CNIL – Press Release of 3 April 2026
In a press release of 3 April 2026, France’s data protection authority (CNIL) announced that recruitment will feature among its 2026 enforcement priorities. Three years after publishing its guide for recruiters, the CNIL will now actively verify GDPR compliance in this field.
Inspections will focus on the key issues identified in the guide, including automated decision-making tools used to filter or rank candidates, the information provided to candidates about how their data is processed, and retention periods applied to candidate files.
Given the volume of applications they handle and the selection processes they operate, large companies and recruitment agencies will be the priority targets.
The CNIL frames this initiative as a stepping stone for its forthcoming role as market surveillance authority for “employment” under the EU AI Regulation.
