GDPR for Recruitment Agencies

Any organisation which handles the personal data of EU citizens is subject to the GDPR, regardless of their size, location or the type of business.

As a recruitment agency, you will most likely be a data controller with regards to most of the data that you hold

Generally, you will be a data controller if the following applies:

• You are processing personal data as part of your general and contracted activities;
• You have control over how and why the data processed (if you do not have control over this, for example, if the data processing is specified by the company carrying out recruitment, you are a data processor).

A CV constitutes personal data because it contains information by which a person can be identified. In fact, there will usually be several pieces of personal data within an individual's CV.

Even if you were to remove directly identifiable information, such as a candidates name, telephone number and address for the purposes of anonymisation, it should be noted that a candidate could still be identified from the collection of information contained within a CV, meaning this data remains 'personal data'.

For example, it could become easy to narrow down a candidate's identity by their work and education history alone, particularly if cross-referenced with information avaliable on the internet.