Privacy notice for a recruitment agency

A recruitment agency processes the personal data of people who have applied, people it has found on job boards and professional networks who have not, referees, client contacts and the candidates it keeps on file for the next role. The privacy notice has to explain the lawful basis for each of those (which is mostly legitimate interests rather than consent), tell candidates whose data came from somewhere else where it came from, deal with the health, criminal records and equality data recruitment touches, describe the sharing with clients and the checks the conduct regulations require, and set the retention that decides whether the talent pool is lawful. The privacy notice and the cookie notice are drafted for the business, with guidance on the consent mechanism, for a fixed £595 and delivery in five working days.

Who this is for

Recruitment agencies, employment businesses, executive search firms and in-house recruiters in England and Wales, from a one-person consultancy to an agency with a database of thousands.

What matters in a recruitment agency privacy notice

Candidates, clients and the data of people who never applied

The controller's duty under Article 13 of the UK GDPR is to tell candidates what it collects, and Article 14 requires it to tell people whose data it obtained from somewhere else (a job board, a professional network, a referral, a referee) within a month or at first contact, what it holds, where it came from and why; a recruitment agency's notice therefore has to address candidates who applied, candidates the agency sourced, referees, and the client contacts whose details it holds for business development, with the notice given to sourced candidates at the first approach rather than buried on the website.

The lawful bases for sourcing, matching and introducing

Consent is the wrong basis for most recruitment processing, because it can be withdrawn and because a candidate cannot refuse it freely when they want the job; the notice should rely on the steps taken at the candidate's request before a contract under Article 6(1)(b) for a candidate who has applied, on legitimate interests under Article 6(1)(f) for sourcing, matching, keeping candidates on file and marketing roles to them, with the interest stated and the balance recorded, and on legal obligation under Article 6(1)(c) for the checks the law requires; consent is kept for the optional things (marketing by email to candidates who are not clients, which regulation 22 of the Privacy and Electronic Communications (EC Directive) Regulations 2003 governs, and the talent pool where the agency chooses to use consent for it).

The data obtained from job boards, networks and referees

The notice should name the sources (job boards, professional networking sites, the agency's own database, referrals, referees, public sources) and say what the agency does with data from each, within the terms the source permits (job boards and networks license their data on terms the agency should have read), should explain the reference process (the candidate's consent to approach referees, what referees are told, the referee's own data), and should address the candidate's right to know the source under Article 15; a candidate who asks how the agency got their details is asking a question the notice should already answer.

Special category data, criminal records and equality monitoring

Recruitment touches health data (adjustments for interviews, fitness for a role, sickness records in references), criminal records (disclosure checks where the role permits them, under Article 10 of the UK GDPR and the conditions in the Data Protection Act 2018), and equality monitoring data (ethnicity, disability, sexual orientation, collected anonymously and voluntarily under the equality of opportunity condition), and the notice should say which the agency processes, the condition under Article 9 and Schedule 1 to the Data Protection Act 2018 for each, the appropriate policy document the Act requires, and the limits (no disclosure checks where the role does not justify them, no health questions before offer beyond what section 60 of the Equality Act 2010 permits).

Sharing with clients, checks and the conduct regulations

The notice should explain that the agency shares candidate data with clients for roles the candidate is put forward for (with the client as a separate controller for what it then does), with the candidate's agreement to each introduction where the Conduct of Employment Agencies and Employment Businesses Regulations 2003 require it, that the agency carries out the identity, qualification and right to work checks the regulations and the Immigration, Asylum and Nationality Act 2006 require for employment businesses, that it shares with umbrella companies, payroll providers and referencing services as processors or controllers, and that it may share with regulators and the authorities where the law requires; the client's own notice covers what the client does after the introduction.

Retention, the talent pool and the candidate who objects

The notice should state the retention periods (candidate data for a stated period after the last contact, with the agency's reason; successful placements for the period the conduct regulations and tax law require; unsuccessful applicants for a period that reflects the discrimination claim limitation period and the agency's legitimate interest in future roles), the talent pool arrangement and how a candidate leaves it, the candidate's right to object to legitimate interests processing under Article 21 (which the agency must honour unless it shows compelling grounds), the individual's rights over their data (access, rectification, erasure, restriction, portability, objection), the process and the one-month limit, and the complaint to the Information Commissioner's Office; the business should be registered with the Information Commissioner's Office under the Data Protection (Charges and Information) Regulations 2018, which the notice can say.

What it costs

Website privacy and cookies pack, £595. Privacy notice, cookie notice and consent guidance. Five working days.

DPA and privacy terms, £795. Data processing agreement plus privacy notice. Five working days.

Buying online forms the engagement on payment. The scope is what the data protection agreements and privacy terms page describes, you accept the Terms of Service at checkout, and I email you within four working hours to get started. If you would rather ask something first, email me.

What you get

• A data processing agreement that meets the statutory requirements and can be used as a schedule to your main contract
• A privacy notice written for people to read rather than to be scrolled past
• Clear allocation of controller and processor roles, which is where most confusion starts
• International transfer provisions where you use overseas suppliers
• Sub-processor and security provisions proportionate to what you do
• A note on the operational steps the documents assume you are taking

What is not included

• Full compliance audits and data mapping exercises
• ICO registration, which you do yourself
• Breach response and regulatory correspondence
• Cyber security certification such as Cyber Essentials
• Advice on data protection law outside the UK and EU

Questions I am often asked

Do we need consent to keep candidates on file?

Not usually: legitimate interests, with the interest stated, the balance recorded and the right to object honoured, is the usual basis. Consent is used for marketing emails and for the talent pool where the agency prefers it. The notice says which the agency relies on.

We found a candidate on a professional network. Do we have to tell them we hold their data?

You do, at the first approach or within a month, with the source stated. The notice is written to be given at that point as well as on the website.

How long can we keep unsuccessful candidates' data?

For a stated period that reflects the discrimination claim window and the agency's interest in future roles, with the candidate able to object. The notice states the period; keeping everyone for ever is the practice the regulator objects to.

Related guidance and services

• Data protection agreements and privacy terms, £595, the service this page describes
• Terms and conditions drafting, £995
• SaaS and technology contracts, £995
• Job applicant privacy notice
• Privacy notice for a recruitment platform

This page is general guidance for businesses in England and Wales, not advice on your own circumstances. Last reviewed: October 2026. Email geoffrey@caesar.co.uk.