# Recruitment Data Protection and Privacy: practice workbook
Talent Engineering Academy | An education initiative by Vitae
Edition 2026.09 | Updated 2026-09-24
Course: https://talentengineering.org/courses/recruitment-data-privacy

Map personal information through recruitment and design practical controls for purpose, access, retention and requests.

## Your deliverable
A recruitment data inventory and handling checklist.

Use fictional information. Keep your completed work in your own secure notes. Exercises and capstone work are self-directed, not independently assessed.

## 1. Purpose and categories of information

Your notes:



## 2. Source, recipients and systems

Your notes:



## 3. Applicable basis and specialist review

Your notes:



## 4. Access, security and retention decisions

Your notes:



## 5. Transparency and rights-request route

Your notes:



## 6. Deletion, correction and vendor exit tests

Your notes:



## Lesson exercises

### 1. Map information by purpose

Map five data categories across collection, use, sharing and storage for a fictional search.

Your response:


Worked example: A team discovers that interview recordings are copied into a general AI workspace even though the recruitment system has restricted access. The inventory includes that secondary copy and questions whether it is needed and approved.

Self-review guidance: Name each purpose and recipient. Include shadow copies such as exports and transcripts. Mark unresolved legal-basis or role questions for the responsible privacy specialist rather than guessing.

### 2. Minimise collection and control access

Design an access matrix for researcher, recruiter, interviewer, hiring manager and administrator.

Your response:


Worked example: A panel needs evidence for its assigned criteria, not every candidate message or an adjustment request’s private details. The pack contains the necessary assessment material and practical arrangements only.

Self-review guidance: Explain the purpose of each permission and remove unnecessary access. Include how temporary access expires and who checks it. A job title alone should not grant unrestricted visibility.

### 3. Plan transparency, retention and requests

Create a request-routing checklist and a retention-decision table with placeholders for approved periods.

Your response:


Worked example: A candidate correction must update the ATS and a shortlist already sent to a panel. The request workflow identifies both locations and confirms the correction, rather than changing only the visible profile.

Self-review guidance: Use purpose, owner, trigger and affected systems. Do not invent a universal retention period. Include verification of downstream copies and an escalation path for disputed or complex requests.

### 4. Check suppliers and test the controls

Write six supplier questions and a fictional deletion test with expected results.

Your response:


Worked example: A demo account offers a delete button but leaves data in exported evaluation files. The buyer asks for an end-to-end deletion procedure and tests it with synthetic records before approval.

Self-review guidance: Include secondary copies, subprocessors, access, training use, retention and exit. Record what is evidenced versus merely asserted by the supplier and route unresolved issues to the accountable owner.

## Portfolio review
Check that your work is internally consistent, distinguishes facts from assumptions, names decision owners and explains its limitations. Revise gaps before using the method in real work.

## Further reading
- [ICO: Recruitment and selection](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/employment/recruitment-and-selection/): UK guidance. Check its current status and updates before implementation.
- [GOV.UK: Responsible AI in recruitment](https://www.gov.uk/government/publications/responsible-ai-in-recruitment-guide/responsible-ai-in-recruitment): UK guidance on procuring and deploying recruitment AI.

Original educational scenarios. References provide further reading and do not imply endorsement. Check current official rules and appropriate professional advice for real legal, financial or regulated decisions.