We are posting a job ad – how do we handle candidates' data correctly from start to finish?

Fill in this table. It takes 15 minutes and becomes the basis of the recruitment entry in your record of processing activities (Article 30(1) GDPR); the entry will also need transfers outside the EEA and a description of security measures.

Our recommendation is one channel. When CVs land in five personal mailboxes, nobody can later find and delete them all.

If a recruitment platform or agency handles CVs on your behalf and on your instructions, it is a processor (Article 4(8) GDPR) and you need a contract with it (Article 28(3) GDPR). If it also uses candidates' data for its own purposes, for example its own database, it is an independent controller (Article 4(7) GDPR). Check what its terms say.

When the candidate sends the CV themselves, Article 13(1) GDPR requires the information to be given at the time the data are obtained, and Article 13(2) GDPR adds, among other things, the storage period, the candidate's rights and the right to lodge a complaint. A short notice in the ad and a link to a fuller candidate notice are enough.

Template for the ad:

Candidate data are handled by [company name, registration number, e-mail]. We will use your CV and answers for this recruitment; these are steps taken at your request before entering into an employment contract. They will be seen by [roles]. If you are not selected, we will delete your data [date or when]. [If applicable: we will keep the selection decision and its reasons until [date] in case of a dispute – this is our legitimate interest.] You may ask to access your data, correct or erase them, and lodge a complaint with the State Data Protection Inspectorate. More: [link].

The legal basis here is Article 6(1)(b) GDPR: processing is necessary "in order to take steps at the request of the data subject prior to entering into a contract". You do not need consent for the recruitment itself.

In the fuller notice, also give: additional contact details, where they must be given; each purpose and its legal basis, and where you rely on legitimate interests, the interest itself; to whom the data may be passed (e.g. the platform or agency) and whether they go outside the EEA; the storage period or how you set it; all the candidate's rights – access, rectification, erasure, restriction, objection and portability; whether a CV is required to take part and what happens if it is not provided; and whether the recruitment system takes automated decisions (Article 13(1)(b)–(f) and 13(2) GDPR). If you will look at candidates' public profiles for the role, say that in the ad too (see below).

Collect only what the purpose needs (Article 5(1)(c) GDPR). The Labour Code says it plainly: it is prohibited to require information unrelated to the person's state of health, qualifications or circumstances directly linked to the work, and information about pay received in current or previous employment (Article 41(1) of the Labour Code (DK)). The rule applies even when no employment contract is concluded.

A practical check for every field in the form:

• Education, experience, languages, driving licence (if the job involves driving) – fine.
• Expected salary – you may ask what the candidate expects.
• Previous or current salary – do not ask; Article 41(1) of the Labour Code prohibits it.
• Marital status, children, date of birth, photo – usually not needed for the job; remove these fields.

Separately from data protection: the Labour Code requires the ad itself to state the offered base pay or its range (Article 25(6) of the Labour Code (DK)).

In interview notes write facts about competences, not personal remarks. The candidate may ask to see them.

The rule has two sides (Article 5(3) of the Law on the Legal Protection of Personal Data (ADTAĮ)): you may call a former employer after telling the candidate, and the current employer only with the candidate's consent. You may ask about qualifications, professional abilities and business qualities. In practice, two questions before you call:

We intend to contact your former employer [name] about your qualifications, professional abilities and business qualities.
Do you agree that we also contact your current employer? ☐ Yes ☐ No

Keep the answer and the date with the candidate's file. Ask only about qualifications, abilities and business qualities – not about health or private life.

The Article 29 Working Party opinion WP 249 (2017, adopted before the GDPR applied; guidance on interpretation, not a binding rule), section 5.1, recommends this: a review is possible only where it is really necessary for the specific role and candidates are informed of it, for example in the job ad. A professional profile and a private one are treated differently. The opinion also says: "There is no legal ground for an employer to require potential employees to" befriend the employer. The legal basis for such a review is legitimate interests (Article 6(1)(f) GDPR), so the notice must also state the interest itself (Article 13(1)(d) GDPR).

An agency proposed a candidate, you found a CV in a database, or someone forwarded it. Then you must also tell the candidate where you got the data from (Article 14(2)(f) GDPR). Inform them within a reasonable time and at the latest within one month; if you first write to or call them earlier, at the latest in that first e-mail or call (Article 14(3) GDPR). The simplest way is to give all the information in the first e-mail or call, with a link to the candidate notice.

WP 249, section 5.1, says that "Data collected during the recruitment process should generally be deleted as soon as it becomes clear that an offer of employment will not be made or is not accepted by the individual concerned". This matches Article 5(1)(e) GDPR: data are kept no longer than the purpose needs. On deletion day, go through this list:

1. the recruitment system or the jobs@… mailbox;
2. every reviewer's mailbox and forwarded e-mails;
3. download folders, shared drives, chat apps;
4. printed CVs and interview notes;
5. the agency or platform – ask them in writing to delete.

If you decide to keep the selection decision and its reasons for a short time in case of a dispute, that is a separate purpose based on legitimate interests (Article 6(1)(f) GDPR). Write down exactly what you keep, for how long and why, and state it in the candidate notice (Article 13(1)(c) and (d) GDPR). It does not need all the CVs. A candidate may at any time demand erasure of data no longer needed for the purpose (Article 17(1)(a) GDPR); this does not apply to what is genuinely needed to defend legal claims (Article 17(3)(e) GDPR).

A talent pool needs a different basis – the candidate's consent (Article 6(1)(a) GDPR). The consent box is shown separately from the application (Article 7(2) GDPR) and is not pre-ticked:

☐ I agree that [company] may keep my CV for [period, e.g. 12 months] and use it only to offer me other vacancies. I can withdraw my consent at any time by writing to [e-mail].

You set the period yourself; 12 months in the template is only an example. "It shall be as easy to withdraw as to give consent" (Article 7(3) GDPR), so the withdrawal address must work. You must be able to prove the consent (Article 7(1) GDPR): keep the date, the form and the text shown at the time. When the period ends, the CV is deleted.

Fill in the first table before your next ad and paste the template at the bottom of the ad. If the record is mandatory for you, enter recruitment in it as a separate activity. With the tool (in Lithuanian) you can find out free of charge whether you must keep a record of processing activities. A record can also be ordered as a one-off procedure – €95 excl. VAT.

Is the website privacy policy enough, or do candidates need a separate notice?
It is enough if the privacy policy has a separate section on candidates and the ad links to it. What matters is that the candidate gets the information when sending the CV.

May we ask for a CV with a photo?
Only if the job needs a photo. Usually it does not, so the form should not have such a field. If a candidate chooses to send a CV with a photo, that is their choice.

How long do we keep CVs of unsuccessful candidates?
Only until recruitment ends. Longer only with consent for a talent pool and only for the period stated in the consent. For a possible dispute you may keep the selection decision and its reasons for a short time, but not all the CVs.

Is a recruitment platform a processor?
It depends on whom it processes the data for. If only for your recruitment and on your instructions – a processor, and you need a contract under Article 28(3) GDPR. If also for its own purposes – an independent controller.

• Employee privacy notice: how to prepare it
• Consent to process data: how to ask for it and prove it
• How long to keep employee data? (in Lithuanian)
• Who signs the data processing agreement and on whose behalf? (in Lithuanian)

The law and the risk: Candidate CVs and ID copies: what an employer may keep – dat.lt

• Informing when data are collected from the candidate – Article 13(1) and 13(2) GDPR.
• Informing when data come from elsewhere – Article 14(2)(f) and 14(3) GDPR.
• Legal basis for recruitment – Article 6(1)(b) GDPR; for a talent pool – Article 6(1)(a).
• Keeping the decision for a dispute and social media review – Article 6(1)(f) GDPR; Article 13(1)(c) and (d) GDPR.
• Exception for legal claims – Article 17(3)(e) GDPR.
• Proving, separating and withdrawing consent – Article 7(1), 7(2) and 7(3) GDPR.
• Data minimisation and storage limitation – Article 5(1)(c) and 5(1)(e) GDPR.
• Right to erasure – Article 17(1)(a) GDPR.
• Controller and processor – Article 4(7) and 4(8) GDPR; processor contract – Article 28(3).
• Record of processing activities – Article 30(1) GDPR.
• References from former and current employers – Article 5(3) of the Law on the Legal Protection of Personal Data (ADTAĮ).
• What may not be required from a candidate – Article 41(1) of the Labour Code (DK); pay in the job ad – Article 25(6) of the Labour Code (DK).
• Social media review and deletion after recruitment – WP 249, section 5.1 (Article 29 Working Party opinion, 2017).

Legal texts checked on 2026-09-25: GDPR – official consolidated English text (02016R0679) with corrigenda; ADTAĮ – e-tar.lt edition in force from 2026-06-30; Labour Code – e-tar.lt edition in force from 2026-06-07 (Article 25(6) of the Labour Code and Article 41(1) of the Labour Code unchanged in the 2026-11-01 and 2027-01-01 editions). This text is general information and is not individual legal advice.