How to source candidates in a GDPR-compliant way with Workable

The General Data Protection Regulation (GDPR) is the new European data protection law and it applies to all organisations that process the data of EU residents. To protect people’s privacy, GDPR places restrictions on how you can collect and process personal data. What does GDPR mean for recruiters? By default, the recruiting process relies on processing candidate data, which means that your organisation will need to comply with GDPR. One of the toughest tasks is to make sure the way you source passive candidates is compliant. But this doesn’t mean that you need to stop sourcing, just that you should make some changes to satisfy the GDPR requirements.

Workable itself is a GDPR-compliant vendor. In addition, it provides tools to help with your own compliance. Our GDPR-related features include support for sourcing and the automation of certain tasks, like deleting old candidate data. For sourcing specifically, here’s a breakdown of the features available with every PRO plan:

  • A template to help you create an effective recruitment Privacy Notice.
  • A footer, automatically added to every sourcing email, linking to your Privacy Notice.
  • A setting to send an automated bulk email with your Privacy Notice to existing candidates (sourced before the GDPR came into effect).
  • A setting to auto-delete the profiles of sourced candidates who haven’t been contacted within a month.

Want to learn how Workable helps your entire recruiting process stay compliant? Get a demo to explore our full GDPR feature pack with functions like candidate consent requests and ways to action the ‘right to erasure’.

How do our GDPR features for sourcing work? Here’s a closer look:

Turn on GDPR settings

Once activated, our GDPR features run by default across your account. Set them up quickly and easily by sliding a single button to ‘On’:

gdpr compliance with Workable ATS

Then, you’ll be able to set a few parameters for auto-deletion and craft your own Privacy Notice.

Privacy Notice template

GDPR places great importance on transparency: organisations must tell people why and how they process their personal data, as well as provide easy instructions for people to exercise their rights under GDPR. You can provide all the required information with a Privacy Notice. If you have one written specifically for your company, upload it to Workable and it will be included in every email, whenever you communicate with candidates. If your organisation doesn’t already have one, no problem. A template is provided by Workable, ready for you to customize.

When you switch on the GDPR features, the first thing you’ll be asked to do is establish the details for your own Privacy Notice:

gdpr privacy notice template Workable ATS

Fill out the fields to generate a Privacy Notice for your organisation. If you already have one, use the option at the top right “I want to use our existing Privacy Notice.” You’ll be asked to verify that you’re happy with your own document and that it’s legally compliant.

Once you set up your Privacy Notice via the Workable template, you can preview. Here’s what a sample looks like:

GDPR privacy notice preview Workable ATS

You’ll see your notice included in the first email that candidates receive from you – both when they apply and when they’re sourced. For example, a job applicant will receive an automatic “thank you for applying” email that contains a link to this Privacy Notice.

Sourcing email footer

Your Privacy Notice should be sent to all EU candidates on first contact. Candidates who apply to your jobs will receive an automatic email confirming their application. This includes the Privacy Notice as standard.

But sourced candidates follow a different path. They don’t initiate contact with your organisation, so they won’t automatically receive the email with your company’s processing information. This means that you should include your Privacy Notice in your first sourcing emails. Workable helps you do that by automatically including a footer linking to your Privacy Notice when you first start writing an email to the candidate:

GDPR recruitment

This helps ensure you’re sending the right information to candidates from the outset, minimising the possibility of error or omission.

Keep in mind that GDPR lets you store sourced candidate data for only a month without contact. If you keep this data longer than that you risk getting a fine. That’s why Workable has built data retention settings.

Data retention

The data retention options play a big part in compliance. Under GDPR, you can’t process candidate data indefinitely. You must also delete candidate data if you haven’t provided your Privacy Notice to the candidate within a month of sourcing their details. But if you’re sourcing multiple candidates, how can you remember to delete their information from your database when the legal period has passed? And how can you stay compliant without losing a huge amount of time manually deleting every candidate?

Workable’s data retention options tackle these issues. There are two features that you’ll be asked to turn on after you’ve created your Privacy Notice:

GDPR recruitment data retention

By turning on the first data retention option, you enable Workable to delete old candidate data automatically. What ‘old’ means is up to you; you’re able to set a specific number of months (which should ideally be less than a year):

GDPR recruitment delete candidate

This is a way to clean up your candidate database, removing old sourced candidate profiles (and profiles of candidates who applied a long time ago.) If there’s been no recent contact, Workable will automatically delete them to help you remain compliant without any time lost on your part.

By turning on the second option, you enable Workable to delete candidates if they stay in your database for more than a month without receiving your Privacy Notice:

GDPR recruitment automatically delete candidates

This helps you avoid storing candidate data for longer than the legal period. If you want to keep processing the data of a candidate you sourced, send them your first sourcing email (with the automatic privacy footer) within a month.

Automated bulk email with processing information

Once you turn on your data retention settings, Workable will show you an overview of your candidate database: If you’re new to Workable, then there will be very few candidates that will be affected by the deletion settings. If you’ve been using Workable for some time, then you will have more candidates in your database who will be affected straight away.

gdpr compliance with Workable ATS

This shows how many candidates in your database will be deleted. Also, you can see how many haven’t yet received your Privacy Notice. If you click on “Email them with a link to the new Privacy Notice”, these new candidates receive an automatic email containing your processing information (and can, therefore, remain in your database until they become ‘old’ based on your settings). Here’s an example of a bulk email to candidates who have been contacted by your hiring team before:

GDPR recruitment preview notification email - Workable ATS

With this email, you ensure transparency in how you’re processing candidate personal data.

Once you’ve turned on the GDPR settings, save the changes and you’re good to go. Our GDPR features will run by default and help you remain compliant when sourcing and recruiting candidates. Your reporting won’t be affected by automatic candidate deletion. This way, Workable provides you with the tools to manage and monitor your recruiting function while minimising the burden of GDPR compliance.

Related:
GDPR compliance checklist for recruiters and HR
GDPR Readiness Evaluator

Looking for an all-in-one recruiting solution? Workable can improve candidate sourcing, interviewing and applicant tracking for a streamlined hiring process. Sign up for our 15-day free trial today.

Get a free trial

Nikoletta Bika

Nikoletta Bika is a writer and a researcher at Workable. She writes about all things HR and recruiting, with a particular interest in metrics, laws, interviews and technology. She's a relentless editor and loves to sneak in Oxford commas in her drafts. She tweets @Nikoletta_Bika.

Related to this

Why and how to conduct video interviews with Workable

With one-way video interviews, you can screen candidates faster and avoid the hassle of sc...

How to use the Workable mobile app for hiring

It’s 8.30am and you’re on your way to the office. You have a hunch that today is going to ...

Why and how to use the Workable API for integrations

Workable is recruiting software to manage the entire hiring process. It provides a complet...

All in one recruitment software Sign up