Should employers ask job applicants for consent to process their data under the GDPR?

Provided that the processing is limited to what is necessary for the recruitment process, the employer will not need to ask job applicants for their consent to process their personal data under the General Data Protection Regulation (GDPR).

An employer must show that it has a legal basis under the GDPR when it processes personal data. In the case of personal data provided by job applicants as part of a recruitment process, the legal basis is likely to be that processing is necessary for the purposes of the legitimate interests of the employer. The employer will need to process personal data provided by candidates when conducting the recruitment exercise; for example, it will need to assess and record information about their qualifications as part of the selection process. It has a legitimate interest in managing the recruitment exercise effectively to decide to whom to offer a job. Employers are also under a legal obligation to process certain information as part of a recruitment exercise, for example checking that a successful candidate has the right to work in the UK.

Where the processing is necessary for the employer's legitimate interests, or for compliance with a legal obligation, there is no need for the employer to obtain candidates' consent for the processing as an additional or alternative legal basis.

The employer must provide candidates with a privacy notice, setting out, among other things, the purpose and the legal bases for processing their data, and their right to object to the processing in certain circumstances.