GDPR Compliance for Employment Agencies

The GDPR has been in effect for nearly a year now, which makes this the ideal time to be reviewing your compliance. A core principle of the GDPR is transparency – transparency about your collection of personal data, your storage of it, and your processing of it. It is important that individual data subjects know what you have, what you use it for, and why.

This is particularly the case with employment agencies as such businesses will gather large amounts of personal data about large numbers of job applicants.

Employment agencies, as with other types of business, have six legal bases to choose from when deciding upon their justification for processing personal data. Of those, the following are the most likely to be relevant:

• Compliance with a legal obligation;
• Contractual performance;
• Legitimate interest; and
• Consent.

The remaining two bases for processing personal data are unlikely to apply in this context, but in the interests of completeness, they are:

• Public interest; and
• Vital interests.

New Privacy Notice Template for Employment Agencies

This month, a new privacy notice template specifically designed for employment agencies joins our standard privacy notice template. This document is available both in our Business document folder and in our Employment document folder.

Under the heading of ‘the right to be informed’, the GDPR requires the following information to be provided to data subjects:

• the identity and contact details of the organisation;
• the purposes for which the personal data will be processed, as well as the legal basis for the processing;
• if the organisation is relying on its legitimate interests as the lawful condition for processing, what those legitimate interests are;
• the recipients or categories of recipients of the personal data;
• any transfer of the data outside the EEA and the basis for such transfer;
• the period for which data will be stored, or the criteria used to determine how long data will be retained;
• the individual's rights to subject access, rectification or erasure of personal data, and the right to restrict processing or object to processing;
• the existence of any automated decision-making and meaningful information about the logic involved and the consequences of any such processing for the individual; and
• where data is obtained from a third party, the source of the data, including if it came from publicly accessible sources.

This Privacy Notice is for use by employment agencies and recruitment businesses offering work-finding services. If a business is looking to provide job applicants with information about how their personal data will be used during their own recruitment process, the Job Applicant Privacy Notice in our Employment document folder should be used.