Practice areas

GDPR in your firm

You are not currently recruiting but still receive CVs? Is it legal to process personal data?

When you are not currently recruiting but still receive CVs, you must make a decision whether to remove the data or take advantage of it in future recruitment. The second option means for you that you became a controller and therefore you have to comply with the obligation of information under Art. 13 of GDPR. You do not have to comply with the obligation of information if the person who sent you CV could have previously read such information, e.g. visiting our website or his/her CV was provided together with a consent to use his/her data in future recruitments. In this case, CV may be kept by the controller until the consent will be withdrawn. Data should also be removed in a situation where we will no longer process them for future recruitment, e.g. skills of the person who sent you own CV no longer correspond to our needs or you have changed the company profile and you do not intend to conduct recruitment processes, or simply data in CV became outdated.

What about CV of an applicant who has not been selected for a position?

A resume and other recruitment documents of candidates who have not been employed can be kept in order to protect the firm against any claims that might arise in connection with the recruitment process (e.g. claim of discrimination). The legal base for data processing in this case will be Art. 6 par. 1 point “f” GDPR, i.e. the legitimate interests of the would-be employer. The employer does not have to remove the CV immediately after the recruitment, but the firm cannot keep the recruitment documents indefinitely. The period of retention of the CV should be as short as possible, i.e. the employer must use common sense when storing the resume of person have not been employed after the recruitment process. A risk assessment should be carried out and a data processing period should correspond to real threats, including, for example, the candidate's activities during or immediately after recruitment, suggesting that the candidate will file claims against the would-be employer or in the case of very comparable applications. The maximum retention period of storage of documentation is the period of limitation of claims, i.e. three years from the date on which the candidate could and ought to direct claims to the would-be employer at the earliest. At the same time, it should be remembered that a resume kept for protection against potential claims should not be used for other purposes, unless the qualified person has not taken the position. In such a case, the employer may process the personal data of the candidate in order to inform him/her about the vacancy in the position for which he has previously applied.