abroad, your application falls under the same rules. For Switzerland, the Swiss data protection act applies instead, which is similar in structure.

Can I ask a company to delete my application?

Yes. You can request erasure at any time, and you can withdraw consent to a talent pool with effect for the future. Write to the data protection contact named in the privacy notice and mention the role and date of your application. The company may keep data it still needs for legal reasons, for example to defend against claims, and should tell you so.

May an employer look me up on social media?

Not freely. According to the Hamburg Commissioner's guidance, private social networks may not be used for background checks. Information from professional networks has to be judged by the purpose for which you published it. In all cases, data should normally be collected directly from you.

Can an algorithm reject me on its own?

Not as a rule. Article 22 GDPR restricts decisions with legal effects that are based solely on automated processing, and the Hamburg authority says a human must have genuine discretion over the outcome. You can ask the employer how automated tools are used in its process.

What are the seven main principles of the GDPR?

They are lawfulness, fairness and transparency; purpose limitation; data minimisation; accuracy; storage limitation; integrity and confidentiality; and accountability. For applicants, the most visible ones are minimisation (only relevant data), storage limitation (deletion after the process) and transparency (a clear privacy notice).