{
  "@type": "FAQPage",
  "mainEntity": [
    {
      "@type": "Question",
      "name": "What is the biggest GDPR risk when using AI in recruitment?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "The biggest risk is automated decision-making and profiling without proper safeguards. This includes lack of transparency, absence of human review, and potential bias in AI models. To reduce risk, carry out DPIAs and ensure explainability and clear appeal processes."
      }
    },
    {
      "@type": "Question",
      "name": "Can I rely on consent for AI-driven talent pools?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Yes, but consent must be freely given, specific, informed, and easy to withdraw. In many cases, legitimate interest may be more practical for recruitment-related processing, provided you perform a proper balancing test."
      }
    },
    {
      "@type": "Question",
      "name": "Do I need a DPA with my ATS vendor?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Yes. A Data Processing Agreement (DPA) is required whenever a third party processes candidate data on your behalf. It should clearly define the scope of processing, security measures, and use of subprocessors."
      }
    },
    {
      "@type": "Question",
      "name": "When should I perform a DPIA in AI recruitment?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "You should perform a Data Protection Impact Assessment (DPIA) when using AI for large-scale profiling, automated shortlisting, or any decision that significantly affects candidates. DPIAs should be documented and reviewed regularly."
      }
    },
    {
      "@type": "Question",
      "name": "How do I explain AI decisions to candidates?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Provide clear and concise information about how AI is used, including the data sources, decision logic, and impact on outcomes. Avoid technical jargon and always offer an option for human review."
      }
    },
    {
      "@type": "Question",
      "name": "Can I use third-party AI models in my ATS?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Yes, but ensure your vendors are GDPR-compliant. This includes signing DPAs, verifying security measures, ensuring transparency, and regularly monitoring models for bias and accuracy."
      }
    },
    {
      "@type": "Question",
      "name": "What records should I keep to demonstrate GDPR compliance?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Maintain documentation such as data maps, lawful basis records, DPIAs, consent logs, vendor agreements, audit trails, and model validation reports. These records help demonstrate accountability to regulators."
      }
    }
  ]
}