Recruitment glossary

An ATS (applicant tracking system) is recruitment software that centralises job openings, applications and the tracking of each stage, from the hiring request through to onboarding of the person hired. It differs from an HRIS, which covers all HR processes such as payroll or training, although some HRIS include a recruitment module. According to an Apec study published in 2017 using 2016 data, adoption rises sharply with company size, from 13% of organisations with fewer than 100 employees to 68% of those with more than 5,000.

The controller is the person or organisation that determines the purposes and essential means of processing personal data, in other words who decides why and how the data is used. In recruitment, this is usually the employer or the recruitment agency deciding how applications are collected and kept, even when it relies on software supplied by a vendor. The role follows from the facts rather than from the contract, and the CNIL advises documenting the reasoning behind it.

A DPIA is an assessment that the controller must carry out before starting any processing likely to result in a high risk to people's rights and freedoms (Article 35 GDPR). It describes the processing, checks that it is necessary and proportionate, and then assesses the risks and the measures planned to reduce them. According to the CNIL, a DPIA is generally required when processing meets at least two of the nine criteria set out in the European guidelines, which include evaluating or scoring individuals, combining datasets and using innovative technology.

Under Article 3 of the European regulation on artificial intelligence (AI Act), a deployer is any person or organisation using an AI system under its own authority in a professional context. A company using an AI tool to sort or assess job applications is therefore the deployer, while the company that makes the tool is the provider. For a high-risk system, Article 26 requires the deployer in particular to assign human oversight to competent staff, to inform the people affected by decisions and, where it is an employer, to inform workers' representatives and the workers concerned.

The General Data Protection Regulation (Regulation (EU) 2016/679) has governed the use of personal data since 25 May 2018 by organisations established in the European Union, and in some cases by organisations based outside it. In recruitment, it applies from the moment a CV is received, and then to interview notes and to the retention of applications. In France, compliance is overseen by the CNIL, the national data protection authority, which can impose sanctions.

A high-risk AI system is one that the AI Act subjects to stricter requirements because it can affect people's health, safety or fundamental rights. Annex III of the regulation includes tools intended for recruitment or selection, in particular those used to place targeted job ads, analyse and filter applications, or evaluate candidates. Since the AI Omnibus (Regulation (EU) 2026/1744) entered into force on 27 July 2026, the obligations for these systems apply from 2 December 2027.

An interview scorecard is a document listing the criteria to assess in a candidate, such as technical skills, soft skills or motivation, with a rating scale shared by everyone recruiting for the same role. It makes it possible to compare applications on the same basis and to keep a record of why the final choice was made. France's Defender of Rights lists the interview grid among the measures that strengthen equal treatment between candidates, and asks that the criteria used be neutral and relevant to their purpose.

The legal basis is the ground in law that allows an organisation to process personal data. Article 6 GDPR provides six of them (consent, contract, legal obligation, public task, legitimate interest and vital interests), and only one may be chosen for each purpose, before processing begins. The choice has consequences, because it determines which rights individuals can exercise, such as the right to object or the right to data portability.

Legitimate interest is one of the six legal bases set out in Article 6 GDPR. It allows an organisation to process data without collecting consent, provided that its interest is legitimate, that the processing is necessary to pursue it, and that it does not override people's rights given their reasonable expectations. The CNIL requires this balancing test to be carried out for each processing operation, and data subjects keep the right to object to the processing of their data.

A processor is an organisation that processes personal data on behalf of a controller and on its documented instructions, for example a hosting provider or an online software tool that stores applications. Article 28 GDPR requires a written contract setting out the subject matter, duration and purpose of the processing and the provider's obligations, including confidentiality, security, assistance with data subject requests, and deletion or return of the data when the contract ends. A processor may not engage another processor without the client's prior specific or general written authorisation.

The recruitment funnel conversion rate measures the share of candidates who move from one hiring stage to the next, for example from application to interview, from interview to offer, and from offer to acceptance. It is calculated by dividing the number of candidates who reach the next stage by the number who entered the current one. Read stage by stage, and ideally by candidate source, it shows where the process loses candidates and makes it possible to fix one stage without overhauling the whole recruitment process.

The retention period is the length of time an organisation may keep personal data, set according to the purpose of the processing (Article 5 GDPR). For an unsuccessful candidate kept in a talent pool, the CNIL recommends no more than two years from the last contact, unless the candidate objects. Its human resources reference framework, published in April 2026, also provides for five years of intermediate archiving from the date the position was filled, as evidence in case of a discrimination claim.

The right of access (Article 15 GDPR) allows anyone to find out whether an organisation holds data about them and to obtain a copy, whatever medium it is stored on. A candidate can therefore request the information used during their recruitment process without giving a reason. The organisation must reply within one month, which can be extended by two further months depending on the complexity and number of requests, provided the person is told within the first month.

A silver medalist is a highly qualified candidate who reached the final stage of a hiring process but was not selected. They have already been assessed and have shown interest in the company, which makes them a priority to contact again when a similar role opens. For that to work, they need to be tagged as such in the talent pool at the moment of rejection and given a good candidate experience, otherwise they may not respond later.

According to Apec, sourcing covers everything a company does to find candidates, from defining the need to identifying and directly approaching people who would never have applied without that effort. It combines several channels, such as job postings, professional social networks, employee referrals, CV databases and the talent pool. A recruiter quoted by Apec notes that recruiters increasingly try to attract people who are not looking for a job, because the strongest candidates respond less and less to job ads.

A structured interview is a job interview run from a common script, with the same questions put to every candidate and assessment criteria set before the interviews, based on the skills the role requires. France's Defender of Rights recommends using interview grids so that every candidate is asked the same questions, in order to ensure equal treatment and to be able to justify the decision if discrimination is alleged. The method usually relies on written reports, which make the process traceable.

A talent pool is the set of profiles a recruiter keeps in order to contact them again for future roles, such as past unsuccessful candidates, former interns or speculative applications held in reserve. According to Apec's Sourcing cadres survey, 37% of recruiters drew on their talent pool for their most recent executive hire in 2017, and Apec notes that a pool must be kept up to date to remain useful. The CNIL recommends keeping a profile for no more than two years after the last contact and informing the candidate.

Time to hire measures the number of days between the moment the candidate who is eventually hired enters the process (their application or first contact) and their acceptance of the offer. It differs from time to fill, which starts when the position is opened and therefore measures the full length of the recruitment. Tracked by role or by candidate source, it helps identify the stages where candidates are left waiting too long.