Privacy notice for a recruitment platform

A recruitment platform sits between candidates who upload profiles and applications and employers who search, shortlist and contact them, with the platform controlling the candidate data on its own account, processing it for employers, and often ranking or matching candidates by algorithm. The privacy notice has to explain which role the platform plays for each set of users, what employers see and what they may do with it, how the matching works and what rights the candidate has against an automated decision, where data from other sources comes in, and what happens to the profiles nobody has touched for years. A fixed £595 covers the privacy notice, the cookie notice and guidance on the consent mechanism, drafted for the business and delivered in five working days.

Who this is for

Job boards, niche recruitment marketplaces, applicant tracking and hiring platforms, freelance marketplaces and recruitment technology businesses in England and Wales.

What matters in a recruitment platform privacy notice

Candidates and employers as two sets of users and the controller for each

Under Article 13 of the UK GDPR the business, being the controller, has to tell each set of users what it does with their data, and a platform's notice should address candidates (profiles, CVs, applications, messages, activity) and employer users (the recruiters' own account and contact data, their searches and messages) separately, stating that the platform is the controller of the candidate's profile and account data for the platform's own purposes (operating the service, matching, communications, analytics), the processor of application data submitted to a particular employer where the employer decides what happens to it, and the controller of the employer users' own data; a platform that describes itself as a neutral intermediary has not told candidates that it decides how their profiles are used.

Profiles, applications and the data employers see

The notice should state what a candidate's profile contains and who can see each part (public, visible to registered employers, visible only to employers the candidate applies to, hidden), what an employer receives when a candidate applies (the application and the profile, as the platform's settings provide), what the employer may do with it (consider the candidate for the role, within the platform's employer terms, as a separate controller), whether employers can search and download CVs and what limits apply, and how a candidate controls visibility (hiding the profile from named employers, including their current one); candidates assume their current employer cannot see them, and the notice should say whether that is true.

Matching, ranking and automated decisions

Where the platform ranks candidates, scores applications, suggests matches or filters by criteria, the notice must under Article 13(2)(f) of the UK GDPR give meaningful information about the logic involved and the significance and consequences for the candidate, and where a decision with legal or similarly significant effects (rejection from a role) is taken solely by automated means, Article 22 applies as amended by the Data (Use and Access) Act 2025, which permits such decisions outside special category data with safeguards (information, the right to make representations, human intervention, the right to contest), and the notice should explain whether the platform's tools decide or recommend, what the employer does with the output, and the candidate's rights; a platform that cannot explain its ranking to candidates should not be using it on them.

Employers as separate controllers and the platform's processor role

The notice should explain that an employer who receives a candidate's application or views their profile is a separate controller for what it then does, bound by its own notice and by the platform's employer terms (which should require employers to use candidate data only for the recruitment the platform provides, to delete it when the recruitment ends, and not to contact candidates for other purposes), that the platform processes application data on the employer's behalf under those terms, and that complaints about an employer's use of data are the employer's to answer, with the platform able to suspend employers who breach the terms; the platform's employer terms and its data processing terms are separate documents the notice refers to.

Data from scraping, integrations and other platforms

Where the platform imports profiles from other sources (professional networks, other job boards, employers' applicant tracking systems, scraped public profiles), Article 14 of the UK GDPR requires it to tell the individuals within a month or at first contact what it holds and where it came from, to have a lawful basis (legitimate interests, with the balance recorded, or the source's consent), and to respect the source's terms, which for professional networks and other platforms usually prohibit scraping; the notice should name the sources and the basis, and a platform built on scraped profiles should take advice before it launches, because the regulator's enforcement against data brokers starts there.

Retention, dormant profiles and the candidate who wants to disappear

The notice should state the retention: active profiles while the account is used, dormant profiles for a stated period after the last activity with a reminder before deletion, applications for the period the employer's recruitment and the discrimination claim window justify, messages for a stated period, and account deletion available in the product with the profile removed from employer view immediately and from backups on the stated cycle; it should cover what the individual may ask for (access, correction, erasure, restriction, portability, objection), how and within the month allowed, and the Information Commissioner's Office as the place to complain, the cookies and tracking under regulation 6 of the Privacy and Electronic Communications (EC Directive) Regulations 2003 with the consent mechanism the pack provides guidance on, the marketing to candidates and employers under regulation 22, and the international transfers under Article 46; the notice can record the business's registration with the Information Commissioner's Office under the Data Protection (Charges and Information) Regulations 2018.

What it costs

Website privacy and cookies pack, £595. Privacy notice, cookie notice and consent guidance. Five working days.

DPA and privacy terms, £795. Data processing agreement plus privacy notice. Five working days.

Buying online forms the engagement on payment. The scope is what the data protection agreements and privacy terms page describes, you accept the Terms of Service at checkout, and I email you within four working hours to get started. If you would rather ask something first, email me.

What you get

• A data processing agreement that meets the statutory requirements and can be used as a schedule to your main contract
• A privacy notice written for people to read rather than to be scrolled past
• Clear allocation of controller and processor roles, which is where most confusion starts
• International transfer provisions where you use overseas suppliers
• Sub-processor and security provisions proportionate to what you do
• A note on the operational steps the documents assume you are taking

What is not included

• Full compliance audits and data mapping exercises
• ICO registration, which you do yourself
• Breach response and regulatory correspondence
• Cyber security certification such as Cyber Essentials
• Advice on data protection law outside the UK and EU

Questions I am often asked

Are we the controller or the processor for candidates' data?

Both: the controller for profiles and accounts and the platform's own purposes, the processor for applications submitted to a particular employer. The notice says which for each, and the employer terms set the employer's obligations as a separate controller.

Our algorithm ranks candidates for employers. What must the notice say?

Meaningful information about the logic and its consequences, whether the tool decides or recommends, and the candidate's rights where a decision is automated, under Article 22 as amended by the 2025 Act. If the ranking cannot be explained to candidates, it should not be used on them.

Can we keep candidates' profiles indefinitely?

Not indefinitely. Dormant profiles are kept for a stated period after the last activity with a reminder before deletion, and account deletion is available in the product. The notice states the periods.

Related guidance and services

• Data protection agreements and privacy terms, £595, the service this page describes
• Terms and conditions drafting, £995
• SaaS and technology contracts, £995
• Privacy notice for a recruitment agency
• Privacy notice for a company using AI tools on customer data

This page is general guidance for businesses in England and Wales, not advice on your own circumstances. Last reviewed: October 2026. Email geoffrey@caesar.co.uk.