Data Protection Impact Assessment template

How to use this

Screening job applicants with AI assistance is the kind of processing for which Article 35 GDPR requires the controller (the employer) to carry out a data protection impact assessment before starting: it evaluates people, at scale, using new technology, in a way that affects whether they get a job. This is not optional, and it is not something the software vendor can do for you.

What FTM Ventures OÜ can do, and this document is, is fill in everything that depends on how Relevnt works, so that what remains is the part only you know: who at your company does what, how many people apply, and what you have told them. Paragraphs marked [Customer to complete] are yours. Everything else is pre-filled and accurate for Relevnt as of the date above; when the service changes materially, this template is updated and the change is noted in the Data Processing Agreement.

Once completed, keep it with your other data protection records. If your assessment finds a high residual risk you cannot mitigate, Article 36 requires you to consult the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon) before you start.

1. Description of the processing

Purpose: assessing job applicants against the requirements of a specific vacancy, to decide whom to interview and, ultimately, whom to hire.

Nature: CVs and cover letters are uploaded by the employer or received through a careers page. The text is extracted and sent to a large language model (Anthropic, via API) together with the role requirements the employer wrote. The model returns a written assessment and a numerical score. Employers read the assessment, add their own notes and verdicts, message candidates, and schedule interviews. Nothing is decided by the system.

Scope: [Customer to complete] expected number of applicants per year, number of roles, whether candidates are mainly in Estonia or elsewhere, and which of your staff will use the service.

Context: candidates apply expecting a human to read their application. Some will not expect AI to be involved. Candidates are in a weak position relative to an employer and cannot realistically refuse the processing while still applying.

Data: name, contact details, employment and education history, skills, the free text of a CV and cover letter, and whatever else the candidate chose to include. Special category data is not requested but may be volunteered (a photograph, a health condition, a trade union role). Retention: [Customer to complete] the retention period you have set in Relevnt, and why. Relevnt deletes candidates automatically after that period.

Parties: you are the controller. FTM Ventures OÜ (registry code 17592430) is the processor under the Data Processing Agreement. Sub-processors are Supabase (EU, database and file storage), Vercel (hosting), Anthropic (AI evaluation, US, under Standard Contractual Clauses) and Resend (email, EU).

2. Necessity and proportionality

Lawful basis: [Customer to complete]. For most employers this is Article 6(1)(b), steps at the request of the data subject prior to entering into a contract, for the application itself, and Article 6(1)(f), legitimate interests, for the AI-assisted evaluation. If you rely on legitimate interests, record your balancing test here. Consent is a poor basis: a candidate cannot freely refuse.

Purpose limitation: the data is used only to assess the candidate for the role applied for, and, if you use the candidate pool, for later roles you consider them for. It is not used by the processor for any purpose of its own and is not used to train models.

Data minimisation: the service processes what the candidate submitted; it does not enrich it from other sources or search the web for the candidate. Employers should not ask for more in an application form than the role needs.

Accuracy: the evaluation is generated text and can be wrong. It is presented as a recommendation with its reasoning visible, so a reviewer can check it against the CV. Candidates can correct their data by contacting you.

Transparency: [Customer to complete] where and how you tell candidates that AI assists your screening, that a person makes the decision, how long you keep their data, and how to contact you. Relevnt's careers page carries this notice; if you collect applications elsewhere, your own notice must.

Automated decision-making: the service does not make decisions. Every advance, rejection and interview is a human action recorded against a named user. To stay outside Article 22, the person reviewing must have real authority and must actually look. A rule such as 'we interview everyone above 70 and reject everyone below 40 without reading further' would turn the score into a solely automated decision. [Customer to complete] Describe your review practice.

Data subject rights: access, rectification, erasure and export are available to you directly in the product, and through you to the candidate. Objection to the AI evaluation should be honoured by evaluating that candidate manually. [Customer to complete] Who handles requests and within what time.

3. Risks to candidates

Unfair or biased assessment. A language model may weight irrelevant features (a gap in employment, a foreign-sounding name, an unusual career path) in ways that disadvantage particular groups. Likelihood: possible. Severity: significant, since it can cost someone a job. This is the principal risk of the processing.

Over-reliance on the score. A busy reviewer treats the number as the decision. Likelihood: likely without a process to prevent it. Severity: significant, and it also converts the processing into an Article 22 decision.

Loss of confidentiality. CVs contain addresses, dates of birth and employment histories; a breach exposes them. Likelihood: low, given the measures below. Severity: significant.

Excessive retention. Applications kept indefinitely 'in case'. Likelihood: likely without an automatic rule. Severity: moderate.

Processing of special category data the employer had no basis for. A candidate mentions a disability in a cover letter and it is stored and evaluated. Likelihood: possible. Severity: significant.

Candidate unaware of AI involvement. Likelihood: possible where the employer's own notice is missing. Severity: moderate, and a breach of Article 13 and of AI Act Article 50.

Transfer to a third country. Evaluation happens on Anthropic's infrastructure in the United States. Likelihood of misuse: low, given the contractual no-training commitment and Standard Contractual Clauses. Severity: moderate.

4. Measures that address the risks

Against bias: the evaluation reasons only from the role requirements the employer wrote, and shows its reasoning so a reviewer can see what drove the score. The employer should write requirements about the job, not the person, and should periodically compare outcomes across groups. [Customer to complete] How and how often. Any candidate may be re-evaluated manually.

Against over-reliance: the score is labelled a recommendation; advancing or rejecting requires a deliberate click by a named user, which is recorded; the reviewer can read the full CV in the product. [Customer to complete] Your written rule that no candidate is rejected on the score alone, and who checks that it is followed.

Against loss of confidentiality: organisation-level isolation enforced in the database; encryption in transit and at rest; private file storage with expiring links; invite codes that rotate; secrets outside the codebase; a written incident procedure; breach notification to you within 72 hours of confirmation. Details are in Annex 2 of the Data Processing Agreement.

Against excessive retention: a retention period set in the product deletes candidates automatically. [Customer to complete] The period and its justification.

Against unwanted special category data: application forms do not ask for it; the employer's notice should ask candidates not to include it; where it appears, the reviewer should disregard it and the employer should consider deleting it. [Customer to complete].

Against lack of transparency: the Relevnt careers page tells candidates that AI assists screening and a person decides. [Customer to complete] The notice you use elsewhere.

Against transfer risk: Standard Contractual Clauses with Anthropic; contractual commitment that data is not used for training; only the CV text and role requirements are sent, not the employer's notes or the candidate's file.

5. Conclusion and sign-off

Residual risk after the measures above: [Customer to complete; typically 'low to moderate' where the review practice in section 2 is real and followed; 'high' if the score is used as a cut-off without human review, in which case consult the Data Protection Inspectorate before starting].

Consultation: [Customer to complete] whether you consulted your data protection officer, if you have one, and whether you sought the views of candidates or their representatives (Article 35(9)). Both are optional for most SMEs; record the decision either way.

Assessed by: [name, role, date]. Approved by: [name, role, date]. Review date: one year from approval, or sooner if the processing changes.