An interview transcript in your ATS should usually not flow back in full. The applicant tracking system should receive a purpose-limited structured summary, criterion-level assessments, necessary process metadata and the documented human decision; the full text, recording and technical raw data should remain separate, tightly permissioned and deletable.

That is data minimisation in practice. An ATS is the system of record for a recruiting workflow, not a complete archive of every moment in a conversation. Designing that separation early reduces unnecessary access and makes it easier to explain how a selection decision was made.

Interview transcript ATS: what data is actually created?

An AI-led first interview produces more than text. A transcript is a machine-readable rendering of the conversation, often with speaker labels and timestamps. It can contain errors or omissions, yet still hold a large amount of personal information.

A structured summary condenses only information relevant to the role. A criterion assessment connects an answer to a predefined job requirement, such as availability, experience or a job-specific approach. Metadata includes the candidate and requisition IDs, interview time and language, interview status, the question and scoring rubric, and the version of the system used.

That distinction matters especially for AI interviews and voice recruiting. The purpose of a conversation is to gather useful context, not to create a second unstructured applicant database beside the ATS.

What belongs in the ATS, and what does not?

Use one practical test for every field: does an authorised person need this information to move the current selection process forward fairly, consistently and accountably? If the answer is no, keep it outside the ATS or do not retain it at all.

• Send to the ATS: the candidate and role reference, interview status, structured summary, assessment against predefined criteria, rubric and version used, a flag for required human review, and the actual decision with owner and timestamp.
• Keep separate and restricted: the full transcript or recording where it is genuinely needed for quality assurance, a justified follow-up or resolution of a specific challenge. In most cases, the ATS needs a protected reference rather than a copied file.
• Do not send back: technical debug logs, internal prompt content, irrelevant conversation passages, personality or emotion inferences, and information not required for the role. Candidates may also disclose health, origin, religion or other private details incidentally.

This distinction also improves process quality. A criterion with no defined meaning is not a dependable assessment. A short rationale tied to an answer is more useful than a stand-alone score. Apply the same rule to results from AI-supported CV screening: move relevant evidence into the process, not every piece of raw information into the candidate record.

Why a full transcript rarely belongs in the ATS

A full transcript can feel complete, but it is too broad for most downstream decisions. It expands the group that can read personal, ambiguous or irrelevant statements. It can also remain visible long after the vacancy or the specific decision reason has ceased to matter.

A structured summary is usually the better working record. It makes criteria comparable, supports a quick human review and limits data volume. It must not pretend to be certain, however. Recruiters need an appropriate route back to the source when an assessment is unusual or a candidate raises a concern.

A useful return-flow rule is this: the ATS record should show which criterion was examined, what relevant evidence supported the assessment and who made the decision. If that is possible, the ATS normally does not need a complete interview transcript. If it is not, the gap is usually in the assessment design, not in the amount of text retained.

Retention and deletion must be designed together

Do not give transcripts, summaries, assessments and recordings one blanket retention period. For each data type, define the purpose, legal basis, access group, storage location, deletion event and accountable owner. The actual period requires your organisation's privacy review and may depend on the end of the process, a justified retention need or an effective withdrawal.

The technical chain is essential. When a candidate record is deleted or anonymised in the ATS, that event must reach the linked transcript repository and any recording store. A link that still opens raw data after deletion is not a functioning deletion process.

A separate candidate portal can provide candidates with a clearer, separate view of their data. It does not replace a deletion rule or the decision about which fields are necessary in the ATS.

Team permissions: role before curiosity

The hiring team does not automatically need access to the full text. A role-based model works better: hiring managers see the approved summary and role-relevant criteria; recruiters manage the workflow; a narrowly defined group can inspect raw material only for a documented reason. Access to transcripts should be logged and reviewed.

Edit rights matter too. It should be clear who may change a criterion assessment or summary. Otherwise, it becomes difficult to distinguish what the system produced, what a person corrected and what the final decision relied on.

Traceability for the EU AI Act and GDPR Article 22

The legal classification depends on the intended use. AI systems intended for recruiting, selecting or evaluating candidates can fall within the high-risk rules in Annex III of the EU AI Act in the Official Journal. Confirming that classification requires a legal and organisational assessment before deployment; it should not be inferred from a product label alone.

Traceability does not require retaining every candidate detail. It requires a reliable decision chain: the questions and rubric, system and model version, generated assessment, human review, any correction or override, and the final decision. For high-risk systems, the EU AI Act requires technical capabilities for automatic event logging; under Article 26(6), logs automatically generated while under a deployer's control are generally retained for at least six months, unless Union or national law provides otherwise. Legal position stated in this article: 20 August 2026.

Article 22 of the GDPR in the Official Journal restricts solely automated decisions that produce legal or similarly significant effects. A person making a final click is not, by itself, a governance design. Human oversight should enable a qualified person to understand the information, challenge an assessment and genuinely change the outcome; Article 14 of the EU AI Act likewise addresses effective human oversight for high-risk systems.

Technical ways to return interview data

There are several sound patterns. A direct ATS integration can write clearly defined fields such as interview status, summary, criteria and review status. An API or webhook can send a structured event after the interview ends. In older stacks, a controlled import can work, but it needs fixed field mappings, unique IDs, error logs and retry behaviour that does not create duplicate records.

A reference model is often safer for raw material: the ATS stores a protected link to a separate repository with its own permission check. The transfer method matters less than its meaning. A status must not be mistaken for a rejection, a score must not appear without its rubric, and a deleted application must not remain available in the source system.

When assessing options in categories such as AI interview and voice tools, evaluate data return and deletion capability alongside the candidate experience.

What to require from a provider

• A data map: which fields are generated, where transcripts and recordings are stored, which subprocessors handle them and which hosting options are available.
• A controllable integration: documented field mappings, unique IDs, a test environment, error and change logs, plus a verifiable deletion interface.
• An accountable assessment: versioned questions, rubrics and system changes, with a clear distinction between AI output, human edits and the final decision.
• Access and export controls: role permissions, access logs, restricted raw-data access and exportable records for privacy requests or a provider change.

With Atlas Apply, results can flow back into an ATS; common ATS are connected and further integrations are available on request. Still, confirm the actual fields, deletion events and permissions for your specific ATS. A connection alone does not establish data minimisation.

An explicit limitation

A structured summary can lose tone, uncertainty or an important nuance, and a transcript can contain errors. No data model makes a poorly designed question, an unsuitable rubric or a rushed human decision fair. Disputed cases therefore need a defined, limited path to inspect source material and a person accountable for the decision.

FAQ

Is candidate consent enough to store the full transcript in the ATS?

No. Consent does not remove the need to assess necessity. Even with consent, limit the purpose, access, location and deletion of the data. A structured summary is usually sufficient for day-to-day selection work.

Should an AI score enter the ATS without an explanation?

No. A score without a criterion, rubric and reviewable evidence is difficult for a team to use and for an affected person to understand. Store at least the criterion's meaning and the status of human review.

Who should be able to read the full transcript?

Only people with a documented, role-based reason, such as quality assurance or resolution of a specific assessment issue. It should not be open to the entire interview panel, and it should cease to be accessible when the reason ends.

What happens when a candidate withdraws?

The withdrawal should trigger a defined process across the ATS, transcript repository, recording store and integration logs. Your privacy review determines whether limited information may or must remain for a lawful period. The key is that no uncontrolled copy is left behind.

Can an ATS export solve the compliance question?

No. An export moves data, not a sound selection rule. Compliance depends on the combination of minimised fields, an explainable assessment, human oversight, permissions and technically effective deletion.