GDPR legitimate interest in recruitment: when it works, stage by stage

Under the GDPR and UK GDPR, legitimate interests (Article 6(1)(f)) is the lawful basis most recruitment processing rests on: reading CVs, shortlisting, interviewing, assessing and verifying candidates. Legal obligation covers checks a law requires, and the UK ICO's draft guidance says the contract basis applies only once a candidate has accepted an offer. Legitimate interests needs three cumulative conditions, assessed and documented before you start: a legitimate interest, processing that is necessary for it, and a balance that the candidate's interests and rights do not override. Candidates must be told the interest you rely on and can object. It never covers special category data on its own, and consent is rarely the better choice in hiring because of the imbalance of power.

This page applies those rules stage by stage, from sourcing to the talent pool, as of October 2026. For the specific case of recording and transcribing interviews, including a worked assessment for screening calls, see recording interviews under UK GDPR.

What does Article 6(1)(f) actually require?

The EDPB's guidelines, version 1.0 adopted for consultation in October 2024, summarize the case law in three cumulative conditions: "the pursuit of a legitimate interest by the controller or by a third party"; "the need to process personal data for the purposes of the legitimate interest(s) pursued"; and that the person's interests or fundamental rights "do not take precedence." The UK ICO describes the same thing as the purpose, necessity and balancing tests.

Two details recruiters miss. First, reasonable expectations are not created by a privacy notice alone: the EDPB says meeting the information duties in Articles 12 to 14 "is not sufficient in itself" to make processing expected, and that common practice in a sector does not settle the question either. Second, the written assessment: the ICO says the UK GDPR does not require a legitimate interests assessment (LIA) on paper, but you must apply the three tests and it recommends recording them. The EDPB says the assessment should be done and documented before processing begins. In practice, write one per purpose.

On the purpose test, the Court of Justice confirmed in Case C-621/22, KNLTB (October 4, 2024) that a commercial interest can be legitimate if it is lawful. That helps agencies, whose interest in placing candidates is commercial, but it does not lower the necessity or balancing bar.

Which lawful basis fits each recruitment stage?

Why not just ask for consent?

Recital 43 says consent "should not provide a valid legal ground" where "there is a clear imbalance between the data subject and the controller." Someone who wants a job is not in a position to refuse freely. The ICO's draft recruitment guidance makes the same point, that because of the likely imbalance of power, consent "is unlikely to be an appropriate lawful basis to use at most stages of the recruitment process." It goes further for agencies: "You must not rely on consent in order to consider a candidate for multiple roles, or future roles," because that consent would not be specific, granular and informed, so agencies "are most likely to rely on the legitimate interests basis." Consent also fails operationally: if a candidate withdraws it halfway through an interview loop, you must stop, and switching to another basis after the fact is not a fix.

Consent keeps a narrow place for genuinely optional extras a candidate can refuse with no effect on the application, such as, in the ICO's equality monitoring example, keeping monitoring data beyond its original purpose only with an explicit opt-in.

How do you write a legitimate interests assessment for sourcing?

Sourcing is where legitimate interests is most often relied on and least often documented. An example, with invented details, for an agency that searches LinkedIn for passive candidates:

Legitimate interests assessment: sourcing candidates from professional networks
Organization: [Example Search Ltd]   Owner: [name]   Date: [date]   Review: [date]

1. PURPOSE
Interest: identifying and approaching qualified candidates for specific
live vacancies we are retained or engaged to fill.
Benefit to candidates: being told about relevant roles they may want.
Lawful and specific: yes, tied to named vacancies.

2. NECESSITY
Data collected: name, current and past job titles and employers,
skills, location (city), public professional profile URL, our notes on
fit for the named role.
Not collected: photos, age, personal social media, family details,
anything not on a professional profile.
Less intrusive alternative? Job adverts alone do not reach passive
candidates; we contact only people whose profile matches the role.

3. BALANCING
Reasonable expectations: candidates published a professional profile on
a recruitment-oriented platform; the ICO's draft guidance treats this
use as reasonably expected.
Impact: low; an unsolicited message about a job.
Safeguards: Article 14 notice in our first message with a link to our
candidate privacy notice; right to object stated separately in that
message; records of people who are not interested are deleted after
[period], except a minimal record so we do not contact them again;
no automated decisions; access limited to the consultants on the role.

OUTCOME: legitimate interests applies, subject to the safeguards.
Reassess if: we start bulk scraping, use AI to rank profiles, or keep
profiles for roles that do not yet exist.

Notice timing is the point people get wrong. Article 14(3) requires the privacy information within a reasonable period and "at the latest within one month," or, if you use the data to contact the person, "at the latest at the time of the first communication," and, if you plan to disclose it to someone else such as a client, at the latest when you first disclose it. For agencies, that last limb means the candidate hears from you no later than the moment their profile lands in a client's inbox, and in practice before. The content of the notice is in our candidate privacy notice template.

Two UK-specific limits from the ICO's draft guidance on finding candidates. Searching recruitment-oriented platforms may be reasonable, but "you should not search for candidates on their personal social media profiles, even when these are public-facing." And "direct messaging on social media constitutes direct marketing and electronic mail" under the Privacy and Electronic Communications Regulations, so a sourcing message has to meet those rules as well as the GDPR.

What do regulators say about social media checks?

The former Article 29 Working Party, the EDPB's predecessor, addressed this directly in Opinion 2/2017 on data processing at work. It said employers "should not assume that merely because an individual's social media profile is publicly available they are then allowed to process those data for their own purposes." A legal ground such as legitimate interest is required, the employer should first consider whether a profile is business or private, and collection is limited to what is "necessary and relevant to the performance of the job." Its example allows a review of public information only where it is necessary for the job, such as assessing specific risks for a particular function, and candidates are told, for instance in the job advert. It adds that there is no legal ground to require applicants to "friend" the employer.

The ICO's draft guidance reaches a similar place with a worked example: a charity hiring for a public-facing role tells candidates it will search their public social media, asks about it at interview so they can respond, and runs the three-part test, while noting the checks can have a high impact because they may stop someone being employed. If you cannot write that justification for a role, do not run the check.

Can you keep unsuccessful candidates in a talent pool?

Yes, with care. The same Opinion says recruitment data "should generally be deleted as soon as it becomes clear that an offer of employment will not be made or is not accepted," and, in a footnote citing the Council of Europe's employment recommendation, that an employer wanting to keep data for a future opportunity should tell the person and let them object, deleting it if they do. The ICO's draft guidance on keeping recruitment records gives the example of a firm keeping the top ten candidates' details for six months in case a further vacancy arises, having said so on the application form.

A defensible talent pool under legitimate interests has four features:

• Candidates are told at the point of collection that you keep details for future roles, and for how long.
• The period is short and stated, with records deleted at the end unless the candidate re-engages.
• The right to object is easy to use and honored straight away.
• The pool is used for similar roles, not as a general marketing list.

Do not reach for consent to justify a bigger or longer pool: as above, the ICO's draft rules out consent for considering candidates for future roles. If the balancing test fails for a broad, open-ended pool, shrink the pool. The retention periods themselves belong in your retention policy.

What happens when a candidate objects?

Article 21(1) gives the right to object to processing based on legitimate interests. You must stop "unless the controller demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject or for the establishment, exercise or defence of legal claims." Article 21(4) requires the right to be "explicitly brought to the attention of the data subject" at the latest at the first communication, "clearly and separately from any other information." A line buried in a long notice does not do that.

Objections often arrive with access or erasure requests; the handling, deadlines and reply wording are in candidate data access requests.

What is different in the UK after the Data (Use and Access) Act 2025?

• Recognised legitimate interests. Section 70, in force since February 5, 2026 under SI 2026/82, added a short list of pre-approved purposes that need no balancing test. The ICO's guidance lists five: public task disclosure requests, national security and defense, emergencies, crime, and safeguarding. Recruitment is not among them, so the ordinary three tests still apply.
• Automated decisions. Section 80, in force on the same date, replaced Article 22 with Articles 22A to 22D, which allow significant decisions based solely on automated processing with safeguards: information, the ability to make representations, human intervention and a way to contest. Stricter limits apply to special category data.
• Complaints. Since June 19, 2026, controllers must make it easy to complain and acknowledge complaints within 30 days (section 103).
• Guidance status. The ICO's recruitment and selection guidance was still marked draft and under review for the Act when we checked in October 2026.

What mistakes come up most often?

• Relying on "legitimate interests" in the notice with no assessment behind it.
• One assessment for all of recruitment, rather than one per purpose: sourcing, recording, AI scoring and talent pools have different balances.
• Sending a sourced candidate's profile to a client before telling the candidate.
• Treating public data as fair game, which the Working Party rejected explicitly.
• Forgetting that health, ethnicity or religion volunteered in an interview need an Article 9 condition, and training interviewers to note the job-relevant fact, not the characteristic.
• Keeping the talent pool forever because nobody set a period.