Candidate Data Consent (GDPR)

Valid consent is a positive choice the person could have refused without penalty and can withdraw afterwards. In recruiting that means telling the applicant who is collecting the data, what will be done with it, how long it will be held, who else may see it and how to change their mind, expressed in language an ordinary reader understands rather than buried in a policy link nobody opens. Pre-ticked boxes and agreement bundled into a mandatory step are weak, because no genuine option existed. Consent also has to be recorded, including the wording displayed, the timestamp and the version of the notice in force at the time. Frameworks describe these conditions differently and enforcement varies, so treat this as the general shape and let qualified counsel confirm specifics for your markets.

Frequently it is not, which surprises teams who assume consent is the safe default. GDPR sets out several lawful bases and consent is only one of them; processing necessary to take steps at the candidate's request before entering a contract, or a properly documented legitimate interest, often fits an application better. Consent is fragile by design. It can be withdrawn at any moment, at which point the processing must stop, and the burden of proving it was ever given rests with the employer. A talent pool assembled on consent that cannot be evidenced years later is a pool you may not be able to use. Selecting a basis is a legal judgment, not a product setting, so confirm it with counsel instead of copying another company's privacy notice.

Treat the record as part of the data rather than as paperwork. Store the timestamp, the exact wording accepted, the purpose it covered and the channel it arrived through, so reusing a profile two years later becomes a decision you can defend. Reuse is where most teams slip. Someone who agreed to be considered for one role has not necessarily agreed to sit in a general pool indefinitely, and a short re-permission message before a new campaign is both safer and better received than silence. Keep withdrawal immediate and easy, including a path that genuinely stops sourcing outreach rather than only marketing email. Any candidate sourcing tool connected to the hiring system must honour the same flags, because a suppression living in one place is not a suppression.

Name an owner and define the route before the first request arrives, since the clock starts when the candidate asks rather than when the message reaches the right desk. Someone has to locate every copy: the primary record, exported spreadsheets, notes kept elsewhere, scheduling tools and anything fed by an integration. Verify identity proportionately, act, and log what was done and when. Watch for records you cannot simply erase, because some data may need to be retained to defend a legal claim or to satisfy another obligation, and the interaction between deletion rights and retention duties is precisely the question that belongs with counsel. Building this capability into talent acquisition operations early costs far less than improvising against a deadline.