AI Recruiting Compliance
Who Owns Candidate Data in AI Recruiting? Contract Clauses to Check
Whoever negotiates the data clauses controls candidate data, and in most AI hiring deals nobody negotiates them. Teams adopting AI interviewing and screening tools hand over resumes, voice recordings, video and assessment scores, yet most scrutinize the product demo far more closely than the data terms.
Candidates are already uneasy. According to Gartner, only 26% of job candidates trust AI to evaluate them fairly, and 25% say they trust an employer less when it uses AI to evaluate their information. Courts are also testing who is accountable. The Mobley v. Workday litigation involves roughly 1.1 billion processed applications, and in January 2026 job applicants sued Eightfold AI over how it allegedly assembled candidate profiles.
Ownership gets settled in the contract long before it gets settled in court. This guide explains who owns candidate data in AI recruiting and which clauses to check before you sign.
Key Takeaways
- The employer is usually responsible for candidate data, even when the vendor stores and processes it, so the contract has to carry the protections
- Eight clauses decide who controls the data: license scope, model training, retention, subprocessors, security, access and audit, liability, and exit
- Training on candidate data and keeping derived scores are the two terms vendors most often leave vague
- Illinois requires deletion of AI-analyzed video interviews within 30 days of a request, so your vendor must be able to delete on demand
A signed contract does not move legal risk to the vendor, so audit rights and indemnification matter as much as the feature list
What Counts as Candidate Data in AI Recruiting?
Candidate data is far more than the resume a person uploads. An AI recruiting platform creates and collects five distinct categories, and each one needs its own ownership and usage terms.
|
Data category |
Examples |
Contract question to settle |
|
Submitted data |
Resumes, application answers, assessment responses |
Can the vendor use it outside your account? |
|
Recordings |
Interview video, voice audio, transcripts |
How long is it kept and who can access it? |
|
Derived data |
Match scores, rankings, summaries, skill tags |
Who owns the output, and can the vendor reuse it? |
|
Third-party data |
Enriched profiles, public web data, background checks |
Where does it come from and are candidates told? |
|
Usage data |
Recruiter actions, logins, device and browser details |
Can the vendor use it for analytics or product training? |
The third row is where disputes are heading. The Eightfold complaint alleges the platform compiled information beyond what applicants submitted, including social media profiles and device data. Eightfold disputes the claims and says its tool operates on data candidates intentionally share or customers provide. The allegations are unproven, but they show why “candidate data” must be defined broadly in your agreement.
Who Owns Candidate Data: The Employer, the Vendor, or the Candidate?
In law, “ownership” of candidate data is really about control and accountability, and the contract decides how those are split. No single US statute assigns candidate data to one party, so three layers apply at once.
- The employer typically acts as the business that decides why candidate data is collected and is the party regulators and plaintiffs look to first. Attorneys analyzing Mobley note that both the vendor and its business customers can be held liable.
- The vendor acts as a service provider, storing and processing data on your instructions. Anything beyond that, such as training its models on your candidates, needs to be explicitly agreed.
- The candidate keeps rights that follow the data. Illinois requires employers to obtain consent before AI analysis of a video interview and to delete the video within 30 days of an applicant’s request, including copies held by others. California’s automated decisionmaking rules take effect January 1, 2027 for covered employers and add notice, opt-out and access rights.
Retention rules can pull in opposite directions. The EEOC expects private employers to keep hiring records for one year, while Illinois sets a 30-day deletion window on request. Your vendor agreement needs to let you apply the right rule to each record, which is why the clauses below matter.
8 Contract Clauses to Check Before You Sign an AI Recruiting Vendor
Eight clauses decide who controls candidate data once the contract is signed. Review each against the vendor’s standard terms and request changes where the language is vague.
1. Data Ownership and License Scope
The agreement should say you own the candidate data you submit and every output generated from it, and that the vendor holds only a limited license to process it for your account.
Ask for: a definition of customer data that covers inputs, recordings, transcripts, scores and summaries, not just uploaded resumes.
Matters most for: teams running video or voice interviews, where recordings and transcripts pile up quickly.
2. Model Training and Derived Data
Vendors often reserve the right to use customer data to improve their product, and candidates never agreed to help train anyone’s models.
Ask for: a written default of no training on your data, or opt-in only. Separate identifiable data from de-identified aggregate statistics, and ask how derived data such as embeddings is handled when your contract ends.
Matters most for: any employer hiring in states with notice or consent rules.
3. Retention, Deletion and Backups
Unclear deletion timelines are among the most common gaps in hiring tools, and they collide with real legal deadlines.
Ask for: retention settings by data type, deletion within a window you can meet (Illinois sets 30 days on request), deletion confirmation, coverage of backups and subprocessor copies, and legal-hold support for the EEOC’s one-year record rule.
Matters most for: high-volume hiring, where recordings multiply fast.
4. Subprocessors and Cross-Border Transfers
Your candidate data often passes through speech, storage and analytics providers you never selected.
Ask for: a current subprocessor list, advance notice of changes, your obligations flowed down to each one, and named storage regions. For global hiring, add residency commitments and lawful transfer mechanisms where rules like GDPR or India’s DPDP Act apply.
Matters most for: staffing firms and enterprises recruiting across countries.
5. Security and Breach Notification
Breach exposure in the US is large. IBM’s 2025 report put the average US breach at $10.22 million and found it took 241 days on average to identify and contain a breach.
Ask for: a current SOC 2 Type II or ISO 27001 report, encryption in transit and at rest, a fixed breach-notification window, and cooperation on candidate notices.
Matters most for: anyone storing voice, video and background-check data in one platform.
6. Access Controls and Audit Rights
Recruiters, hiring managers and agencies should never share one permission level.
Ask for: role-based access, activity logs showing who viewed or exported a record, and your right to audit the vendor or receive audit evidence. Illinois limits who may see AI-analyzed video to people whose expertise is needed to evaluate the applicant.
Matters most for: organizations that give outside agencies or several business units access.
7. Liability, Indemnity and Compliance Support
Many enterprise AI contracts cap vendor liability at the previous twelve months of fees, which can be tiny next to a data incident. Counsel also advise addressing compliance representations, audit rights and indemnification for regulatory or litigation exposure.
Ask for: a higher liability cap for data breaches, indemnity for vendor-caused compliance failures, and cooperation on risk assessments and regulator inquiries.
Matters most for: high-volume employers whose decisions touch thousands of applicants.
8. Exit and Portability
Vendor lock-in turns candidate data into a hostage when you want to switch.
Ask for: export in standard formats including scores and transcripts, a defined transition period, and certified deletion after exit.
Matters most for: teams starting with a single-vendor pilot.
What Happens When Candidate Data Ownership Is Overlooked
-
Skipping the data clauses rarely causes one dramatic failure. It builds exposure that surfaces later, usually all at once.
- Candidate data can be reused to train vendor models you never approved, and that is hard to reverse after the fact
- Deletion requests miss backups and subprocessor copies, which creates compliance risk under rules like Illinois’ 30-day window
- A breach at the vendor still triggers your notification duties and lands on your employer brand
- Candidate trust erodes, since 25% of candidates trust employers less when AI evaluates their information
- Switching vendors becomes costly when scores and transcripts cannot be exported
Five Questions to Ask Every AI Recruiting Vendor Before You Sign
Five direct questions expose most data-ownership gaps in a single vendor call.
- Do you train models on our candidate data, and will you confirm the answer in the contract?
- Where is candidate data stored, and which subprocessors touch it?
- How do you delete a candidate’s data, including backups, and how fast?
- What do your liability cap and indemnity cover if candidate data is exposed?
- Can we export every record, score and transcript if we leave?
Treat any answer that arrives as marketing copy instead of contract language as a no.
How to Manage Candidate Data After You Sign
A strong contract only works if someone enforces it, and three habits separate well-run deployments from the rest.
- Name one accountable owner and map the data flows. Document what candidate data enters the platform, where it goes and who can see it, so TA, IT and legal are not each assuming another team owns it.
- Set retention by data type and test deletion. Keep recordings, transcripts and scores on separate schedules, and run a test deletion request each quarter to confirm backups and subprocessors comply.
- Review access and vendor changes on a schedule. Check permissions for recruiters, managers and agencies every quarter, and act on subprocessor or policy change notices rather than filing them.
Conclusion
Candidate data ownership in AI recruiting comes down to the contract. The employer carries most of the accountability, the vendor holds the data, and candidates keep rights that travel with their information. Defining customer data broadly, banning training by default, matching retention to legal deadlines and securing audit and exit rights puts that control back in your hands.
To see how MeritHyre AI approaches candidate data in AI interviewing, request a demo and bring the five questions above. This article is general information, not legal advice, so confirm requirements with counsel for your states.
Frequently Asked Questions
No single US law assigns it, so the contract decides. The employer typically controls the data and answers for it, the vendor processes it on your instructions, and candidates hold rights such as consent and deletion in some states.
Only if the agreement allows it, and many vendor terms reserve some right to use customer data. Ask for a written no-training default or an opt-in, and confirm how derived data is handled after termination.
The EEOC expects private employers to keep hiring records for one year, while Illinois requires deletion of AI-analyzed video within 30 days of an applicant's request. Set retention by data type and have counsel confirm how the two rules apply to you.
No. The Mobley litigation tests whether vendors can be liable as agents, but employers can face exposure too. Negotiate indemnity, audit rights and a liability cap that fits data incidents.
In this article
See it live
Watch MeritHyre AI run a full pipeline
From job post to ranked shortlist with a structured interview report — live demo on a real role.