Your Agency
Recruitment Agency GDPR Pack
A browser-based working toolkit for recruitment agencies handling candidates, clients, vacancies, CVs, right-to-work documents, DBS/screening data, payroll data and marketing records. Updated for the Data (Use and Access) Act 2025 changes in force in 2026.
Settings
Reusable business details for headers, generated text and exports.
Your logo and colours are saved with your data (Save button, or automatically with Backup). Upload once and every printed policy, register and log carries your branding.
Agency Profile
Define the recruitment model, candidate groups, client types and data-heavy processes.
Record of Processing Activities
Document recruitment processing operations, including purposes, data categories, lawful basis, recipients, retention and safeguards.
Candidate Privacy Notice Generator
Create a recruitment-specific privacy notice for candidates, contractors and temporary workers.
Candidate Intake & Source Log
Record where candidate data came from, what information was collected, and why it is being used.
CV Sharing & Client Submission Log
Track when candidate CVs/profiles are sent to clients and what basis/controls apply.
Candidate Consent & Marketing Permissions
Track consent, job alerts, marketing preferences and candidate communication choices.
Lawful Basis & Legitimate Interests Assessment
Assess recruitment activities where legitimate interests may be relied on, such as candidate sourcing or client business development.
DSAR & Rights Request Tracker
Track subject access, rectification, erasure, restriction, portability and objection requests, including the 2026 SAR clarification and reasonable-search rules.
Suppression, Erasure & Do-Not-Contact Log
Keep a minimal record of people who should not be contacted or whose data has been erased/restricted.
Recruitment Data Retention Schedule
Set retention periods for candidate, client, payroll, screening and vacancy records.
Special Category & Criminal Offence Data Register
Document higher-risk recruitment data, such as health adjustments, DBS checks and criminal offence data, including any use in automated decisions.
Data Breach & Incident Log
Record incidents affecting candidate, client or worker data and your assessment/response.
Processor & Supplier Due Diligence
Track recruitment technology and suppliers that process personal data for the agency.
Client & Third-Party Data Sharing Record
Document controller-to-controller sharing and routine data disclosures.
International Transfer Register
Track overseas processing or support access by recruitment systems and vendors using the current UK transfer terminology and data protection test.
Website, Cookies & Job Applicant Tracking
Record job application tracking, analytics, cookies, pixels and recruitment marketing tools against the current PECR storage-and-access rules.
Staff GDPR Training & Access Review
Track staff privacy training and access to candidate/client systems.
Data Protection Complaints Log
Record and manage data protection complaints under the Data (Use and Access) Act 2025 complaints requirements in force from 19 June 2026.
Automated Decision-Making & AI Recruitment Review
Assess AI screening, automated ranking, testing and other recruitment decisions against the UK GDPR automated decision-making rules as amended by the Data (Use and Access) Act 2025.
Annual GDPR Compliance Review
A yearly check for recruitment agencies to keep records, notices and controls current, including the DUAA 2025 changes now in force.