RECRUITMENT AGENCIES

POPIA for recruitment agencies: candidate data checklist

Recruitment agencies handle information throughout a candidate's working life. A CV received for one vacancy can later enter a talent pool, reach several clients or be processed by screening and software providers. Record those separate uses so your notices, permissions and actual workflow stay aligned.

By POPIA Check · AI-assisted practical guidance · Editorial update 18 October 2026 · General information, not legal advice

Start free assessment View sample report

Trace a candidate record from application to closure

Stage	What to examine	Evidence to gather
Application or sourcing	What is collected, where it came from and how the candidate is informed.	Application form, sourcing process and notice version.
Recruiter notes and screening	Whether notes and checks are relevant, accurate and restricted to the necessary people.	Assessment criteria, access list and screening review.
Client introduction	Which version of a CV is sent, why it is shared and how recipients protect it.	Handover process, recipient record and reviewed terms.
Talent pool	Whether ongoing storage and later use match the stated purpose and applicable conditions.	Talent-pool rules, candidate choices and review dates.
Closure or rights request	Where copies remain and how corrections, objections and retention decisions reach them.	System inventory, response log and retention schedule.

Priorities for your recruitment team

Separate active applications, speculative CVs, employee records and talent-pool activities in your inventory.
Record how sourced information enters the database. Public availability does not remove the need to assess applicable processing conditions.
Review the fields and notes collected at each stage. Flag unnecessary identity numbers, health details and unrelated personal commentary.
Check the sharing process before forwarding a CV to a client. Review purpose, notice, lawful processing and recipient responsibilities.
List applicant-tracking, interview, testing, payroll and screening providers, including subprocessors and storage countries.
Set justified review triggers for inactive candidates and unsuccessful applications. Include inboxes, exports and recruiter devices.
Test a candidate correction or objection request across the applicant-tracking system and relevant recipients.
Make a secure incident route clear to recruiters, including accidental emails and exposed candidate folders.

Worked example: a CV added to a talent pool

A candidate applies for one vacancy. After the role closes, the recruiter keeps the CV for future searches and uploads it to another platform. Treat the future-use decision and new provider as review points. Record the purpose, what the candidate was told, the applicable ground and retention review. Confirm access and international hosting arrangements. Use a reference in your register, not the candidate's CV or contact details.

Screening and automated decisions need extra attention

Criminal-behaviour, health and other special personal information can engage additional requirements. Automated ranking or rejection can also require a closer assessment, particularly where a decision has legal or substantial effects. Record the purpose, information used, decision process and available human review, then obtain advice on the applicable conditions. A general questionnaire cannot approve a screening product or an automated hiring decision.

Prepare a useful discussion with your adviser

Bring a redacted application workflow, current candidate notice and examples of sourcing and client handover messages.
Locate supplier terms, screening documentation and the retention rules used by recruiters.
Explain whether you recruit for children, handle special personal information or send records across borders.
Identify whether talent-pool messages are vacancy communications, direct marketing or another activity requiring a separate review.
Bring the assessment's unanswered questions and an action plan with owners, rather than only a policy document.

Build your evidence, then assess the wider business

Start with the toolkit's information inventory, supplier register, rights request tracker and action plan. The 40-question assessment then covers the broader controls behind recruitment. The separate website check looks at public-page evidence; it cannot inspect your candidate database or confirm that a hiring process is lawful.

Common questions

Can we keep every CV for future vacancies?

Do not assume indefinite retention or a new use is justified. Review the original purpose, the information given to candidates, the relevant conditions and an appropriate retention decision.

Does a candidate's consent solve every issue?

No. Review necessity, purpose, transparency, security, retention and any special-information requirements as well as the relevant lawful ground. Consent does not replace the other conditions.

Will POPIA Check review individual candidate records?

The public assessment records your answers about business controls. Do not upload CVs or identity documents to it. Discuss restricted evidence with an appropriate adviser through an agreed secure route.

Sources and further reading

Editorial guidance from POPIA Check, with links to primary sources. Ask your selected legal partner how the law applies to your organisation. These AI-assisted materials have not been presented as a legal partner’s reviewed advice.