Harper James advises UK employers on recruitment data protection under the laws of England and Wales, including UK GDPR compliance, employment processes and supplier contracts. Recruitment teams must treat candidate information as personal data from the first application through to deletion.
Start by mapping the information collected, who can access it and where it is stored. Identify a lawful basis for each purpose, such as managing an application, meeting a legal obligation or pursuing a legitimate interest. Give candidates a concise privacy notice covering the employer’s identity, purposes, retention periods, rights, recruitment platforms and any international transfers.
Employers should also separate ordinary recruitment data from special category data, including health information, ethnic background and disability data. Collect the latter only where a specific legal condition applies, restrict access and avoid asking for sensitive information earlier than necessary. A practical review of recruitment privacy compliance can help identify gaps in notices, retention schedules and supplier arrangements.
Applicant tracking systems, psychometric testing providers and AI screening tools generally process data on the employer’s behalf. Put a UK GDPR-compliant data processing agreement in place, check sub-processors and locations, and confirm how the supplier handles deletion, security incidents and candidate rights. Conduct a Data Protection Impact Assessment before introducing monitoring, profiling or automated assessment at scale.
Human oversight must be meaningful rather than a rubber stamp. Recruitment teams should test for discriminatory outcomes, document selection criteria and provide a route for candidates to challenge an automated assessment. The Data (Use and Access) Act 2025 also means employers should track changes to the UK data protection framework as its provisions take effect, particularly where automated decision-making and accountability processes are concerned.
Set separate retention periods for successful applicants, unsuccessful candidates, talent pools and vetting records. Do not keep applications indefinitely because a future vacancy is possible. Record the reason for each period, remove expired data securely and ensure backups follow the same policy where practicable.
Candidates can exercise rights including access, rectification and, in suitable circumstances, erasure or objection. Train hiring managers not to store recruitment information in personal email accounts or informal messaging channels. A quarterly check of access permissions, supplier security, retention logs and subject access request procedures gives HR a workable control framework and creates evidence of accountability.