Short answer: A volume of 20 applications a month is technically very easy to handle with free applicant tracking software, but the legal risk comes from your data retention and deletion workflows not the tool itself. In Germany, to defend against potential AGG claims, data is generally kept for a maximum of 6 months after a rejection; most free tools lack automated deletion features and don't provide EU-standard data processing agreements.
The first thing you need to verify when picking a free tool is whether the vendor will sign a data processing agreement (AVV). Their servers must be located within the EU, and the system must not transfer data to third parties. If their free tier doesn't include an AVV or moves data to third countries, rule that tool out immediately.
The second critical factor is automated data deletion. 20 applications might not seem like much, but that's 240 candidates' personal data every year. Once you send a rejection, you cannot keep their data without their explicit consent. Free plans rarely include auto-anonymization or scheduled deletion after 180 days; that leaves you manually tracking and deleting profiles, and a single forgotten record can trigger fines if someone files a complaint.
If your budget is tight, you have two options: either go with an EU-based free provider that signs an AVV and tie your deletion schedules to a strict internal audit calendar, or budget 30-50 EUR a month for an entry-level tier that handles basic compliance automation out of the box.