Do Recruitment Agencies Need A Data Processing Agreement?

Priya runs a small recruitment agency in Manchester. A client asks her to send over shortlisted CVs for a finance role, then follows up with a contract clause saying Priya is their "data processor" and must delete all candidate records after 30 days.

Priya pauses. She found the candidates, interviewed them, checked their availability and wants to keep their details for future roles. Is she really just processing data for the client, or is she using candidate data for her own recruitment business too?

If you're sharing candidate details with clients, this question comes up all the time. The answer matters because the wrong contract can leave you with unclear obligations around CVs, references, right to work checks, retention, data breaches and candidate complaints.

The good news is that this doesn't have to be complicated. You just need to work out your role under the UK GDPR, then use the right mix of processor terms, data sharing terms and, in some cases, joint controller terms.

Do Recruitment Agencies Need A Data Processing Agreement?

It depends on whether you're acting as a processor, a separate controller or a joint controller for the particular activity.

Under the UK GDPR and the Data Protection Act 2018, the label in the contract doesn't decide your role. What matters is who decides the purposes and essential means of using the personal data.

In recruitment, you're often a controller when you:

• Source candidates through job boards, LinkedIn, referrals or your own talent pool
• Decide which candidates to approach or shortlist
• Keep candidate profiles for future vacancies
• Decide how long to retain candidate records
• Use candidate data to manage your own recruitment business and client relationships

You're more likely to be a processor when you process candidate data only for a client's purposes and only on their instructions. For example, a client gives you access to its internal applicant tracking system and asks you to screen applications using its process, its criteria and its retention rules.

Many recruitment agencies do both across different services. You might need:

• A data processing agreement for processor activities covered by Article 28 of the UK GDPR
• Data sharing terms for separate controller-to-controller sharing, such as sending CVs to clients that make their own hiring decisions
• Joint controller terms where you and the client jointly decide why and how candidate data will be used

If a client insists you're a processor for everything, be careful. If you actually use candidate data for your own recruitment purposes, processor terms may stop you from doing things your business needs to do, like keeping a candidate on file for future roles.

Are Recruiters Controllers Or Processors Under UK GDPR?

Recruiters are usually controllers for their own candidate database, but they can be processors for some client-led tasks.

Think about control. If you decide why candidate data is collected, what you collect, who you share it with and how long you keep it, you're likely a controller. If the client decides those things and you're just following instructions, you're likely a processor.

Example: Independent Controller

Say Priya advertises a finance role, receives CVs, interviews candidates, takes notes and sends a shortlist to her client. She also asks candidates whether they'd like to hear about similar roles in future.

Priya is likely a controller for the candidate data she collects and uses. The client is also likely a controller once it receives the shortlist and uses the CVs to decide who to interview.

That means the main contract between Priya and the client should include a data sharing agreement or clear data sharing terms, not just a processor agreement. A standalone data sharing agreement isn't always a strict legal requirement for separate controllers, but ICO-style data sharing clauses are strongly recommended because they make each party's responsibilities clear.

Example: Processor

Now say a large employer asks Priya to provide admin support during a graduate hiring round. The employer has already collected applications through its own portal. Priya logs into the portal, scores applications against the employer's fixed criteria and follows the employer's deletion policy.

For that specific service, Priya may be acting as a processor. She'll need a written data processing agreement with the client that includes the required UK GDPR processor clauses.

Example: Joint Controllers

Joint controllership can also arise in recruitment. For example, Priya receives a speculative CV, speaks with a client about where the candidate may fit, and they work together to identify a relevant role. If Priya and the client jointly decide the purpose and essential means of that processing, they may be joint controllers for that activity.

Where parties are joint controllers, Article 26 of the UK GDPR requires a transparent arrangement that sets out who is responsible for what, including privacy information and candidate rights requests. The essence of that arrangement must be made available to candidates.

When Do You Need Data Sharing Terms With Clients?

You should use data sharing terms when you and your client are both controllers and you're sharing candidate personal data between your businesses.

This is very common in recruitment. When you send a candidate's CV, interview notes, salary expectations or availability to a client, the client will usually use that data for its own hiring decision. You're not just storing or passing data on their behalf.

Good data sharing terms should cover:

• Purpose: why you're sharing the data, such as assessing candidates for a specific role
• Types of data: CVs, contact details, work history, qualifications, interview notes, salary expectations, references and right to work information
• Lawful basis: which UK GDPR lawful basis each party relies on, commonly legitimate interests for many recruitment activities
• Transparency: who gives candidates privacy information, and when
• Candidate permission: when you'll seek clear permission before putting a candidate forward, especially for speculative submissions
• Security and retention: how CVs and related records should be sent, stored, accessed and deleted
• Candidate rights and breaches: how you'll handle access requests, deletion requests, objections, corrections and data incidents

These terms can sit inside your recruitment services agreement, master services agreement or client terms of business. You don't always need a separate document, but you do need the clauses to be clear.

What Clauses Should A Recruitment Agency Data Processing Agreement Include?

A recruitment agency data processing agreement should include the mandatory processor clauses required by Article 28 of the UK GDPR, plus recruitment-specific detail.

If you're a processor for a client, the agreement should set out:

• Subject matter and duration: what processing you're doing and how long it lasts
• Nature and purpose: for example, screening applications, scheduling interviews or carrying out reference checks
• Types of personal data: CV details, contact details, employment history, interview notes, assessment results and right to work records
• Categories of data subjects: candidates, applicants, referees and sometimes hiring managers
• Client instructions: a clear requirement that you only process personal data on documented instructions from the client
• Confidentiality and security: staff confidentiality, access controls, secure file transfer, backups and staff training
• Sub-processors: rules for tools such as applicant tracking systems, cloud storage, payroll providers or screening platforms
• International transfers: how data will be protected if it's accessed or stored outside the UK
• Assistance and breaches: how you'll help with candidate rights requests, regulator enquiries and personal data breaches
• End of services and audits: whether you'll delete or return personal data, and what compliance information you'll provide

For recruitment agencies, the biggest trap is accepting a deletion clause that doesn't match your role. If you're genuinely a processor, deleting or returning data at the end of the project may make sense. If you're also a controller, you may need to keep certain records for your own legitimate business reasons, such as fee disputes, placement records, compliance records or future opportunities where the candidate has been told about that use.

Templates often miss these mixed-role issues. A document that works for a software supplier won't always work for a recruiter handling CVs, references and right to work documents.

How Should You Handle Candidate CVs, References And Right To Work Data?

You should handle each category of candidate data based on its sensitivity, purpose and retention need.

For CVs, make sure candidates know how you'll use their details. Your candidate privacy policy or notice should explain what information you collect, where you collect it from, which clients or types of clients you may share it with, whether you'll keep their details for future roles, how long you normally keep records and how candidates can exercise their rights.

For speculative applications, be especially careful. If you're sending a CV to a client without a live role or without the candidate expecting it, you should usually get clear permission first. This protects both compliance and your reputation with candidates.

References need careful handling because they involve both the candidate and the referee. Before contacting a referee, check that the candidate has agreed to that contact and that the timing is appropriate. Your client terms should say whether you or the client is responsible for taking references, what information can be shared, and whether reference notes can be passed on.

Right to work data can be more sensitive than it first looks. It may include passport copies, immigration status, share codes and other identity information.

If your recruitment agency employs temporary workers, you may have direct right to work obligations as an employer. If your client employs the candidate, the client will usually need to satisfy its own right to work obligations. Agencies often help collect or check documents, so your contract should spell out who is responsible for what.

Employers commonly need to keep right to work evidence for the duration of employment and for 2 years after employment ends. If you're not the employer but you're holding copies for a client, your retention position should be written into the agreement rather than guessed later.

If you collect equality monitoring data, health information for reasonable adjustments, criminal records information or background screening results, special category data and criminal offence data have extra rules under the UK GDPR and the Data Protection Act 2018.

How Long Can Recruitment Agencies Keep Candidate Data?

You can keep candidate data only for as long as you have a genuine, documented reason to keep it.

The UK GDPR doesn't set one fixed retention period for recruitment agencies. Instead, you need to choose retention periods that are proportionate to the purpose.

Common recruitment retention categories include:

• Active candidates: while you're working with them on current roles
• Talent pool candidates: for a set period where you've told them you may contact them about future roles
• Placed candidates: for placement records, fee arrangements, rebate periods and client account management
• Unsuccessful candidates: for a limited period after a process ends, especially if you need records to respond to queries or complaints
• Right to work records: based on whether you're the employer, supporting the employer or holding data as a processor

Whatever periods you choose, write them down in a retention policy and reflect them in your privacy notice and client contracts. Your agency should also have a practical deletion process, because a retention policy won't help much if data sits forever in inboxes, spreadsheets and old databases.

For many agencies, the most workable approach is to review candidate records at regular intervals and ask whether the candidate still wants to stay on file. If they don't respond, you can usually anonymise or delete records unless you have another lawful reason to keep them.

What Should Your Recruitment GDPR Contract Pack Include?

Your recruitment GDPR contract pack should include documents that match how your agency actually collects, shares and stores candidate data.

For a typical recruitment agency, this may include:

• Client terms of business: covering recruitment services, fees, replacement periods, confidentiality and data sharing
• Data sharing terms: for controller-to-controller sharing of CVs, interview notes, references and candidate communications
• Joint controller terms: where you and a client jointly decide the purposes and essential means of a recruitment activity
• Data processing agreement: for any services where you process candidate data on a client's instructions
• Candidate privacy notice: explaining how you collect, use, share and retain candidate data
• Supplier processor agreements: for your ATS, CRM, cloud storage, email tools, payroll or screening providers
• Internal data retention policy and breach process: so your team knows what to keep, what to delete and what to do if data is sent to the wrong place

You may also need to pay the data protection fee to the Information Commissioner's Office, unless an exemption applies. If you work with clients outside the UK, or use systems hosted overseas, you'll also need to think about international data transfers.

Common Mistakes To Avoid

The biggest mistake is treating every recruitment arrangement as a processor relationship.

Here are the issues we see most often:

• Calling the agency a processor when it's really a controller: this can make your retention, candidate communication and future role matching clauses unworkable
• Missing the joint controller possibility: if you and the client jointly decide how candidate data is used to identify a relevant role, you may need an Article 26 arrangement
• Sending CVs without clear candidate expectations: candidates should understand which types of clients may receive their details
• No rules for speculative submissions: this can create disputes if a client receives a CV it didn't request, or a candidate didn't expect to be put forward
• Unclear responsibility for right to work checks: your contract should say who checks, who stores evidence and who carries the compliance risk
• Over-retaining old records: keeping candidate data forever is hard to justify and increases the impact of any breach
• Ignoring supplier contracts: if your ATS or screening provider processes data for you, you need proper processor terms with them too

A well-drafted contract won't remove every data protection risk, but it gives you a clear playbook. That helps you move quickly, protect candidate trust and avoid awkward client disputes down the track.

Key Takeaways

• Recruitment agencies are often controllers when they source, shortlist and keep candidate data for their own recruitment services.
• You need a data processing agreement when you process candidate data only on a client's instructions.
• Controller-to-controller CV sharing should be covered by clear data sharing clauses, even if a standalone agreement isn't always strictly required.
• Joint controller arrangements can arise where you and a client jointly decide the purposes and means of using candidate data.
• Your contracts should deal clearly with CVs, references, right to work records, retention, candidate rights, security and data breaches.
• Your supplier contracts matter too, especially if you use an ATS, CRM, cloud storage or screening platform.

If you'd like help with recruitment client terms, data processing agreements, candidate privacy notices and data sharing arrangements, you can reach us at 08081347754 or team@sprintlaw.co.uk for a free, no-obligations chat.