Recruiter notes on candidates: why they are usually kept out of a license

Why are recruiter notes usually excluded from a data license?#

Recruiter notes are usually excluded from a data license because they combine three problems in one field: they are about an identifiable person, they record opinions and sensitive details, and the candidate shared that information to get a job, not to supply training material.

A single phone screen note can hold a salary expectation, a reason for leaving, a spouse's relocation, a medical leave, a visa question and the recruiter's own impression. Each detail carries a different risk, and none of them sits in a predictable field that a tool can reliably find and remove.

That is why privacy reviews at staffing firms start from exclusion and ask which narrower, structured records can stand in for the notes, rather than starting from the notes and asking what to redact.

What recruiter notes typically contain#

Recruiter notes typically contain far more than skills and availability. They collect in the ATS activity log, in email threads synced to candidate records and in texting logs, and counsel should assume every category below is present until a sample shows otherwise.

Why redaction does not make free-text notes safe#

Redaction does not make free-text notes safe because identity in a note rarely sits in the name field. A line saying a candidate ran the payments team at a regional bank and left after its merger can point to one person with every name removed.

Re-identification research supports that caution. Latanya Sweeney estimated from 1990 census data that most people in the United States were likely unique on ZIP code, gender and date of birth alone, and NIST's report on de-identification treats free text as its own category while noting that some de-identified data has been re-identified.

Automated tools help but do not settle the question. Presidio's documentation states that, because it relies on automated detection, there is no guarantee it will find all sensitive information and other protections should be added. For notes, that means a person reviewing every record released, which is rarely proportionate to what the notes add.

Which laws may apply to candidate notes?#

Several laws may apply to candidate notes, depending on where candidates live, where the firm operates and what the notes contain. These are assessed deal by deal with counsel rather than settled by a general rule.

• 1California's CCPA: since the employee and applicant exemption lapsed on January 1, 2023, candidate records held by covered businesses fall within the law like other personal information.
• 2Other state privacy laws: some, such as Colorado's, exclude people acting in an employment context, so coverage varies by state.
• 3Pending rules: California's privacy agency opened preliminary rulemaking in April 2026 on how the CCPA applies to employee, applicant and contractor data.
• 4GDPR and UK data protection law: may apply to candidates located in Europe or the UK, where pseudonymised data remains personal data.
• 5Employment and anti-discrimination laws: notes that mention age, health, family status or similar traits raise their own concerns if reused.
• 6Background screening rules: reports from consumer reporting agencies typically come with legal and contractual limits on the purposes for which they may be used.

California's deidentified standard sets a high bar#

California's deidentified standard sets a high bar for anything derived from notes. Under the CCPA definition, the business must take reasonable measures so the data cannot be associated with a person, publicly commit to keep it deidentified and not attempt re-identification, and contractually bind every recipient to the same terms.

A license that included material derived from notes would have to carry those obligations to the licensee. Counsel would also need to be confident the derived material genuinely meets the standard, which is hard to show for narrative text about individuals.

What can stay in scope instead of notes#

What can stay in scope is the shape of the recruiting process rather than the story of any person in it. Event records show how long each stage took, where candidates dropped out and which requirements tended to lead to fills, and that pattern is what teams building recruiting and workflow tools usually need.

The test for each field is whether it describes the process or the person. Process fields can often be kept with generalization; person fields are removed; anything ambiguous goes to counsel.

Illustrative: an engineering staffing firm separates notes from process records#

Illustrative: a fictional engineering staffing firm places design and project engineers with manufacturers and utilities. Its ATS holds years of job orders, submittals and placements, plus phone screen notes, interview debriefs and client feedback logged by recruiters.

Before a data licensing review, the privacy lead samples the notes and finds salary history, health-related leave and family relocation details throughout. Counsel confirms that all notes, debriefs, references and client feedback stay out. The package under review holds only de-identified stage events, rejection codes and generalized job requirements, and the excluded fields are listed in its privacy record.

How SourceX treats recruiter notes#

SourceX treats recruiter notes and candidate assessments as excluded by default in staffing transactions. In the Rights and Preparation steps of the SourceX five-step transaction, the work centers on whether structured, de-identified process records can stand on their own.

Where a package goes forward, its SourceX Evidence Packet documents the privacy record, including which fields were excluded and why, alongside provenance, licensing rights, permitted use and release authorization. The supplier approves the final scope before anything is delivered.