Checks & records
What is candidate data protection?
Candidate data protection is the obligation to handle candidate personal data lawfully — with a valid basis, for stated purposes, kept accurate, and retained no longer than necessary.
Agencies hold large volumes of sensitive data: identity documents, criminal records information, health information and financial details, frequently for people they never placed.
Retention is the recurring failure. Databases grow because nobody deletes, and a candidate registered eight years ago whose documents are still held is data held without a basis.
Criminal records and health data carry additional conditions, which means the general approach to candidate data is not sufficient for the parts of it that matter most.
What goes wrong in practice
- Retention policies written and never applied to the actual database.
- Identity documents retained indefinitely after a placement ended.
- Special category data held under the same arrangements as ordinary data.