Sharing Candidate Profiles With Clients: A Practical Data Protection Checklist
A practical candidate data sharing guide for recruitment agencies covering purpose, access, recipient controls, transparency, retention and AI screening evidence.
Sending a CV to a client is a data disclosure, not just a convenient attachment. Good recruiting practice makes the recipient, purpose and evidence visible.
A recruiter can choose the correct candidate and the correct vacancy—and still make a costly disclosure mistake by sending a CV to an outdated client distribution list. An expiring portal link helps only if the recipients are right and downloaded copies are governed. Privacy is therefore a submission control, not a paragraph at the bottom of the email.
A professional client-sharing workflow answers six questions before any profile leaves the approved system: why this role, why this recipient, which data, which lawful basis and notice, what access duration, and who can correct or revoke the disclosure. The details differ by jurisdiction; the following controls are practical design patterns, not legal advice.
Start with the actual purpose
The first question is not whether the candidate exists in the database. It is why the agency wants to process and share the information now. Is the person applying for a named role, being considered for a new opportunity, or being rediscovered from a historical talent pool? Those are different circumstances and may require different notices, controls or checks.
Document the job, intended recipient and fields needed to assess suitability. A client may need relevant employment history, a skills summary and confirmed availability. It does not automatically need a home address, date of birth, personal identification number or unrelated health information. Data minimization should be a design decision, not a final manual cleanup.
Lawful basis is not a synonym for consent
Under GDPR-style frameworks, organizations must identify an appropriate lawful basis for each processing purpose. Depending on the facts, legitimate interests, steps connected to a contract or consent may be relevant. Each has conditions and limitations. A recruiter should not claim that an old checkbox covers every future client, and should not treat a generic business interest as automatic permission to disclose a profile.
The European Data Protection Board has published guidance on legitimate interests, and the UK ICO provides recruitment-specific material. Legal teams should check the applicable jurisdiction, the nature of the relationship and any sector-specific rules. This article is an operational checklist, not legal advice.
Define who controls the data
An agency and its client may each determine their own purposes and means for processing some candidate information. In other arrangements, a vendor may process data on behalf of another organization. The controller and processor roles depend on actual decisions and contracts, not on what the parties call themselves in a sales document.
Before integrating a resume analysis provider, map where data enters, which subprocessors may access it, what is stored, how long it is retained, and how deletion or access requests are handled. Check whether the tool sends documents to a third-party model and whether that is covered by the intended processing arrangement.
Control links, attachments and exports
A secure client portal can provide field-level visibility, access expiry and an audit trail. A plain email attachment is harder to revoke once sent. Neither method is automatically compliant; what matters is the security and purpose of the disclosure.
Check recipient identity before sharing, especially when several contacts have similar names. Use the least necessary permissions. Avoid public links that can be forwarded without authentication. If the ATS allows clients to export CSV files, confirm whether that is necessary. Recruit CRM documentation, for example, describes controls over fields visible to clients and whether export is enabled.
Reuse of old candidates requires a fresh check
Rediscovery can save time, but a historical profile is not a permanent license to contact or present a person. Review the original collection context, retention policy, notice, objections, current accuracy and the proposed new purpose. Check whether the candidate has withdrawn, requested deletion or set a contact restriction.
A candidate who applied for a sales position years ago might now be a strong match for a product role. That does not mean the agency should forward the old CV without checking whether it remains current and whether the disclosure is appropriate. A brief confirmation can protect both the candidate and the client from outdated assumptions.
Build an auditable submission record
For each external submission, record the candidate identifier, job identifier, approved recipient, purpose, fields or document version shared, time of disclosure and responsible recruiter. Store the outcome and any correction request in the authorized system. This is particularly important when two agency teams or external vendors work on the same vacancy.
The record should support a practical question: if a candidate asks where their data went, can the agency give an accurate answer? If the answer requires searching several personal inboxes, the workflow needs improvement.
Handle objections, corrections and deletion consistently
Candidates may ask to access, correct or erase information, or object to certain processing. The precise rights and exceptions depend on the applicable law. Create a route for these requests, assign ownership and track deadlines without relying on individual recruiter memory.
Correcting a wrong employment date in the ATS may not correct a PDF already sent to a client. The team needs a process for notifying recipients when appropriate and ensuring future submissions use the corrected version. Similarly, deleting a candidate record in one tool may not remove copies from approved downstream systems.
Automated screening adds a second layer of questions
If an AI tool helps rank or screen candidates, document the role of automation, the evidence it uses, the human review process and the mechanism for challenging errors. The ICO has emphasized transparency, meaningful oversight and safeguards in automated recruitment decisions. These are operational design issues as well as legal ones.
Do not present a local keyword checker as an independent verification service. Do not claim that a score is a hiring decision when a human reviewer still makes the decision. Conversely, do not call a process human reviewed if the person merely clicks approve without seeing the relevant evidence.
A client-sharing preflight checklist
- Identify the current role and purpose of the disclosure.
- Confirm the appropriate legal basis and candidate transparency arrangements.
- Check contact restrictions, objections and data currency.
- Verify the intended recipient and their access rights.
- Remove fields not needed for the selection decision.
- Check the summary against the original source documents.
- Record what was shared, when and by whom.
- Set a retention, correction and access-revocation process.
- Confirm that any AI processor and transfer arrangements have been assessed.
- Keep the ATS or approved CRM as the authoritative record.
This checklist does not replace a data protection impact assessment where one is required. It helps a recruiting team notice when a routine submission has become a new or higher-risk processing activity.
The no-send gate: six checks before disclosing a profile
Make the submission button conditional on an auditable preflight. 1. Purpose: current role and client are identified. 2. Lawful basis and transparency: documented for this processing purpose. 3. Currency: candidate interest, restrictions and core facts have been checked. 4. Recipient: named authorized people, not an old distribution list. 5. Minimisation: only job-relevant fields are included. 6. Security: access, retention and correction routes are set.
Stop and escalate if a candidate objected, the recipient cannot be verified, a source contains irrelevant sensitive data, the lawful basis is unresolved, or the new use materially differs from the original collection purpose. A recruiter should not improvise a legal basis to meet a submission deadline.
This translates the GDPR principles and the ICO data-sharing code into a workflow gate. The ICO guidance is being reviewed after UK legislative changes; confirm the current applicable law.
The field-level sharing matrix recruiters can actually use
| Field | Default handling | Reason |
|---|---|---|
| Role-specific work evidence | Share minimum relevant summary and source status | Directly supports the hiring decision. |
| Candidate contact details | Limit to authorized client contacts where necessary | Contact is not always needed at initial shortlist stage. |
| Home address, date of birth, ID number | Exclude unless a specific justified requirement applies | Typically unnecessary for initial role assessment. |
| Health, family details, unrelated private notes | Exclude and escalate any exceptional processing | Potentially sensitive and usually not job-relevant. |
| Salary expectations / availability | Share only if current, relevant and appropriate | Outdated logistics create misleading client decisions. |
Keep the original CV in the approved record, but generate a purpose-limited client view. A downloaded file cannot reliably be recalled, so record the exact version disclosed and recipients. The CNIL recruitment guide and EDPB privacy-by-design guidance support building such controls into the system rather than relying on memory.
The disclosure and correction runbook
For every client submission, log candidate_id, application_id, recipient_ids, purpose, lawful_basis_record, document_version, sent_at, expiry and reviewer. If a candidate corrects a date, changes a restriction or exercises a relevant right, the data steward can identify which downstream recipients may need an update.
- Contain: stop future exports and revoke active access where possible.
- Trace: identify the disclosed version and recipients, including downstream systems where contractually known.
- Assess: determine rights, correction and possible breach obligations with the responsible privacy team.
- Close: record the outcome and test that future packets use the corrected information.
EU GDPR rights are summarized by the European Commission. For AI-assisted screening, review the ICO’s 2026 findings on automated recruitment and distinguish meaningful human review from rubber-stamp approval. Avoid universal claims about retention periods or the application dates of AI rules: both depend on the facts and current law.
FAQ
Can an agency send a CV to a client without consent?
The answer depends on the jurisdiction, processing purpose, lawful basis and notices. Consent is not the only possible basis, but the agency must have an appropriate basis and meet all other applicable obligations.
Can an old CV be used for a different vacancy?
Potentially, subject to the original purpose, transparency, retention, accuracy, candidate rights and other relevant rules. Historical possession alone is not sufficient justification.
Is a password-protected portal enough?
No. Security is one component. The agency still needs purpose limitation, recipient control, data minimization, transparency and a process for correcting or deleting information.
Make responsible sharing part of the workflow
The strongest agency process makes a good candidate easier to evaluate without making their personal information harder to control. That is a better long-term advantage than sending more CVs faster.
Research basis and implementation notes
Selected primary guidance, regulator material and implementation documentation are linked below. Vendor documentation describes product behavior; it is not independent evidence of hiring effectiveness. The full research register and source classifications accompany this file.
- European Commission: Principles of the GDPR — Purpose limitation, minimisation, accuracy, storage limitation and accountability apply..
- European Commission: Legal grounds for processing data — Consent is one possible lawful basis, not a universal requirement..
- European Commission: Information for individuals — Access, rectification, erasure and objection rights require operational handling..
- ICO: Recruitment and selection guidance — Guidance addresses agencies, headhunters and employers across recruitment stages; under review in 2026..
- ICO: Data sharing: code of practice — Document who receives candidate data, for what purpose and with what safeguards..
- ICO: Recruitment rewired report — Meaningful human involvement and effective review matter in automated hiring..
- ICO: AI recruitment procurement questions — Ask vendors about DPIA, bias, transparency, unnecessary data and controls..
- CNIL: Le guide du recrutement — French regulator describes candidate-data operations across the hiring lifecycle..
- EDPB: Controller and processor guidelines 07/2020 — Data protection roles depend on actual purposes and means, not contractual labels alone..
- EDPB: Data protection by design guidelines 4/2019 — Default visibility and access design are part of privacy controls..
- EU AI Act Service Desk: When does enforcement start? — The AI Act has phased application dates, including Annex III high-risk rules..
Put evidence before the next hiring decision
Explore how RoleRise supports source-aware resume review, recruiter judgment and practical quality checks without replacing your ATS.
Explore the RoleRise demo