Data privacy rules govern how candidate and client information gets stored and used. GDPR is the main regulation for candidates based in the EU. Recruiting software needs to handle consent, storage limits, and deletion requests correctly. Agencies working across borders need to understand which rules apply where. Mishandling candidate data can create real legal and reputational risk.