Under UK and EU GDPR, the employer is usually the data controller and a screening, ATS or assessment vendor acts as a processor. Article 28 requires a written contract covering what data is processed and why, security measures, confidentiality, use of sub-processors, international transfers, help with data subject requests, and deletion or return of data when the service ends. Many vendors supply a standard DPA that customers review and sign.
Candidate data includes CVs, interview recordings and assessment results, so the stakes are real if it is misused or breached. Before switching on a new tool, recruiting and legal teams typically check where data is stored, how long it is kept, whether it is used to train models and which sub-processors are involved. Requirements differ by jurisdiction, so specific questions are best taken to a qualified adviser.