Professional services
Data protection for
human resources companies
HR companies and temporary employment agencies manage thousands of candidate and placed worker files. They must assess whether the circumstances of art. 34 LOPDGDD are met for the possible appointment of a DPO. CVs, profiling and data transfers between companies require the highest GDPR safeguards.
art. 34
LOPDGDD — possible DPO
1 year
max. CV retention
Art. 22
GDPR — automated decisions
24 h
personalised proposal
Sector challenges
General obligations for HR and staffing agencies
CVs and candidate files
CVs are personal data with limited retention periods. Candidates must be informed of the use of their data and have the right to request its deletion at any time.
Worker placement (staffing agencies)
Placing workers involves transferring the worker's data to the user company. This communication must be regulated contractually and the worker must be informed.
Profiling and automated decisions
The use of algorithms, psychometric tests and personality analysis in candidate selection is subject to the automated decision-making rules of art. 22 GDPR.
Recruitment platforms and ATS
Applicant Tracking Systems (ATS) that store CVs and evaluations may act as data processors; the terms and conditions of each provider should be reviewed and, if acting as such, the corresponding DPA should be executed.
Social media in recruitment
The use of LinkedIn and other networks to evaluate candidates must respect GDPR principles. Candidates must be informed of the data sources used.
Client employees' data
HR consultancies that access client employee data for outplacement, training or evaluation projects may act as data processors, depending on the degree of autonomy and the conditions of each engagement.
Legal obligation
The DPO may apply to HR companies and staffing agencies
Art. 34 of the LOPDGDD contemplates the possible obligation to appoint a DPO where the main activity involves large-scale processing of employee data. Temporary employment agencies and HR consultancies managing a high volume of candidate and worker files must assess whether the relevant circumstances are present.
Even smaller consultancies should evaluate whether their volume and type of processing makes the appointment of a DPO advisable — even if not strictly mandatory — particularly when they work with health data or psychological profiles of candidates.
As a general rule, the final requirement will nonetheless depend on the scale, volume and exact nature of each entity's processing activities. Each case requires individual analysis.
Enquire about an external DPO for my companyThe service
What the service includes for your HR company
RoPA (Record of Processing Activities)
Tailored RoPA: candidates, placed workers, enterprise clients and selection tools.
Information clauses
Texts for candidates, placed workers and enterprise clients.
Privacy policy and legal notice
Documentation for the company's website.
Data Processing Agreements (DPA)
DPA for ATS platforms, assessment tools and payroll management systems.
Data breach protocol
Response procedure with notification within 72 hours.
Data subject rights management
Procedure for requests from candidates, placed workers and own employees.
Document management platform
Access to a private platform with documents and electronic signature.
Ongoing support
Unlimited consultations. Updates on regulatory changes.
External DPO
Separate contract. Recommended if the individual analysis advises appointment pursuant to art. 34 LOPDGDD.
Do you need a proposal for your HR company?
Tell us about the volume of candidates you manage. Proposal within 24 hours.
FAQ
Frequently asked questions about data protection in HR
Are HR companies and temporary employment agencies required to appoint a Data Protection Officer (DPO)?
Art. 34 of the LOPDGDD contemplates the possible obligation to appoint a Data Protection Officer (DPO) where the processing of employee data at large scale is the main activity. Temporary employment agencies and HR consultancies with a high volume of files must analyse whether the circumstances set out in that article are present.
Can CVs received be retained indefinitely in the database?
No. CVs received for a specific vacancy may be retained for the time necessary for the selection process and, as a maximum, for one additional year for similar future vacancies, provided the candidate is informed. Beyond that period, the data must be erased. The candidate has the right to request deletion of their CV at any time.
Can a recruitment company share a candidate's CV with its client without the candidate's consent?
Only if the candidate has been informed of this possibility and has not objected, or if they have given their consent. When a candidate applies for a vacancy managed by an HR consultancy, they must be informed that their CV may be sent to the end client. Sending CVs in bulk to client companies without an adequate legal basis may constitute a GDPR infringement.
Can selection process data be used to profile candidates?
The profiling of candidates (using algorithms to evaluate them, personality analysis, psychometric tests) is subject to the GDPR provisions on automated decision-making (art. 22). Candidates must be informed of the profiling and of the fact that they are not subject to decisions based solely on automated processing without human intervention.
Can the HR company access candidates' social media profiles to evaluate them?
Only the public sections of professional social networks (LinkedIn) and with limitations. Accessing candidates' private personal social media profiles without their consent, or basing selection decisions on data obtained from social networks without informing the candidate, may breach the GDPR. Candidates must be informed of all data sources used in the process.
Is the data of workers placed by a temporary employment agency subject to the GDPR?
Yes. The placement of workers involves the transfer of personal data (identity, employment history, qualifications, health and safety data) between the agency and the user company. This communication of data must be regulated contractually and the worker must be informed that their data will be disclosed to the user company in the context of the placement.
Sector resources
Learn more
HR
CVs and recruitment processes: how long to keep candidate data and how to inform candidates correctly
Processing candidate data under the GDPR: legal basis of the process, reasonable retention (1-2 years with consent for future vacancies), information notice, data subject rights and clean erasure.
8 min·Read article
HR
Workplace health data: occupational health surveillance, sickness absence and how far the employer can go
Workplace processing of health data under the GDPR and the Spanish Occupational Risk Prevention Act (Law 31/1995): occupational health surveillance, sickness notes, medical confidentiality, fitness assessment and the split of information between mutual, medical service and employer.
8 min·Read article
Free tool
Data protection self-check
Check in 5 minutes your overall adaptation level in personal data protection.
No email · Anonymous · No commitment
Professional services
GDPR compliance
for your HR company.
An expert analyses your activity and proposes the right solution. No intermediaries.
Proposal within 24 h · info@certix.es
Legal note: This content is for informational and educational purposes only; it does not constitute specialist legal advice. The application of the regulations to each specific case requires individual analysis.