What does GDPR require of a UK recruitment agency when it handles candidate data?

In brief. A UK recruitment agency is a data controller for every candidate whose details it holds, and UK GDPR with the Data Protection Act 2018 asks six things of it. A lawful basis for each use of the information, which for most of recruitment is legitimate interests rather than consent. A privacy notice that tells the candidate who you are, what you do with their details and who you pass them to, with the client's identity given as soon as it is reasonably practicable. No more information than the stage needs, kept accurate and secure, and kept no longer than you can justify, with the Conduct Regulations' one-year record rule sitting alongside. A written answer within a month when a candidate asks for their data. A report to the ICO within 72 hours of a breach that puts people at risk. And, since 5 February 2026, the Data (Use and Access) Act 2025's rules on automated decisions and subject access, which reach every agency that screens by software. The ICO's draft recruitment guidance, written for employers and for agencies, is the standard the regulator will measure you against.

Key facts, each with its source

1. The law is the UK General Data Protection Regulation and the Data Protection Act 2018, as amended by the Data (Use and Access) Act 2025, whose main data protection provisions came into force on 5 February 2026 (ICO statement, 5 February 2026; SI 2026/82).
2. The ICO's guidance "Employment practices and data protection: recruitment and selection" is written for employers and for organisations that recruit on their behalf, "such as recruitment agencies, head-hunters or consultancies". It is a draft under review after the 2025 Act, and it is the regulator's current statement of what an agency must, should and could do (ICO, recruitment and selection guidance, pages dated to June 2026).
3. Lawful basis. The agency must identify and document a lawful basis before it processes a candidate's information, for each activity and stage. The ICO says legitimate interests "is likely to be relevant in many recruitment contexts", collecting CVs, shortlisting, interviewing, assessing and verifying, and that a recruitment agency is "most likely to rely on the legitimate interests basis", with a legitimate interests assessment on file (ICO, Data protection and recruitment).
4. Consent is the wrong basis for most of recruitment. The ICO says the imbalance of power makes consent "unlikely to be an appropriate lawful basis at most stages", and that an agency "must not rely on consent in order to consider a candidate for multiple roles, or future roles" because such consent cannot be specific and granular (ICO, Data protection and recruitment).
5. Contract applies only once a conditional or unconditional offer has been made and accepted, or where the agency itself has a contract with the worker that says what it will do with their information, as a temp desk does (ICO, Data protection and recruitment).
6. The privacy notice. A recruiter acting for an employer "must provide your name and contact details, and explain how you use and disclose the personal information you receive", must tell candidates the employer's identity "as soon as reasonably practicable" once their application goes forward and at the latest when the employer first obtains the information, must limit what it discloses to the employer to what the current stage needs, and should send only anonymised details until the employer has been named (ICO, What do we need to tell candidates if we are a recruiter).
7. Special category data, which covers health, ethnicity, religion, sexual orientation and trade union membership among others, needs an Article 9 condition as well as a lawful basis; criminal records information needs a condition under Schedule 1 of the 2018 Act, and most private employers and agencies can process it only where the law requires the check or a substantial public interest condition applies (ICO, Pre-employment vetting of candidates).
8. Retention. Data protection law "does not specify timescales for keeping recruitment records"; an agency should set and document retention periods and, for unsuccessful candidates, should not keep records beyond the period in which a claim arising from the recruitment can be brought (ICO, Keeping recruitment records). The Conduct of Employment Agencies and Employment Businesses Regulations 2003, regulation 29, require the records of each work-seeker's application to be kept for at least one year from creation and for at least one year after the agency last provides services to that person (legislation.gov.uk).
9. Since 1 October 2026 a candidate has six months, not three, to bring an Employment Tribunal claim, which is the period the ICO's "statutory period in which an applicant can bring a claim" now means for most recruitment claims (Employment Rights Act 2025; the gov.uk timeline update of 25 September 2026).
10. Subject access. A candidate may ask for a copy of their information, including "any outcomes or results relating to them at all stages of the recruitment process"; the agency answers within one month, extendable by up to two further months for complex requests; a reference given in confidence may be withheld. For requests received on or after 5 February 2026 the agency need only make a reasonable and proportionate search, and the clock stops while it waits for clarification it reasonably needs (ICO, Right of access; UK GDPR Articles 12A and 15 as amended).
11. Breaches. A personal data breach that is likely to result in a risk to people's rights and freedoms must be reported to the ICO within 72 hours of the agency becoming aware of it, and the people affected must be told without undue delay where the risk is high; every breach, reported or not, is recorded (UK GDPR Articles 33 and 34).
12. Automated decisions. From 5 February 2026 a decision with a legal or similarly significant effect may be taken by automated means alone, provided the candidate is told, can make representations, can obtain human intervention and can contest the decision, unless the decision rests on special category data, where the old prohibition stands (UK GDPR Articles 22A to 22D, inserted by the 2025 Act). The ICO is consulting on new automated decision-making guidance in 2026 and has said it will update its recruitment guidance to match.
13. Registration and complaints. An agency that processes personal data pays the data protection fee to the ICO unless exempt (The Data Protection (Charges and Information) Regulations 2018), and from 19 June 2026 must have a procedure for data protection complaints and acknowledge each one within 30 days (section 164A of the 2018 Act, inserted by the 2025 Act).

Who the law covers, and who is the controller

An agency decides why and how it holds a candidate's details, so it is a controller in its own right, not a processor for its clients. The client that receives a CV becomes a controller too, for its own copy and its own decisions. Each is responsible for its own compliance, and the agency's privacy notice, its terms of business and its contract with the client should say who holds what and for how long. An umbrella company that employs the agency's temps is a controller for the payroll information it holds. Where the agency uses software to hold CVs, run searches or score applications, the software supplier is usually its processor, and a written contract with the Article 28 terms is required.

The lawful basis, and why it is not consent

There are six lawful bases, and for recruitment the ICO points to three. Legitimate interests covers the ordinary work of an agency, receiving and reading CVs, shortlisting, interviewing, testing and checking, and keeping a candidate on file for roles of the kind they have asked about. It needs a legitimate interests assessment, the three-part test of purpose, necessity and balance, written once for the type of processing rather than for each candidate. Legal obligation covers what the law makes you do, the right to work check, the Conduct Regulations' records and the checks a regulated sector requires. Contract covers the steps a candidate asks for after accepting an offer, and the temp's own contract with the agency.

Consent sits badly in recruitment. The candidate cannot refuse it without losing the chance of the job, so it is rarely freely given, and the ICO is explicit that an agency must not use consent to keep a candidate for other or future roles. An agency whose registration form asks candidates to "consent" to being kept on file has chosen the one basis it cannot defend. The sentence that works is the honest one. We hold your details because we need them to find you work, and here is how long and what for.

The 2025 Act added a short list of recognised legitimate interests, where no balancing test is needed, which are disclosures to public bodies that ask, national security and defence, emergencies, crime, and safeguarding vulnerable individuals. They matter to a safeguarding desk asked for information by a local authority; they do not change the everyday basis for recruitment, which stays legitimate interests with its assessment.

The candidate privacy notice

Articles 13 and 14 ask for the same information whether the candidate gave you their CV or you found it on a job board or a professional network. It covers who you are, how to contact you, what you use the information for and on what basis, who you share it with, how long you keep it, the candidate's rights, and the right to complain to the ICO. For details you gathered rather than received, the notice goes within a month and before the first disclosure. The ICO adds three points for recruiters. Say how you disclose, even when it seems obvious. Name the client as soon as it is reasonably practicable once the candidate's application is going forward, and no later than the moment the client first receives their details. Until then, send the client an anonymised profile. A notice that lives at a link in your email signature and on the registration form, and that is actually read, is the single document the ICO asks about first.

Health, equality monitoring and criminal records

Health information arrives in recruitment when a candidate asks for an adjustment to an interview or a test, and that is the one point at which you may ask about it before an offer. The lawful route is an Article 9 condition, usually the employment-law condition in Schedule 1 of the 2018 Act, with an appropriate policy document on file. Equality monitoring is special category data too; the ICO's own example is a secure, separate form, anonymised for statistics and deleted when the exercise ends. Criminal records are different again. A DBS check is lawful only for roles the law makes eligible, and an agency that asks every candidate about convictions "as standard" is processing without a condition. For the detail of the vetting rules, read the ICO's pre-employment vetting chapter.

Sharing with clients and suppliers

Send the client what the stage needs and no more. A shortlist does not need a date of birth, a home address or a photograph. Keep a note of what went to whom and when, because a candidate's subject access request will ask. Put the data terms in writing with the client, saying that each party is a controller, that the client will use the details for this vacancy, that it will tell you of a breach, and how long it keeps unsuccessful candidates. Do the same with your software suppliers under Article 28, and with any umbrella or payroll provider, where the Conduct Regulations and the Agency Workers Regulations already ask you to know who is paying whom. International transfers, including a CRM hosted outside the UK, need a transfer mechanism, in most cases the UK's adequacy regulations or the International Data Transfer Agreement.

How long you keep it

Data protection law sets no fixed period; it asks you to decide one, write it down and keep to it. Three clocks give you the answer. The Conduct Regulations' records of each application are kept for at least a year from creation and for a year after you last provided a service to that candidate. Copies taken for a right to work check are kept for the length of the engagement and two years after it ends, in the Home Office's own words. And since 1 October 2026 a candidate who believes the process discriminated against them has six months, not three, to bring a claim (the Employment Rights Hub carries the dates), so interview notes, scoring sheets and the reasons for a rejection are kept at least that long, with a margin. Beyond those clocks, a CV kept "in case" is kept without a purpose, and the ICO's position is that unsuccessful candidates' details go once the claim period has passed unless the candidate has asked to be kept on file for roles you can describe. Write the schedule, review the database against it on a fixed day each quarter, and anonymise what you keep for statistics.

When a candidate asks for their data

A subject access request can arrive as an email, a message on a professional network or a sentence in a call, and the month runs from the day you receive it. The candidate is entitled to a copy of what you hold about them, where it came from, who you gave it to and the reasons for decisions, including interview notes and scores. Information about other people, such as a referee, is weighed before disclosure, and a reference given in confidence may be withheld. For requests received since 5 February 2026 the search need only be reasonable and proportionate, and if you reasonably need the candidate to narrow the request the clock stops until they answer. The other rights follow the same month, correction, erasure where the purpose has gone, and objection to processing on legitimate interests, which an agency answers by stopping unless it can show compelling grounds.

When something goes wrong

The recruitment breaches the ICO sees are ordinary ones, a spreadsheet of candidates sent to the wrong client, a CV database left open, a laptop lost, a consultant who leaves with the contacts. Within 72 hours of becoming aware, the agency decides whether the breach is likely to put people at risk and, if so, reports it to the ICO; if the risk is high, it tells the people affected without delay. Every breach goes in the breach register whether or not it is reported, with the decision and the reason. A written procedure that names who decides, and a template for the report, is what turns a bad week into a managed one.

Automated screening and AI

Since 5 February 2026 the rule on automated decisions has changed. A tool may now reject or shortlist a candidate on its own, which counts as a significant decision, provided the candidate is told it is happening, can make representations, can ask for a person to look again and can contest the result; the agency must have those safeguards built and documented before the tool goes live. Where the decision rests on special category data the prohibition remains. A data protection impact assessment is required for screening by software at any scale, because it is systematic evaluation of people, and it is the document the ICO will ask to see. Keep the human in the loop where the tool is not yet proven, and keep the record of why a candidate was rejected in words a person wrote or read, since that record is also the defence in the six-month claim window.

What is coming

The ICO's recruitment and selection guidance is a draft under review after the 2025 Act, with the final version promised; its new guidance on automated decision-making and profiling is in consultation in 2026 and will be read across to recruitment. The remaining provisions of the Data (Use and Access) Act commence by regulation. The Fair Work Agency, which took over the enforcement of the Conduct Regulations in April 2026, inspects the records that regulation 29 requires, and those records are personal data held under the same law described here.

Your questions, answered.

Do I need a candidate's consent to hold their CV?

No, and the ICO says you should not rely on it. An agency holds a CV on the legitimate interests basis, with an assessment on file and a privacy notice that says so. Consent cannot be used to keep a candidate for other or future roles because it would not be specific, and a candidate who cannot refuse without losing the job has not given it freely.

Can I send a CV to a client without telling the candidate who the client is?

Only as an anonymised profile, and only until the application goes forward. The ICO's guidance for recruiters says the employer must be named as soon as reasonably practicable and at the latest when the employer first receives the candidate's personal information, and that what you disclose is limited to what that stage of the process needs.

How long can a recruitment agency keep a candidate's details?

For as long as you can justify, written into a retention schedule. The Conduct Regulations require application records for a year from creation and a year after the last service to that candidate; right to work copies are kept for the engagement and two years after; interview and selection records are kept at least through the six-month claim window that has applied since 1 October 2026. Beyond that, unsuccessful candidates' details go unless they have asked to be kept on file for roles you can describe.

What must an agency do when a candidate asks for their data?

Give them a copy of what you hold, where it came from, who received it and the reasons for decisions, including interview notes and scores, within one month, extendable by two more for a complex request. A reference given in confidence may be withheld and other people's details are weighed first. For requests since 5 February 2026 the search is reasonable and proportionate, and the clock stops while you wait for a clarification you reasonably need.

Do I have to tell the ICO about a data breach?

Within 72 hours of becoming aware, if the breach is likely to put people at risk, which a leaked candidate database or a CV sent to the wrong client usually is. If the risk is high, the candidates affected are told without delay. Every breach is recorded in the agency's register, with the decision and the reason, whether or not it was reported.

Can an agency use AI to screen candidates?

Yes, within the rules that took effect on 5 February 2026. A tool may take a significant decision on its own if the candidate is told, can make representations, can obtain human intervention and can contest the result, and the agency has those safeguards documented before it starts; where the decision rests on special category data the old prohibition stands. A data protection impact assessment is required, and the reasons for each rejection are kept in a form a person can read.

Data protection is one of the twelve points in the BIOR compliance assessment that every Agency Member passes, and the member library carries Data Protection for Recruitment Businesses: the 2026 Guide, the Agency HR Policies 2026 set with its data protection and privacy notice, and the Data Protection and Cyber Security Policy 2026 with its breach procedure; STAR members have Candidate Data Protection and AI Screening 2026 on the in-house shelf. Agency Membership includes the certification assessment. Pass it and you are certified for five years. Check any recruiter at ior.org/verify.

Sources. Employment practices and data protection: recruitment and selection, the ICO, draft guidance under review, the chapters Data protection and recruitment, Pre-employment vetting of candidates and Keeping recruitment records, pages dated to 16 June 2026. Statement on the commencement of the Data (Use and Access) Act, the ICO, 5 February 2026. The Data (Use and Access) Act 2025 (Commencement No. 6 and Transitional and Saving Provisions) Regulations 2026, SI 2026/82, legislation.gov.uk. The Conduct of Employment Agencies and Employment Businesses Regulations 2003, SI 2003/3319, regulation 29, legislation.gov.uk. UK GDPR Articles 6, 9, 12A, 13, 14, 15, 22A to 22D, 28, 33 and 34, legislation.gov.uk. Employer's guide to right to work checks, the Home Office, 1 October 2026. Plan to Make Work Pay and Employment Rights Act, timeline update, gov.uk, updated 25 September 2026.

The British Institute of Recruiters, the BIOR Membership Team. Last reviewed 15 October 2026. This guide is general information written from government and regulator sources; it is not legal advice. Check the current ICO, GOV.UK or legislation.gov.uk page before relying on any date or figure.