An ATS export is not a training license.

Start here

Does any of this sound familiar?

• Your ATS combines candidate details, recruiter notes, client feedback, and vendor fields.
• Someone wants to use historical applicant records to train or evaluate AI.
• You need to distinguish data access from legal and contractual permission.

An ATS export does not reveal every promise governing its fields. Candidates may supply information, clients set hiring purposes, and vendors impose terms. Account access does not settle model-training rights.

Start with a purpose-and-provenance map, not an upload. Reusing vacancy data for general model development is a new purpose to assess under applicable law.

The problem

One ATS record can have several owners and purposes

A profile can combine a résumé, recruiter annotations, vendor assessment, and client notes. Candidate notices, client agreements, and vendor terms may each restrict secondary use—even when names are removed.

Rare job histories and free text can identify people. EU data protection includes purpose limitation and minimisation; the European Data Protection Board says model anonymity requires case-by-case assessment. Do not label transformed records anonymous without evidence.

An export answers what the system can produce, not what the organization may repurpose.

The solution

Use a field-level rights review, not a blanket “ATS data” label

Specify training, evaluation, or search assistance and who receives the output. “AI” alone is not a purpose.

DataSupply partners only with labs that meet its top 0.01% credibility standard. We help assess whether a qualified buyer may be a fit and negotiate terms that reflect the data's potential value, including exclusivity where relevant. We also help you work through diligence questions about rights, privacy, security, and compliance, then present a high-level inventory of permitted records, not the dataset. Fit is specific to each situation; no buyer or value is guaranteed.

What to inventory before any buyer conversation

• Create a source and purpose register For each field, record source, collection purpose, retention period, system, and client or candidate restrictions. Separately flag notes, assessments, identities, and imported profile content.
• Compare the proposed use with commitments Review candidate notices and legal-basis records, client agreements, ATS and assessment terms, and deletion schedules. Ask counsel if the new purpose requires a different basis, notice, permission, or exclusion.
• Write a disposition before any transfer For each category, record whether to authorize, retain internally, transform and test, or exclude. Specify recipients, location, access, retention, deletion, derivatives, incident notice, and audit evidence; retain reviewer, date, and rationale.

Set the boundaries before discussing access.

Counsel should assess candidate rights, legal basis, notices, requests, transfers, and retention; security should verify encryption, limited access, subprocessors, and deletion. Client approval cannot replace candidate rights.

What could make a permitted example useful?

Clear origins help review, but cleaning and secure delivery take effort. Rights may prevent licensing; volume alone creates no automatic value.

A practical first step.

Create an inventory of field names, sources, purposes, and governing documents only. Do not copy applicant content.

datasupply.ai can discuss possible fit and buyer questions without receiving your dataset. You decide whether to pursue any introduction. No buyer, license, or payment is guaranteed.

Documented example / what it proves

The EDPB describes why AI training data needs a case-by-case privacy review

In Opinion 28/2024, the European Data Protection Board says legitimate interest for AI model development or use requires a three-step assessment: identify the interest, test necessity, and balance people’s rights. Model anonymity claims also require case-by-case assessment; training on personal data does not make a model automatically anonymous. Read European Data Protection Board.

For ATS data, assess the original recruitment purpose, legal basis, and whether outputs may still relate to people. The opinion does not replace local advice or contract review.

The important limit: The opinion explains AI data-protection analysis, not ATS licensing rights, buyer demand, or a completed data transaction.