2. How does the UK GDPR affect the processing and retention of recruitment data by employers?

Under the UK General Data Protection Regulation (retained from EU Regulation 2016/679 EU) (UK GDPR), when an employer collects personal data about an applicant during a recruitment process, whether this is directly from the applicant or from a third party such as a recruitment agency, it must provide the applicant with an information notice, also known as a privacy notice or fair processing notice. This notice must set out certain required information, including the purposes for which the data will be processed, the legal bases for processing and the period for which the data will be retained.

The employer could provide the information notice on its website, and send a link or copy of the notice in correspondence to individual applicants. Where the employer uses a third-party recruitment portal, it could ensure that the details of the vacancy include a link to the information notice.

Employers should put in place policies setting out for how long recruitment data will be retained. The employer will need to retain some candidate data for the purpose of responding to potential employment tribunal claims arising out of the recruitment process. The employer should retain only the minimum data required for this purpose and only until the relevant limitation periods have expired.

If the employer intends to keep the details of unsuccessful candidates on file for future recruitment rounds, it must notify them of this in the information notice. It should either obtain the candidates' consent, or notify them of their right to object (if it relies on its legitimate interests as the legal basis for processing).

How does the UK GDPR affect the processing and retention of recruitment data by employers?

The policy should cover how the employer will deal with unsolicited personal data, for example CVs submitted on a speculative basis. The policy could state that if the employer receives an unsolicited CV at a time when it is not recruiting, it will delete the CV and inform the candidate of this. If the employer holds unsolicited CVs on file for future recruitment rounds, it must inform the candidates of this in a privacy notice, along with the other required information.

Candidates have rights under the UK GDPR in relation to decisions based solely on automated processing, for example automated shortlisting where candidates without a particular level of qualification are automatically filtered out before the applications are considered by the recruiters. If an employer uses automated decision-making, it must advise candidates of this and provide safeguards, by allowing them to contest the automated decision and by giving them the right to an alternative means of making the decision, using human intervention.

If an employer uses third-party recruiters, for example a recruitment agency, where the recruiter processes applicant data on behalf of the employer, the recruiter will be a "processor" and will itself have obligations under the UK GDPR. The employer must ensure that its relationship with the recruiter meets the requirements of the UK GDPR, for example it must be satisfied that the processor will implement appropriate technical and organisational measures to ensure the protection of the rights of the data subjects.