GDPR Compliance checklist for recruiters

GDPR is coming. Hopefully, you already know your responsibilities and obligations, and your data subjects will soon understand their new rights and entitlements. The next stage in GDPR compliance for recruitment companies is to make sure that you have all of the facilities that you will need to manage the extra workload.

That means staff and software solutions.

No two businesses are the same, and it is impossible to predict how your data subjects may exercise their new rights, once they come into force.

GDPR exposure must therefore be assessed on a case-by-case basis. Not preparing for a worst-case-scenario will always be a gamble – and one that could prove costly if you are unfortunate.

Every contingency plan requires a To-Do list. So here is the eBoss, quick-glance checklist of tasks to complete before GDPR Day arrives.

UPDATE Friday 14th March, 2018: eBoss has now launched a GDPR Hub. Visit us there for all news and updates relating to GDPR compliance for recruitment enterprises.

1. Build a stong foundation

GDPR affects every part of your data handling operations. In our interconnected digital age, that essentially means that every division of your enterprise will need to show compliance.

The fundamental aspect of GDPR is ‘Privacy by design’. This means that you are required to show that security has been factored into your system’s development, at every stage. If your software systems cannot guarantee data compliance out of the box, get one that can.

2. Secure your property

GDPR regulates the handling of all data, regardless of its location or means of storage. That means you are responsible for the protection of personal data against physical and virtual attack.

Your online and cloud-based data should be encrypted and pseudonymised. This way, it may remain secured even if your systems are compromised. Although it is not an obligation, it is best practice, as laid out in GDPR guidelines.

Because hacks make the headlines, online storage has received most of the focus. However, all data must be recoverable. This means that you are in breach of GDPR even if you lose data due to physical damage (eg fire and flood), or from theft. If you possess offline databases and off-site hardware, you must make sure that all files are stored safely and backed up.

3. Choose the right friends

Your data subjects’ information is your responsibility, even when kept off-site.

You can think of it like this: if your business is your home, then your service providers are like the neighbourhood watch.

Choose the right friends for your business, so that you can be confident that your data is always safe in their hands.

4. Get permission first

GDPR requires businesses to obtain clear and explicit consent from their data subjects in many situations.

Existing agreements do not cover the full reach of GDPR, and you must also explain the individual’s right to object to having their data stored.

This could mean contacting each data subject in person, and obtaining authorisation from them. Creating a paper trail will demonstrate to regulators your attempts to remain compliant. In practical terms, using a simple SMS or mailing solution, and asking your contacts to re-state their approval – while explaining new entitlements – should do the job.

5. Check their ID

Third parties may not exercise the rights of a data subject on the behalf of others. It is up to you, as a data processor, to verify the identity of every individual making a data request, before you comply.

(NB: There is a technical exception to this rule, covering the data of children. While this is unlikely to affect GDPR compliance for recruitment companies, businesses should note that adults can act as legal guardians on behalf of minors).

6. Meet your deadlines

GDPR standardises deadlines for data requests.

When a data subject makes a request, you have one month to respond. Especially complex or sizeable inquiries may trigger a two-month extention, though only in exceptional cases.

7. Correct your mistakes

If your databases contain errors, then individuals can now insist that data controllers correct mistakes in relation to their own personal data.

Ensuring you have the facilities, and the additional personnel, on hand to complete these tasks should pose no practical difficulties for recruiters. However, many managers will prefer to start preparing early when it comes to budgeting for potential staffing increases.

8. Carry the costs

You may have read all of the above points and understood your obligations and asked: “who is going to pay for all this extra work?”

The short answer is: you are.

You may not charge data subjects if they request access to, or a copy of, their personal information. Conditional allowances are made for repeated or complicated data requests; these may be charged a cost-covering fee to be undertaken.

9. Prepare for portability

GDPR now makes it possible for all data subjects to request a digital copy of their personal information, free of charge.

Perhaps more than any other point in our checklist, it is this aspect of GDPR that may create the most significant workloads and challenges – especially for SMEs on finite resources.

A high volume of data requests has the potential to test your existing systems to breaking point, and should not be under-estimated.

Assess the potential disruption, and ensure you have the facilities to cope with increased drain on bandwidth, servers, and mailing systems.

10. Understand that No means No

Subjects can now request that, as a data controller, you cease the collection and processing of their personal data.

If you attempt to dispute a challenge, you must be able to demonstrate a legal necessity to continue. Failure to comply with this or any other point of GDPR compliance can result in a fine of €20 Million, or 4 per cent (4%) of your company’s annual turnover. The most serious breaches can earn an increased €100 Million fine.

That, then, is our GDPR compliance checklist for recruiters. While we have kept each point deliberately broad, the letter of the law tells us that you will be very close to compliance on day one, if you can check off all ten.

Keep your hardware safe and your data backed-up. Choose trustworthy service providers, and – if your staff are already working flat out – consider making a new hire or two. Once you have all that sorted, you should find GDPR compliance just about bearable! Good luck.

Still feel like you need more advice? Or just eager to learn more? eBoss has a dedicated team of support staff, on-hand to discuss all of your GDPR compliance issues with you. Our latest recruitment software has been rigorously tested to ensure GDPR compliance, out of the box – so that you will have the confidence of knowing that you are ready for GDPR Day.