Recruitment agencies hold large volumes of personal data. The essentials are: keep CVs and ID documents in your recruitment system, not inboxes; get the candidate's agreement before sending their CV to a client; delete old records on schedule; and don't keep DBS certificate information longer than necessary.
CVs and candidate records
- One place. Store CVs, ID and right to work documents in your recruitment system. Copies spread across personal inboxes and downloads folders are the most common source of agency data breaches.
- Agreement before sharing. Get and record the candidate's agreement before sending their CV to a client.
- Only what's needed. Remove details a client doesn't need, such as home address or date of birth, before sending a CV.
- Retention. Set a period for keeping candidate records, tell candidates what it is in your privacy notice, and delete records when it ends.
DBS certificate information
The government's guidance on handling DBS certificate information says not to keep it for any longer than is necessary, and to destroy it securely afterwards. Many organisations set a limit of six months. You can keep a short record instead: the issue date, the person's name, the certificate type and reference number, and the decision made.
Client security questionnaires
Larger clients, and public sector staffing contracts that involve personal information, increasingly ask agencies about security. Under the government's PPN 014 rules, central government and NHS buyers must make sure suppliers meet the Cyber Essentials technical requirements when a contract involves citizens' personal information. Cyber Essentials is the quickest way to answer most of these questions.
The cyber basics
Switch on two-step verification for email and your recruitment system, give every consultant their own login, and remove access on a consultant's last day. A hacked recruiter's mailbox can be used to contact hundreds of candidates with convincing fake job offers.
Common questions
How long can we keep a candidate's CV?
UK GDPR doesn't set a fixed period. Decide how long you need it, explain this in your privacy notice, and delete it when the period ends.
Can we keep copies of DBS certificates?
Government guidance says not to keep certificate information for longer than is necessary. Keep a short record of the date, reference number and decision instead.
Do recruitment agencies need Cyber Essentials?
It isn't a legal requirement, but many clients and public sector staffing contracts ask for it.
Sources
This guide is general information, not legal advice. Fees and rules can change, so check the sources before you rely on them.