GDPR and Candidate Data: A Hiring Checklist for UK Businesses

Every CV is a small file of personal data. A name, an address, an employment history, sometimes a date of birth, a photograph or a note about a health condition that the candidate volunteered. Multiply that by a hundred applicants for a single role, add interview notes, scores and a few email threads, and a hiring round quietly becomes one of the largest collections of personal data your business handles.

The law treats it accordingly. In the UK, recruitment is covered by the UK GDPR and the Data Protection Act 2018, enforced by the Information Commissioner's Office, or ICO. None of it is designed to stop you hiring. It asks you to be clear about why you hold candidate data, to collect only what you need, to keep it only as long as you can justify, and to respect the rights candidates have over it. This guide turns that into a practical checklist.

This guide is general information, not legal advice. It summarises ICO guidance, which is being reviewed following recent changes to the law, so check the current position with the ICO or a qualified adviser before you rely on it. If you hire in the EU, EU rules may apply as well.

Start with why you are holding the data

Every use of personal data needs a lawful basis. For recruitment, three come up most often:

• Legitimate interests. The ICO says this basis is likely to be relevant in many recruitment contexts, for example collecting and reviewing application forms and CVs, and shortlisting candidates. You need to weigh your interest against the candidate's and be able to show that you did.
• Contract. The ICO is clear that you can only rely on this once you have made a conditional or unconditional offer and the candidate has accepted it. It does not cover earlier stages such as shortlisting or interviewing.
• Legal obligation. For example, right to work checks, or vetting the law requires for certain roles.

Decide which basis covers each stage of your process and write it down. It does not need to be long. It does need to exist before the first application arrives.

Tell candidates what you will do with their data

Transparency is a legal requirement, and the timing matters. The ICO says you must provide privacy information at the time you collect the data, for example in the job advert or on the application form. Good privacy information for candidates says:

• who you are and how to contact you about their data
• what you use the data for and on what basis
• who you share it with, such as an agency, a job board or an assessment provider
• how long you will keep it
• the rights they have and how to use them

A short, readable notice linked from your careers page and application form does the job. If your process changes, for instance you add a screening tool or start keeping candidates for future roles, update the notice first.

Collect only what you need

Data minimisation is the rule that catches most small businesses. The ICO puts it plainly: you must not collect more information than you need to achieve your purpose. A few habits keep you on the right side:

• Keep the application form short. Ask for what you need to shortlist. Date of birth, marital status and a photograph rarely help you decide and often create risk.
• Ask for sensitive information later. Special category data, such as health, ethnicity or religion, and criminal offence data need extra conditions and care. The ICO advises collecting information from candidates only when you need it, and typically from successful candidates after an offer rather than from everyone at the start.
• Be careful with monitoring data. If you collect diversity information, explain why, make it optional, and keep it separate from the hiring decision.
• Run checks only where justified. A background or criminal record check must be lawful and proportionate for the specific role, not routine for every hire.

Interview notes count as personal data

Candidates can ask what you hold about them, and that includes what you wrote down about them. The ICO notes that keeping records showing the process was transparent, fair and accountable is what protects you against discrimination claims and against access requests. Write notes as if the candidate might one day read them, stick to job-related observations, and keep them on the candidate's record rather than in a personal notebook or a forgotten email thread.

Automated tools and AI in hiring

Screening tools that score or rank candidates are increasingly common, and they raise a specific data protection question about decisions made without a person involved. The law on solely automated decisions has recently been reworked. As the ICO summarises it, organisations may now rely on more lawful bases for such decisions, but the restriction on using special category data remains, and when you do make an automated decision you must give people information about it, let them make representations, let them obtain human intervention, and let them contest it. The ICO's recruitment guidance is under review as a result, so watch for updates.

The practical position for a small business is straightforward. Treat any scoring or ranking as an aid, keep a person making the actual decision, tell candidates that you use such tools, and be able to explain a result if a candidate asks.

How long to keep candidate data

There is no fixed number in the law, and the ICO does not set one. What it requires is that you carefully consider how long you need the information, set clear retention periods, and document them. It also says you should not keep recruitment records for unsuccessful candidates beyond the statutory period in which an applicant could bring a claim.

That is why so many employers settle on around six months. The usual time limit to bring an employment tribunal claim is three months less a day from the event complained of, and that can be extended by early conciliation. Six months is a common working figure, not a legal rule. Choose a period with your adviser, write it into your privacy notice and your retention policy, and apply it.

Keeping a strong candidate on file for future vacancies is allowed, as long as you told them so and explained the purpose. The ICO gives an example of a firm telling its top scoring candidates it would keep their information for six months in case another role came up. Whatever you decide, delete securely once the period ends.

Rights candidates can exercise

Erasure

A candidate can ask you to delete their data, for instance where it is no longer needed for the purpose you collected it or where it was processed unlawfully. You must respond without undue delay and at the latest within one month, extendable by two further months where a request is complex or you have received several. You cannot generally charge a fee. If you have shared the data with others, you should tell them about the erasure unless that is impossible or involves disproportionate effort, and data in backups needs to be put beyond use. There are exceptions, including where you need the data to establish, exercise or defend legal claims, so a live dispute may justify keeping part of a record. Where you refuse, say why.

Access

A candidate can ask for a copy of the personal data you hold about them. You have one month to respond. Recent changes confirm you only need to carry out reasonable and proportionate searches, and allow you to pause the clock to ask for clarification if a request is unclear. Have a simple routine for logging the request, confirming identity where genuinely needed, and finding everything in one place.

Complaints procedures are now a legal requirement

Under the Data (Use and Access) Act, all organisations that handle personal data must give people a clear way to raise a data protection complaint, acknowledge it within 30 days, investigate it appropriately and tell the person the outcome. The ICO confirmed in June 2026 that the requirement is in force. Put a data protection contact and a simple complaints route on your careers page and privacy notice so a candidate knows where to go.

Agencies and job boards

If you receive candidates through a recruitment agency or job board, the data does not stop being personal data on the way. The ICO expects agencies to limit what they pass to an employer to what is relevant at that stage of the decision, and to send anonymised information where the employer's identity has not been disclosed to the candidate. As the employer, check what you receive, make sure your privacy information explains where candidates' data comes from, and keep the contractual terms with any provider that handles data on your behalf up to date.

Security and breaches

A misdirected CV pack or a spreadsheet of applicants sent to the wrong address is a data breach. Limit access to candidate records to the people who are involved in hiring, use individual logins and keep the data in one system rather than in attachments. If a breach is likely to put people at risk you generally have to report it to the ICO within 72 hours of becoming aware of it, so know who decides and how before it happens.

A hiring data checklist

1. Choose and record your lawful basis for each stage of recruitment.
2. Publish privacy information in the job advert or application form.
3. Trim the application form to what you need to shortlist.
4. Delay sensitive data until it is necessary, typically after an offer.
5. Keep interview notes on the record and write them as if they could be read.
6. Keep a person in the decision whenever you use scoring or screening tools, and tell candidates.
7. Set a retention period, document it and apply it. Tell candidates if you plan to keep them for future roles.
8. Have a routine for erasure and access requests and log every one.
9. Publish a way to complain and respond within 30 days.
10. Restrict access to candidate records and know your breach process.

How Wizard Application helps

Compliance is mostly decisions and habits, and software cannot make those for you. What it can do is give the habits somewhere to live. Wizard Application's recruitment ATS keeps every candidate, note and application in one system with role-based access, so records are not scattered across inboxes and you can limit who sees them.

It also handles the request that is hardest to do well by hand: deletion. Candidates can submit a deletion request themselves from the candidate portal, with an optional reason, and the request is logged and the administrators are notified. People with the data deletion permission review the request from a queue, where each one carries a status, the date it was requested and the date it was processed. They can approve it or reject it with a recorded reason and notes.

Approval anonymises the candidate. Their name, contact details, address, date of birth, nationality, profile links, job title, employer, skills, qualifications and notes are cleared, their CV, cover letter and profile photo are removed from storage, and their login is disabled. The record itself remains in anonymised form with a timestamp, so you keep an audit trail that a request was handled without keeping the person's data.

Wizard Application also offers AI screening on the Professional and Enterprise plans. It is advisory: it returns a fit score, a recommendation and the strengths and gaps behind it for a single candidate, and it never rejects anyone on its own, which keeps the decision with a person.

To be clear about the boundary, choosing your lawful basis, writing your privacy notice and setting your retention period remain decisions for your business and its adviser. The tools help you carry them out consistently and show that you did. Take a look at the recruitment ATS to see how the pieces fit together, and if you are also hiring contractors, read our guide to IR35 for businesses hiring contractors.

Frequently asked questions