What is Candidate Consent?

Candidate consent is a candidate’s voluntary and informed agreement to a defined use of personal data or a defined recruiting action. Depending on the jurisdiction and activity, a recruiter may ask for consent to retain a profile for future roles, share details with a client, record a call, send marketing messages, or process certain sensitive data.

Consent is not a universal legal basis for every recruiting activity. Under the European Union General Data Protection Regulation (GDPR), processing may rely on consent or another lawful basis. Valid consent under GDPR must be freely given, specific, informed, and unambiguous, expressed through a clear affirmative action. A person must be able to withdraw consent, and the organization must be able to demonstrate that consent was obtained.

This page provides general information, not legal advice. The correct rule depends on the jurisdiction, data, purpose, relationship, communication channel, and roles of the agency and client.

Candidate consent at a glance

• Consent should name the purpose and action in plain language.
• Silence, inactivity, or a preselected box is not valid GDPR consent.
• Separate purposes may need separate choices.
• Withdrawing consent should be as easy as giving it.
• A privacy notice supplies information; it does not create consent by itself.
• Recruiters need a record of what the candidate accepted, when, and through which notice.

How candidate consent works

The recruiting firm first maps the processing activity. It identifies the personal data, purpose, people receiving the data, retention period, jurisdiction, and the agency’s role. The firm then selects the correct lawful basis or permission rule for that activity.

If consent is the chosen basis, the request should stand apart from unrelated terms and use direct language. The candidate takes an affirmative action, such as selecting an unchecked box or confirming through a recorded response. The system stores the response with the notice version, timestamp, source, scope, and status.

Later use must stay within that scope. A candidate who agreed to submission for one named role did not automatically agree to marketing, indefinite retention, or submission to unrelated clients. If the purpose changes materially, the firm reviews the legal basis and asks again where required.

Withdrawal stops future processing that depends on that consent. It does not automatically make earlier lawful processing unlawful. Other duties, rights, or legal bases may affect what the firm deletes, restricts, or retains.

Example from an agency recruiting workflow

An executive-search firm sources a finance leader from a public professional profile. The firm sends a privacy notice that identifies the agency, explains the source of the data, describes the search purpose, lists the candidate’s rights, and states the retention approach.

After an exploratory call, the consultant asks permission to share the profile with a named client for a named search. The candidate agrees through a form linked to that assignment. The CRM records the date, purpose, client, consultant, notice version, and response.

The candidate is not selected. The consultant then asks separately if the person wants the firm to retain the profile for future leadership searches. If the candidate declines, the operations team applies the firm’s deletion or restriction workflow, subject to any valid legal reason for limited retention.

This process separates the privacy notice, the lawful basis for initial research, permission to submit, and consent for future opportunities.

Candidate consent versus related privacy concepts

When recruiters may ask for consent

Consent may be relevant for:

• keeping a candidate’s details for future roles where consent is the selected basis;
• submitting a profile to a named client where the workflow or local rule calls for permission;
• recording or transcribing a call in a jurisdiction that requires agreement;
• sending certain marketing communications;
• collecting or using special-category or sensitive information when explicit consent is a valid condition;
• adding optional information that is not needed for the current search.

The word “consent” should not be used as a generic label for every privacy interaction. Acknowledging a notice is not the same as choosing consent as the legal basis. A contractual permission to present a candidate may serve a different purpose from data-protection consent.

GDPR scope and limitations

GDPR Article 6 lists six lawful bases for processing. Consent is one of them. Recruitment activities may use another basis, such as steps requested before a contract or legitimate interests, after a documented assessment.

The European Data Protection Board states that consent is unlikely to be freely given where a clear imbalance exists or refusal may cause detriment. Employment relationships can create such an imbalance. Recruitment teams should test whether a candidate has a genuine choice and can refuse without losing access to a service or opportunity that does not require the disputed processing.

Special-category data requires both an Article 6 basis and an Article 9 condition. Explicit consent is one possible Article 9 condition, but it may not fit every employment context. Local employment law can add or change requirements.

Under Articles 13 and 14, organizations provide privacy information when data comes from the person or from another source. That transparency duty is separate from consent.

How to evaluate a consent process

Use a consent record completeness rate:

Complete consent records divided by records where consent is required, multiplied by 100.

A complete record should contain:

• candidate identity or record identifier;
• affirmative action;
• purpose and scope;
• notice wording or version;
• date, time, and collection channel;
• current status;
• withdrawal date and resulting action, if applicable.

Review exception counts too. Useful signals include expired permissions, failed withdrawal actions, processing outside scope, duplicate requests, and records without a notice version. A high completion rate does not prove that consent was freely given or legally appropriate.

Common mistakes

Using consent for every activity

Map each purpose and select a lawful basis that fits the facts. The presence of a consent form does not make consent the correct basis.

Bundling several purposes into one choice

Separate optional uses such as future-role retention, client submission, marketing, and call recording where separate control is required.

Using vague or open-ended wording

Name the organization, purpose, data use, likely recipients, and withdrawal route. “I agree to data processing” does not explain enough.

Treating a public profile as unlimited permission

Public availability does not remove privacy duties. The firm still needs a lawful basis, transparency, purpose limits, and rights handling where applicable.

Recording consent without honoring withdrawal

Connect the withdrawal route to suppression, deletion, restriction, and downstream notification workflows. Test the full path, not the form alone.

Automation and AI impact

Recruiting software can capture consent status, link a notice version, set expiry rules, send renewal requests, and trigger a restriction or deletion workflow. Recruiterflow provides GDPR settings that can contact candidates when a configured consent period expires and record their response. Product Marketing should confirm the current behavior before publication.

AI-supported recruiting may introduce new purposes, such as transcription, inference, matching, or automated evaluation. Existing consent for profile retention does not automatically cover those uses. Teams should document the data flow, check whether consent is the correct basis, update notices, and add a separate choice where required.

Practical checklist

• List every purpose involving candidate data.
• Identify the controller, processor, or joint-controller roles.
• Select and document the legal basis for each purpose.
• Use separate choices for distinct optional activities.
• Keep requests short, plain, and specific.
• Record the wording, version, action, time, scope, and status.
• Give candidates an easy withdrawal route.
• Connect withdrawal to downstream systems and recipients.
• Test retention, suppression, deletion, and audit reports.
• Obtain qualified privacy or employment-law review.

Questions recruiters ask

Do recruiters always need candidate consent before storing a profile?

No. The answer depends on the jurisdiction, collection source, purpose, and legal basis. GDPR permits several lawful bases. Recruiters still need transparency, purpose limits, data minimization, retention controls, security, and rights handling.

Is consent required before sending a candidate to a client?

Many agencies obtain clear permission before submission as a trust and process control. Whether data-protection consent is legally required depends on the relevant law and the legal basis selected. Record the candidate’s permission, named client, role, and scope.

Can a candidate withdraw consent?

Yes, where processing relies on consent. Under GDPR, withdrawal must be possible at any time and should be as easy as giving consent. The organization must stop future processing that has no other valid basis.

Does accepting a privacy notice count as consent?

No. A privacy notice explains processing. Consent requires a distinct, informed, affirmative choice. Do not turn a notice acknowledgment into a bundled consent statement.