ATS and GDPR: the points many vendors miss
> TL;DR: The most frequent misses in recruiting software: retention, recruiter access, attachments, and candidate-data circulation.
ATS security is not only about retention
Most GDPR discussions around ATS products focus on retention. That matters, but it is not the only issue.
For more — see our our HR tech security offer.
What is usually missed
Teams often overlook overbroad recruiter access, attachments that are too easy to retrieve, internal notes that are not segmented enough, and candidate data replicated across too many third-party tools.
For HR & Payroll vendors
CleanIssue specializes in security reviews for HR, payroll, and recruiting software. If you're building an HRIS, payroll tool, or ATS and want an external review of your exposure before a client audit or security questionnaire, see our offer for HR & Payroll vendors.
Key Takeaways
Building HR, payroll, or recruiting software? CleanIssue performs security audits for HR SaaS in real-world conditions, no source code access needed. For a first read of your exposure, start with an external review of your application.
Go further
Related articles
Three adjacent analyses to keep exploring the same attack surface.
GDPR and recruiting software: what the CNIL really looks at in 2026
The most concrete points for an ATS or recruiting software: candidate data, recruiter access, retention, and visible security posture.
GDPR employee data export: what the access request reveals about your product
An employee requesting their GDPR data tests your access control without knowing. Four common traps for HR vendors.
Candidate onboarding and GDPR: common product mistakes
Candidate journeys often suffer from the same issues: excessive collection, weak attachment protection, and more visibility than intended.
Sources
Editorial analysis based on official vendor, project, and regulator documentation.
Related services
If this topic maps to a real risk in your stack, these are the most relevant CleanIssue audits.