Contact us
Contact us

DPO for Recruitment Agencies

Recruitment agencies hold a lot of personal data about people who are not their customers: CVs, contact details, right-to-work documents, health and diversity information, and sometimes criminal records. Under UK GDPR the agency is usually a controller in its own right, so the compliance work sits with you rather than with the client you recruit for.

By Julian Gage Last reviewed: 28 September 2026

In short: a recruitment agency is normally a controller for its candidate database. It has to give privacy information to the people it sources, not just those who apply, and it needs a lawful condition before it touches health or criminal record data. Whether a DPO is mandatory depends on scale (plenty of agencies appoint one anyway, because clients ask for a named contact).

Engage Compliance acts as the named DPO for recruitment agencies, notified to the supervisory authority, with the same expert on your account throughout.

Key takeaways

  • The ICO’s draft recruitment guidance says recruiters are likely to be controllers in most circumstances, so an agency cannot treat candidate data as its client’s problem.
  • Candidates you find through a search, rather than through an application, still have to receive your privacy information, at the latest within one month (UK GDPR Article 14(3)).
  • Criminal record data needs a Schedule 1 condition under section 10(5) of the Data Protection Act 2018, and health data or data revealing ethnic origin needs an Article 9 condition.
  • Automated CV screening and ranking fall under the UK GDPR rules on automated decisions, which were rewritten as Articles 22A to 22D by the Data (Use and Access) Act 2025.
  • A DPO is mandatory only at scale under Article 37(1), but a named one is often what a client’s supplier questionnaire asks for.

Does a recruitment agency need a DPO

UK GDPR Article 37(1) makes a DPO mandatory in three situations: a public authority, core activities that involve regular and systematic monitoring of people on a large scale, or core activities that involve large-scale processing of special category data (Article 9) or criminal offence data (Article 10). Handling candidate data is the core activity of an agency, so the question comes down to scale and to how much sensitive data you handle.

A boutique agency placing a few hundred office staff a year is usually below the line. A national agency with a large candidate database is much closer to it, and so is a healthcare, education, or security staffing business that runs health declarations and criminal record checks as routine. Those are the cases where we would expect the answer to be yes. If you are not caught, Article 37(4) still lets you appoint one voluntarily (often the cheaper route to answering a client’s due diligence questions than rebuilding the answers every tender). Our do I need a DPO page walks through the test in more detail.

Controller, processor, or both

The ICO’s draft guidance on recruitment and selection is direct on this: recruiters are likely to act as controllers in most circumstances. Keeping a candidate on file for other roles, paying temporary workers yourself, or holding records because employment agency law requires it all mean you decide why and how that data is used. That makes you the controller for it.

You can still be a processor for a narrow campaign run entirely on an employer’s instructions, and then a written contract under Article 28 is needed. Many agencies end up as both across the same client relationship, so the practical job is mapping which data sits in which role and making sure your terms with clients say the same thing. We usually do this as part of building your record of processing.

Sourcing candidates and privacy notices

Headhunting creates a transparency duty that agencies often miss. When you collect someone’s details from a job board or a professional network rather than from them, Article 14 requires you to tell them who you are, what you hold, why, and for how long. That has to happen within a reasonable period and at the latest within one month, or at your first contact with them if that comes sooner. The ICO’s draft guidance adds that searching recruitment-focused platforms can be reasonable, but personal social media profiles should be left alone, and direct messages to candidates count as direct marketing under PECR.

Sensitive data and criminal record checks

Health information for reasonable adjustments, diversity monitoring, and right-to-work checks all come up in ordinary placements. Health data, and diversity data that reveals ethnic origin, religion, or sexual orientation, are special category data, which needs a condition under Article 9 on top of your lawful basis. Criminal record data is stricter again: under section 10(5) of the Data Protection Act 2018 you can only process it if you meet a condition in Schedule 1 of that Act, and several of those conditions require an appropriate policy document as well. We help you decide which roles actually justify a check, record the condition you rely on, and keep the results to the people who need them.

Automated screening and AI tools

CV parsing, candidate ranking, and chatbot pre-screening are now common in agency software. Where a tool takes a significant decision about a candidate with no meaningful human involvement, UK GDPR Articles 22A to 22D apply. The candidate has to be told about the decision and be able to make representations, get human intervention, and contest it, and decisions based on special category data face tighter limits. A DPIA is usually the right starting point before you switch on a new screening tool. The ICO’s draft guidance also has a full section on automated decision-making and profiling in recruitment.

Retention and candidate requests

In Great Britain, regulation 29 of the Conduct of Employment Agencies and Employment Businesses Regulations 2003 requires agencies to keep certain records for at least one year after they last provide services to the work-seeker. That gives you a floor, and your retention schedule should add a clear deletion point for everything beyond it. Candidates can also ask for a copy of everything you hold about them. The answer is due within one month, which you can extend by two further months for complex or numerous requests (UK GDPR Article 12A), so a working subject access process is part of the job.

What we handle for recruitment agencies

  • DPO appointment, notified to the supervisory authority
  • Controller and processor mapping across your client contracts
  • Privacy notices for applicants and for sourced candidates, including the Article 14 timing
  • Appropriate policy documents for criminal record and special category data
  • DPIAs for CV screening, candidate ranking, and other automated tools
  • Retention schedules built around the 2003 Regulations
  • Subject access requests from candidates and workers
  • Answers to client supplier questionnaires and tender due diligence

If you also build or sell recruitment software, our DPO for HR tech page covers the vendor side of the same data, and DPO for UK companies covers the wider UK picture. For what an outsourced arrangement costs, see the outsourced DPO cost guide.

Sources and references

  • Same-business-day response
  • Professional indemnity and cyber insurance
  • Named DPO notified to the supervisory authority
  • Trust Center
Book a free intro call

FAQ

Frequently asked questions

Does a recruitment agency need a DPO?

Sometimes. Under UK GDPR Article 37(1) a DPO is mandatory where your core activities involve large-scale regular and systematic monitoring of people, or large-scale processing of special category data or criminal offence data. A small agency placing office staff will often fall below that line, while a large agency running a national candidate database, or one that routinely handles health information or criminal record checks, may well be caught. Where you are not caught, appointing one voluntarily is allowed under Article 37(4), and many agencies do it because clients ask who owns data protection during tenders.

Is a recruitment agency a controller or a processor?

Usually a controller. The ICO's draft guidance on recruitment and selection says recruiters are likely to act as controllers in most circumstances, for example when they keep candidate information to put forward for other roles or hold records to meet their own legal obligations. You can be a processor for a specific campaign run strictly on an employer's instructions, and in that case a binding written contract is needed. Many agencies are both, for different parts of the same relationship.

Can we source candidates from LinkedIn and job boards?

Yes, with conditions. The ICO's draft guidance says searching recruitment-focused platforms can be reasonable, since candidates expect to be found there, but searching personal social media profiles should be avoided. When you collect someone's details without them applying, UK GDPR Article 14 requires you to give them your privacy information within a reasonable period and at the latest within one month, or at your first contact with them if sooner. Direct messages to candidates also fall under the direct marketing rules in PECR.

What rules apply to criminal record checks?

Criminal offence data is covered by UK GDPR Article 10, and under section 10(5) of the Data Protection Act 2018 you can only process it if you meet a condition in Schedule 1 of that Act. Several of those conditions also require an appropriate policy document. In practice this means deciding which roles actually justify a check, recording the condition you rely on, and limiting who sees the result.

How long can we keep candidate records?

Only as long as you need them, and you should be able to say why. In Great Britain, regulation 29 of the Conduct of Employment Agencies and Employment Businesses Regulations 2003 requires agencies to keep certain records for at least one year after last providing services to the work-seeker, so a retention schedule usually starts from that floor and adds a clear deletion point for everything else.

Can Engage also act as our EU or UK representative?

Yes. Engage supports both Data Protection Officer work and Article 27 representative work, as two separate products scoped to what you need. See Representative Services.

What does UK GDPR mean for a recruitment agency in practice?

An agency is normally a controller for its candidate database, so the compliance work sits with you rather than with your client. You have to give privacy information to the people you source, not only those who apply, and you need a lawful condition before you touch health or criminal record data. Whether a DPO is mandatory depends on scale.

What rules apply to health and diversity data about candidates?

Health information, and diversity data that reveals ethnic origin, religion or sexual orientation, is special category data. It needs a condition under UK GDPR Article 9 on top of your lawful basis. That covers ordinary situations like reasonable adjustments and diversity monitoring, so the condition should be decided and recorded before the data is collected.

Can we use AI tools to screen and rank CVs?

Yes, with care. Where a tool takes a significant decision about a candidate with no meaningful human involvement, UK GDPR Articles 22A to 22D apply: the candidate has to be told and be able to make representations, get human intervention and contest the decision. A DPIA is usually the right starting point before you switch on a new screening tool.

What should our privacy notice for sourced candidates say?

Who you are, what you hold about them, why, and for how long. Under UK GDPR Article 14 that has to reach a sourced candidate within a reasonable period and at the latest within one month, or at your first contact with them if that comes sooner. We write separate notices for applicants and for sourced candidates.

How quickly do we have to answer a candidate's subject access request?

Within one month. You can extend that by two further months for complex or numerous requests under UK GDPR Article 12A. Candidates and workers can ask for a copy of everything you hold about them, so a working subject access process saves a scramble each time one arrives.

What does a DPO handle for a recruitment agency?

The appointment itself, notified to the supervisory authority, plus controller and processor mapping across your client contracts, privacy notices with the Article 14 timing, policy documents for criminal record and special category data, DPIAs for screening tools, a retention schedule built around the 2003 Regulations, subject access requests, and answers to client supplier questionnaires and tender due diligence.

Related

Service DPO for HR tech Service DPO for UK companies Service Outsourced DPO services Service Data subject request services Pricing Outsourced DPO cost guide