Recruitment businesses handle large amounts of personal data: CVs, contact details, employment history and sometimes sensitive information. Your website is often where that data is first collected, so it needs to be designed with data protection in mind.
This is a general overview, not legal advice. Always check your approach with a qualified adviser.
Be clear at the point of collection
Every application and enquiry form should explain, briefly and clearly, how the information will be used and link to your privacy notice. Candidates should understand who will see their CV and why.
Separate marketing consent
Agreeing to be considered for a role is not the same as agreeing to receive marketing emails. Use separate, unticked options for newsletters and job alerts.
Collect only what you need
Long forms asking for information you do not use at the application stage increase risk and reduce conversions. Collect the essentials and gather more later if needed.
Store CVs securely
CVs uploaded through your website should be transferred securely and stored in your ATS, not left in email inboxes or website servers. Make sure your hosting and integrations use encryption.
Retention
Define how long you keep candidate data, explain it in your privacy notice and make sure your systems apply it. Automated retention rules in your ATS make this manageable.
Cookies and tracking
Analytics and advertising tags usually require consent. Use a clear cookie banner that lets visitors accept or reject non-essential cookies, and make sure tags respect the choice.
Candidate rights
Make it easy for candidates to access, update or delete their data. A simple contact route on your website and a clear internal process are essential.
Building it in
The easiest time to get data protection right is during a website build or redesign. Design forms, integrations and tracking with privacy in mind from the start.