Candidate privacy notice for staffing firms: what to include

Who needs a candidate privacy notice?#

Any staffing or recruiting firm that collects personal information from candidates needs a candidate privacy notice, and some laws make one mandatory. California's privacy law requires notice at or before collection for covered businesses, GDPR requires similar information for candidates in the EU or UK, and some states and cities regulate notices for automated hiring tools. Several other state privacy laws exclude employment-context data; the Colorado Attorney General, for example, says the Colorado Privacy Act does not cover job applicants, so check each state where you recruit.

Even where no statute applies, clients increasingly ask agencies how candidate data is handled, and a clear notice is the easiest answer. It also sets the outer boundary for every later use of the data, which matters the moment the firm adopts a new tool or considers a new revenue line.

Section-by-section template#

The template below lists the sections a candidate notice usually needs, with the content each should carry and the staffing-specific detail generic templates leave out. Use it as a drafting checklist, then have counsel adapt the wording to the laws that apply where you recruit.

Placement matters as much as content. Link the notice from the careers page, every job board apply flow that feeds your ATS, recruiter outreach templates and texting opt-in messages, so it reaches candidates at or before the point where their information is first collected.

Writing the client-sharing section#

The client-sharing section should explain exactly when a candidate's profile goes to a prospective employer and what permission the firm obtains first. Candidates care about this section more than any other, and vague wording about sharing with unnamed partners invites complaints.

Describe the submission step in plain terms: who sees the profile, whether contact details are included, and whether the firm asks before each submission. If the firm runs recruitment process outsourcing under a client's brand, say so, and explain that the client's own notice may also apply. Sample sentences you can adapt:

• 1Sample: We send your profile to a client only after a recruiter discusses the specific role with you and you agree.
• 2Sample: When we submit you, the client receives your resume and your recruiter's summary; we do not share identification numbers at that stage.
• 3Sample: If you are placed, we share payroll, timekeeping and compliance information with the client as needed to manage your assignment.

Writing the AI and automated tools section#

The AI section should name each task where software assists, say whether a person reviews the result and explain any choice the candidate has. Recruiters often use more automation than the notice admits, from ATS resume parsing to AI note-takers on screening calls.

• 1Name the task, such as parsing resumes into profiles, suggesting matches or summarizing interviews.
• 2State whether a recruiter reviews every suggestion before a decision affects the candidate.
• 3Explain any recordings or transcripts, and how candidates are told before a call is recorded.
• 4Say whether vendors may use candidate data to improve their own products, and on what terms.
• 5Describe how a candidate can ask for human review or an alternative process, where the firm offers one.

Retention, rights and future uses#

Retention, rights and future uses are where notices most often fall behind practice. State retention for each category, or the criteria used, and make sure the ATS can enforce it; a notice that promises deletion the system cannot perform is a liability, not a safeguard. Check the mechanics in your ATS. Greenhouse Recruiting, for example, lets Site Admins set retention rules per office, separately for rejected and hired candidates, but the flagged personal data is then deleted manually, including in bulk, so someone must own that task.

List rights by jurisdiction rather than promising every right to everyone, unless the firm chooses to extend them. Provide a request method that works for sourced candidates who never created an account, such as a web form or a monitored privacy inbox.

If the firm may use candidate data for purposes beyond recruiting, such as building internal AI tools or licensing de-identified records, assess that use against the existing notice with counsel before it starts. A revised notice generally speaks more clearly to data collected after the change than to data already held.

Illustrative: a finance staffing firm rewrites its notice#

Illustrative: a fictional accounting and finance staffing firm discovers its candidate notice was copied from a website privacy policy and never mentions clients, texting or AI. Its recruiters use Bullhorn, a texting platform, a video interview tool and an AI note-taker.

The privacy lead maps the data in each tool, adds sections on client submission, recordings and AI matching, sets retention by candidate type, and links the notice from every apply flow and recruiter email signature. A recruiter-facing summary explains what to tell candidates before recording a call, and the firm now reviews the notice whenever it adds a tool.

How SourceX reads a candidate notice#

SourceX reads a staffing firm's candidate notice during the Rights step of the SourceX five-step transaction, because the notice frames what candidates were told about their data. Candidate personal information is generally excluded from licensing; the review asks whether any firm-owned process records can be prepared without relying on candidate data in ways the notice does not support.

The conclusion, with any counsel input, is recorded in the privacy record of the SourceX Evidence Packet, so the firm and the buyer see the same basis for what was licensed and what was left out.