Before you post another job advert, make sure you have a privacy notice at the point of collection, a documented lawful basis, PECR-compliant job alerts, a DPIA for any AI screening tool, and a retention policy you can defend. These five steps cover most of what ICO guidance expects from recruiters under the UK GDPR, PECR, and the DPA 2018.
TL;DR:
- Use Article 6(1)(b) for an active application, but obtain separate, freely given consent before retaining a CV for future vacancies or talent pools.
- Job alert emails and texts require a separate, unticked opt in; the soft opt in covers only similar roles and needs an easy opt out.
- Complete the DPIA at tender stage, before signing a contract or using live candidate data, and ask about decision logic, training data, accuracy, and appeals.
- For health, disability, or conviction data, identify an Article 9 condition as well as an Article 6 basis, restrict access, and check Schedule 1 policy requirements.
- Before using a candidate list, verify consent records and wording, confirm your organisation was named, and notify candidates within one month of receiving their data.
Table of Contents
- Privacy information at the point of collection
- Choosing and recording the lawful basis for candidate data
- Electronic marketing and PECR: job alerts, emails and texts
- Special category data and sensitive information in recruitment
- AI, automated screening and the need for a DPIA at procurement
- Due diligence for third-party candidate data and purchased lists
- Retention, deletion and record-keeping for recruitment data
- Quick practical checklist for compliant recruitment adverts and job alerts
- Practitioner perspective: embedding privacy to build candidate trust
- How Jobs-in-Transport helps recruiters advertise roles compliantly
- FAQ
- Sources
Privacy information at the point of collection
A job advert or application form has to tell candidates what happens to their data before they hand it over, not three clicks later in a buried policy. According to ICO guidance on recruitment, a generic privacy footer on your website is usually not enough on its own.
At the point of collection, candidates need to see:
- Who the controller is (your organisation’s name, not just a brand).
- Why you’re collecting the data and what you’ll use it for.
- The lawful basis you’re relying on.
- How long you’ll keep the information.
- How to exercise their rights and who to contact.
In practice, this means a short line on the advert itself (“See how we handle your data: [link]”) pointing to a full privacy page. Log that the link was live and current when the advert ran, it’s the easiest record to produce if a candidate later queries what they were told.
Choosing and recording the lawful basis for candidate data
Picking the right lawful basis isn’t a formality, it determines what you can do with the data later. For an active application, Article 6(1)(b), steps taken prior to entering a contract, usually covers processing a CV and running an interview, according to ICO guidance. That basis doesn’t stretch to keeping the CV for a future vacancy or building a talent pool: that’s a separate purpose needing its own basis.
- Performance of a contract: valid for processing tied directly to filling the advertised role.
- Legitimate interests: often appropriate for sifting or shortlisting, provided you complete a legitimate interests assessment (LIA) weighing your interest against the candidate’s rights.
- Consent: required for talent pools, speculative CV retention, and most marketing uses, and it must be freely given and specific, never bundled into the application itself.
Document your decision before processing starts. ICO guidance is clear that switching lawful basis retrospectively, after a complaint or audit, is not acceptable practice.
Pro Tip: Keep your LIA as a one-page record: the interest, the necessity test, and the balancing test. It takes ten minutes and saves hours if challenged.
Electronic marketing and PECR: job alerts, emails and texts
Job alerts sent by email or text count as electronic marketing, which means PECR applies alongside UK GDPR. ICO guidance on electronic mail marketing sets out that consent must be freely given, specific, and given through a clear affirmative action, so pre-ticked boxes don’t count.
- Use an unticked opt-in box for job alert sign-ups, separate from the application itself.
- If relying on the soft opt-in (an existing relationship, such as a previous application), only market similar roles and give a clear, easy opt-out on every message.
- Keep a record of when and how consent or soft opt-in applied, since you need to evidence it, not just assume it.
- Treat B2B contacts carefully too: a named individual’s work e-mail is still personal data under ICO advice on B2B marketing.
- Audit existing mailing lists for pre-ticked sign-ups or inferred consent, and remove or re-permission anyone who can’t be evidenced.
Special category data and sensitive information in recruitment
Health details, disability information for adjustments, or criminal conviction data all count as special category or similarly sensitive data, and they need more than just a lawful basis under Article 6. ICO guidance on special category data confirms you also need an Article 9 condition, with the DPA 2018 Schedule 1 setting out the UK-specific employment conditions.
- Only collect special category data when it’s genuinely needed, such as arranging interview adjustments.
- Where Schedule 1 applies, check whether you need an appropriate policy document in place.
- Restrict access to this data to the people who need it to make a decision.
- Keep a short record of why the data was collected and who approved its use.
AI, automated screening and the need for a DPIA at procurement
If you’re buying an AI-powered CV screener or scoring tool, the DPIA needs to happen before you sign the contract, not after deployment. The ICO’s guidance on AI in recruitment found that procurement is where recruiters have the most leverage over suppliers on bias, data minimisation, and transparency.
- Run the DPIA at tender stage, before the tool touches live candidate data.
- Ask vendors how the tool reaches decisions, what training data it used, and how accuracy is measured.
- Confirm there’s a clear route for candidates to challenge or query an automated decision.
- Set out controller and processor responsibilities in the contract, including monitoring obligations.
Pro Tip: If the DPIA flags unacceptable risk, don’t buy the tool until the supplier fixes it, not after it’s already screening applicants.
Due diligence for third-party candidate data and purchased lists
Buying or importing a candidate list doesn’t transfer responsibility to the original collector, you become the controller the moment you process it. ICO guidance on generating leads states that you must check what candidates were told and whether your organisation was named at collection.
- Ask suppliers for evidence of consent, including the original wording and date.
- Confirm your organisation (or the type of organisation you represent) was named when consent was captured.
- Tell candidates within a reasonable period, usually within one month, that you now hold their data, plus your purpose and lawful basis.
- Discard any list where the supplier can’t produce clear consent records.
Retention, deletion and record-keeping for recruitment data
Keeping applications forever isn’t compliant, and neither is deleting everything the moment a role closes. Set retention periods for each category: active applications typically run to the end of the recruitment process plus a short window for queries, unsuccessful applications for a defined period you can justify, and talent pool entries only as long as consent remains valid.
- Document any deviation from your standard retention periods and why.
- Record how you’ve handled access, rectification or erasure requests.
- Keep an accountability file: lawful basis decisions, DPIAs, consent logs, and supplier due diligence checks all belong here.
Quick practical checklist for compliant recruitment adverts and job alerts
Before you post, run through this list:
- Add a privacy notice link on the advert itself.
- Record and document your lawful basis for this specific processing purpose.
- Use a clear, unticked opt-in for job alert sign-ups.
- Check PECR rules apply to any marketing message you’re sending.
- Run a DPIA before procuring any automated screening tool.
- Verify supplier consent records before using a bought list.
- Set and document retention periods for applications and talent pools.
A recruitment advert might read: “We collect your details to assess your application for this role. See how we handle your data: [link].” For talent pools: “Tick here if you’d like us to keep your details on file for future roles like this one.” DPIAs for AI tools should be completed before procurement, when you still have leverage over the supplier.
Practitioner perspective: embedding privacy to build candidate trust
I’ve seen adverts with a clear, plain-English privacy line get noticeably better candidate response than ones hiding behind a policy link nobody clicks. Candidates want to know who’s holding their data and how to ask a question about it. Keep that wording short, focused on their rights, and easy to act on.
— Rob
How Jobs-in-Transport helps recruiters advertise roles compliantly
Getting the compliance detail right takes time most recruitment teams don’t have, especially in transport, where roles range from highways engineering to logistics management. Our listing packages give you the fields to embed your privacy notice link and job alert opt-in directly where candidates see them.
- Each listing tier supports a dedicated privacy link field, so your notice sits at the point of collection, not buried in a footer.
- Employer Profiles let you set out your organisation’s name, purpose, and contact route clearly, which supports the transparency candidates expect.
- Our advertising rates page sets out current listing options and pricing.
If you want help setting up a compliant job alert flow alongside your next vacancy, visit our advertising rates page or get in touch through our contact form.
FAQ
What must a job advert’s privacy notice include?
It needs to name the controller, explain the purpose and lawful basis for processing, state how long data will be kept, and explain candidates’ rights and how to contact you, according to ICO guidance. A link from the advert to a fuller privacy page is the usual way to deliver this.
Can recruiters share personal data with third parties?
Sharing candidate data with another organisation, such as a client employer, needs its own lawful basis and should be set out in your privacy notice. If you receive data from a third-party list or supplier, you become the controller and must check the supplier’s consent records under ICO guidance on lead generation.
Do job alert emails need consent under PECR?
Yes, in most cases you need clear, specific consent before sending job alert emails or texts, unless you can rely on the soft opt-in from an existing relationship, as set out in ICO guidance on electronic marketing. Pre-ticked boxes or inferred consent don’t meet this standard.
When is a DPIA required for recruitment technology?
A DPIA is required before procuring AI or automated screening tools that assess candidates, so risks around bias and data minimisation can be addressed before the tool is used. The ICO’s guidance on AI in recruitment recommends completing this at tender stage, not after deployment.
How long can we keep unsuccessful candidates’ data?
There’s no single legal retention period, so you should set a defined timeframe you can justify, document it, and apply it consistently. Any retention beyond that, such as keeping a CV for a future talent pool, needs its own lawful basis and should be recorded separately from the original application.
