GDPR for Recruitment Agencies in Ireland: 2026 Guide
Last updated 4 November 2026. General information only, not legal advice.
Recruitment agencies handle some of the most personal data any business sees: CVs, work histories, references, salary expectations and sometimes health or diversity information. Under the GDPR and the Data Protection Act 2018, an agency is usually the controller of that data, and the Data Protection Commission (DPC) can investigate and fine controllers that get it wrong. This guide sets out what Irish recruitment agencies should have in place.
Why recruitment agencies are a data protection priority
An agency collects data from several directions: candidates apply directly, CVs are downloaded from job boards, profiles are found on professional networking sites, and client employers send back feedback. Each source raises its own transparency question, and the data often passes between several organisations. Regulators look hard at sectors with high volumes of personal data and frequent sharing.
The maximum administrative fines under Article 83(5) GDPR are up to €20 million or 4% of worldwide annual turnover, whichever is higher, for infringements of core principles and individuals’ rights. Most cases end far below that, but the exposure is real. See our guide to GDPR fines and the DPC.
Are you a controller or a processor?
For candidate data, a recruitment agency normally decides why and how the data is used, which makes it a controller. The client employer that receives a shortlist is typically a separate controller for its own hiring decision. Where an agency acts purely on a client’s instructions, for example running a client’s application portal, it may be a processor, and an Article 28 data processing agreement is then needed.
Do not assume the answer. Map each service you offer and decide the role for each one. Where two organisations genuinely decide the purposes and means together, Article 26 requires a transparent arrangement between them.
Lawful basis for each stage of recruitment
Every purpose needs a lawful basis under Article 6. Typical choices for agencies are:
- Matching a candidate to a role they applied for: steps taken at the candidate’s request, or legitimate interests.
- Sharing a CV with a named client: usually the same basis, provided the candidate was told.
- Keeping candidates on a talent pool: consent is a common choice, or legitimate interests supported by a written balancing assessment.
- Marketing job alerts or services: consent or another basis, plus the ePrivacy rules covered below.
Where you rely on consent, it must be freely given, specific, informed and unambiguous, and easy to withdraw. Our GDPR consent guide explains what valid consent looks like. Pre-ticked boxes and bundled terms do not meet the standard.
Transparency: what candidates must be told
Where you collect data directly from a candidate, Article 13 applies at the time of collection. Where you obtain it elsewhere, such as a job board download or a professional networking profile, Article 14 applies. Under Article 14(3) the information must be provided within a reasonable period and at the latest within one month, or at the first contact with the person if you will use the data to communicate with them, or at the first disclosure if you intend to share it.
A candidate privacy notice should cover who you are, the purposes and lawful bases, who you share data with (including categories of client and any service providers), international transfers, retention periods, and the candidate’s rights including the right to complain to the DPC. Keep it in plain language and make it easy to find on your website and application forms.
Retention: how long to keep CVs
Article 5(1)(e) says personal data must be kept no longer than necessary for the purposes. The GDPR sets no fixed period for CVs. You decide a period you can justify, write it into a retention schedule, and then delete on time. Some agencies link the period to the time limit for bringing an employment equality complaint: the Workplace Relations Commission procedures say a complaint must be referred within six months, extendable to a maximum of 12 months for reasonable cause. Others use a shorter or longer talent-pool period, re-confirming interest with candidates before it ends.
Whatever you choose, record the reasoning. Our guide to building a retention schedule shows how.
Special-category and criminal-offence data
Candidates may volunteer health information, disability, or details about their background. Health data and similar categories need an Article 9 condition as well as an Article 6 basis. Data about criminal convictions is restricted by Article 10 and the Data Protection Act 2018. Collect only what is necessary for the role, avoid free-text fields that invite sensitive details, and restrict access internally.
Sharing data and using suppliers
Agencies rely on applicant tracking systems, job boards, cloud storage, background-check providers and marketing platforms. Where a supplier handles candidate data on your behalf, you need an Article 28 contract and due diligence on security and location of data. Check whether any supplier transfers data outside the European Economic Area and what safeguard applies.
Candidate rights
Candidates can ask for a copy of their data, correction, erasure, restriction, and can object to some processing. You normally have one month to respond to a request, which can be extended by up to two further months in complex cases under Article 12(3). Agencies should be able to search CVs, emails, notes and interview feedback quickly. See our guide to data subject access requests.
Marketing, AI screening and security
Marketing by email or SMS to individuals needs consent under Regulation 13 of the ePrivacy Regulations 2011, with a limited soft opt-in for existing customers; B2B email to corporate subscribers works differently. Check the rules before mailing candidates or client contacts.
If you use automated CV screening or AI ranking tools, consider Article 22 (decisions based solely on automated processing), the need for a data protection impact assessment, and the EU AI Act, which treats recruitment AI as high-risk. The application dates have been subject to change, so check the current position.
Security matters too: use access controls, multi-factor authentication, encrypted devices and a tested breach process. A personal data breach may need notifying to the DPC within 72 hours.
A practical checklist for agencies
- Map data flows from candidates, job boards, clients and referees.
- Decide controller or processor roles for each service.
- Record lawful bases and complete a record of processing.
- Publish a candidate privacy notice and give Article 14 notices on time.
- Set and apply retention periods.
- Put Article 28 contracts in place with suppliers.
- Train consultants on CV handling, consent and requests.
- Test your breach and access-request procedures.
For the wider framework, see our GDPR and data protection hub.
Need help with this? Plus Promotions Limited provides GDPR compliance services for Irish businesses, with projects from €995.
Frequently asked questions
What GDPR rules apply to recruitment agencies in Ireland?
Recruitment agencies must follow the GDPR and the Data Protection Act 2018 for all candidate and client-contact data: a lawful basis for each purpose, clear privacy notices, security, retention limits, and respect for individuals’ rights such as access and erasure.
How long can a recruitment agency keep candidate CVs in Ireland?
There is no fixed period in the GDPR. Under the storage limitation principle in Article 5(1)(e), you must set a justified period and apply it. Many agencies tie it to the length of time a candidate could bring a claim or to a stated talent-pool period, and then delete or re-confirm interest.
Do recruitment agencies need consent to keep candidates on a talent pool?
Not necessarily consent in every case, but you need a lawful basis and must tell candidates. Consent is a common choice for talent pools because it is easy to evidence and withdraw. Legitimate interests can also work if you complete and document a balancing assessment.
Can a recruitment agency share a CV with a client employer?
Yes, if the candidate has been told this will happen and it fits the purpose they applied for, normally by name or category of client in your privacy notice. Sending CVs speculatively for roles the candidate has not agreed to is high risk.
Does a recruitment agency need a Data Protection Officer?
Only if Article 37 applies, for example where large-scale processing of special-category data is a core activity or you carry out large-scale regular and systematic monitoring. Many agencies will not meet that test, but the decision should be assessed and documented.
OnlineLegalServices.ie is not a solicitor’s practice and does not give legal advice. Our data protection services are compliance consultancy. For legal advice on your own situation, speak to a solicitor.
