Most recruitment processing does not need consent. Considering an application can usually rest on legitimate interests or on steps taken at the candidate's request before a contract. Consent is the right basis for extras, such as keeping a candidate in a talent pool, using their data for future roles, sharing it with other companies or running optional checks. Valid consent is freely given, specific, informed and unambiguous, recorded and as easy to withdraw as to give. Do not make it a condition of applying if the processing is not necessary for the application. This is general information, not legal advice, as of October 2026. Your lawful basis depends on your location and facts.
Choosing the wrong basis creates problems later, for example when someone withdraws consent that you did not need.
Lawful bases for recruitment data
Under the GDPR and UK GDPR, you need a lawful basis for each purpose. Common ones in recruitment:
| Purpose | Likely basis | Notes |
|---|---|---|
| Considering an application for the role | Legitimate interests, or steps before a contract | Tell candidates; do a balancing test for legitimate interests |
| Contacting the candidate about the application | Same | |
| Interviews, assessments, decisions | Same | |
| Defending legal claims | Legitimate interests or legal obligation | Retain for the limitation period |
| Keeping the application for future roles | Consent, or legitimate interests with a clear opt-out | Consent is common and simple |
| Sharing with a third party for their use | Consent | |
| Optional marketing or newsletters | Consent | |
| Special category data (health, ethnicity) used for monitoring or adjustments | A specific condition under Article 9, and sometimes consent | Take care and advice |
For a plain-language overview, see GDPR and recruitment data.
What valid consent looks like
- Freely given: no pressure, and no penalty for saying no. Do not tie it to the application if it is not needed for it.
- Specific: one purpose per consent. Do not bundle talent pool, marketing and sharing.
- Informed: say who you are, what data you keep, why and for how long.
- Unambiguous: an active step, such as ticking an unticked box.
- Withdrawable: as easy to withdraw as to give, with a clear route.
- Recorded: keep a record of who consented, when, to what and how.
Pre-ticked boxes and silence do not count.
Example wording for a talent pool
"We would like to keep your details so that we can contact you about future roles that may suit you. If you agree, we will keep your application for 12 months and then delete it unless you ask us to keep it longer. You can withdraw at any time by emailing [address]. Saying no does not affect your application for this role. [ ] Yes, keep my details for future roles."
Notice that the box is separate, the period is stated and the application is not affected.
Consent and special category data
Information about health, disability, ethnicity, religion, sexual orientation and similar matters needs extra care. You may need it, for example to arrange adjustments or to monitor fairness, and a specific legal condition applies. Keep it separate from decision makers, explain the purpose clearly and collect it only if voluntary where the law requires. See reasonable adjustments in hiring and the four-fifths rule.
Withdrawal and records
When someone withdraws consent:
- Stop the processing that relied on it.
- Delete the data held only on that basis, unless another basis applies.
- Confirm in writing.
- Keep a record that they withdrew.
See candidate right to erasure for the process. Keep consent records for as long as the processing continues and for a time afterwards, in case you need to show compliance.
Interaction with other duties
Consent does not remove other duties: you must still be transparent, minimise data, keep it secure and apply retention limits. See candidate data retention. If you use automated tools in decisions, consent to data processing does not replace notices or rights relating to automated decision making. See candidate AI disclosure.
Outside Europe
Other places have their own rules. Some US states have privacy laws that cover applicants, and notice requirements for certain tools exist in places such as New York City and Illinois. See NYC Local Law 144. Check the laws where your candidates live.
Practical setup
- List the purposes for which you use candidate data.
- Assign a lawful basis to each, with a short note on why.
- Ask for consent only where it fits, and word it separately.
- Put the details in your privacy notice and on the application form. See job application form design.
- Record consents and withdrawals.
- Review annually.
Common inquiries regarding this topic.
Do you need consent to process a job application?
Often not. Under the GDPR, handling an application to decide whether to hire someone can rely on legitimate interests or on steps taken at the person's request before a contract, rather than consent. Consent is more commonly needed for extras, such as keeping a candidate in a talent pool or sharing data with third parties.
Often not. Under the GDPR, handling an application to decide whether to hire someone can rely on legitimate interests or on steps taken at the person's request before a contract, rather than consent. Consent is more commonly needed for extras, such as keeping a candidate in a talent pool or sharing data with third parties.
The Resume World Team
VerifiedProduct & hiring research, Resume World
We build the screening engine behind Resume World. Everything here comes out of working on resume parsing, scoring and hiring workflows day to day — including the parts that turned out harder than expected.
See more than just keywords.
Resume World extracts verifiable evidence from every applicant against role criteria and delivers an explained, ranked shortlist. 100% free to start with zero card required.
