An applicant privacy notice is a short page that tells candidates who you are, what data you collect, why, who sees it, how long you keep it and what rights they have. This guide lists every item to include and gives a template you can adapt, with notes for the UK, the EU and the United States.
Key takeaways
- Show the notice on the application page, before the candidate submits anything.
- Use plain language and short sentences. Candidates are not lawyers.
- Cover: who you are, what data, why, lawful basis, who receives it, transfers, retention, rights, complaints and automated tools.
- Match the notice to what you really do. If your process changes, change the notice.
- Have a specialist read your final version. This guide is a starting point.
Who needs a notice
In the UK and EU, GDPR requires you to give people information about how you use their personal data. This is often called a privacy notice or fair processing notice. If you collect data directly from the applicant, you give the information when you collect it. If you get data from another source, such as a recruiter database or a public profile, you generally give the information within a reasonable time and at the latest within one month. See Articles 13 and 14 of the GDPR, and the Information Commissioner’s Office guidance on recruitment and selection.
In the United States there is no single federal privacy notice rule for applicants. Some states do have rules. For example, California privacy law gives job applicants certain rights and notice requirements. Rules change, so check the official sources for each state where you hire. Many US employers publish a notice anyway, because it builds trust and prepares them for new rules.
What to include
| Item | What to write | Notes |
|---|---|---|
| 1. Who we are | Company name, address and contact for privacy questions | Add the data protection officer if you have one |
| 2. What data we collect | CV, contact details, work history, education, answers to questions, interview notes, test results | Say where it comes from: the candidate, referees, recruiters or public sources |
| 3. Why we use it | To assess applications, run interviews, decide, make offers and meet legal duties | Separate the purposes. Mention monitoring and talent pools if used |
| 4. Lawful basis (UK and EU) | Steps before a contract, legitimate interests, legal obligation, consent for talent pools | Match the basis to each purpose |
| 5. Who sees it | Hiring team, HR, software providers, referees, background check providers with consent or legal basis | Name categories of recipients |
| 6. Transfers abroad | Say if data goes outside the UK or EU and what protection applies | Ask your software providers where data is stored |
| 7. How long we keep it | A specific period for each group of records | Do not write “as long as necessary” alone |
| 8. Rights | Access, correction, deletion, restriction, objection and, where relevant, data portability | Say how to make a request and how fast you reply |
| 9. Complaints | The right to complain to the data protection regulator | Name the regulator for your country |
| 10. Automated tools | Say if software supports screening or decisions and how a person reviews the outcome | Be specific and honest |
| 11. Is the data required? | Say what happens if the candidate does not give information | Example: without a CV we cannot assess the application |
A template you can adapt
Copy the text below into your application page and replace the words in square brackets. This is a template. It is not legal advice, and your facts may differ.
How we use your information when you apply
[Company name] (“we”) is responsible for your information. You can contact us at [email] with any question about this notice.
What we collect: your name and contact details; your CV or resume; your work history, education and skills; your answers to our questions; notes and scores from interviews and tests; and information from referees, if you give us their details and we have told you before we contact them.
Why we use it: to read and assess your application for [role], to invite you to interviews, to decide who to offer the job to, to make an offer, and to meet legal duties. We rely on [steps before entering a contract and our legitimate interest in running a fair recruitment process].
Who sees it: the people involved in hiring for this role, our HR team, and the providers that supply our recruitment software. They may only use your information for our purposes. [We store data in the country or region of storage.]
How people make decisions: [People make all decisions about who to interview and hire. Our software may highlight text in your CV that matches the job requirements, but it does not reject or rank you. / Describe any other tools and how a person checks the result.]
How long we keep it: if we do not hire you, we delete your application [number] [months] after the process ends, unless you agree that we may keep it for future roles. If you agree, we keep it for [number] [months] and ask again before then.
Your rights: you can ask us for a copy of your information, ask us to correct it, ask us to delete it in some cases, and object to some uses. Write to [email]. We reply within [one month] [or the period required by law]. You can also complain to [name of regulator and website].
If you do not give us the information we ask for, we may be unable to consider your application.
Notes for each region
United Kingdom
Name the Information Commissioner’s Office as the regulator. UK law uses “UK GDPR”. The Data Protection Act 2018 adds rules, for example on criminal offence data and special category data. If you ask for criminal record checks, they are limited by law and by the role.
European Union
Name the national authority for the country of your main establishment, and mention that candidates can complain in their own member state. Local labour law may add rules on retention and on what you may ask in interviews. The European Data Protection Board publishes guidance.
United States
Include a short statement of what you collect and why, and whether you sell or share data. Check state laws if you hire in places with comprehensive privacy rules. Employers that use automated employment decision tools in some cities may also need to give notice, for example in New York City. See the city guidance on automated employment decision tools, and our guide to Local Law 144 when it is available.
Where and how to show it
- On the application page, with a clear link above the submit button. A link in a footer is not enough.
- In the confirmation email, with a link to the full notice.
- In job adverts on third-party boards, with a link to your notice where you can.
- In plain text, not only in a PDF. Many candidates apply from a phone.
- In the local language of the candidate where you hire in that country.
Writing tips
- Use “we” and “you”. It is clearer than “the data controller” and “the data subject”.
- Write short sentences. Aim for fewer than 20 words.
- Use a table or short sections. People scan.
- Avoid vague words. Replace “may” and “from time to time” with real examples.
- Test with a colleague outside HR. Ask them what you do with their CV. If they cannot say, rewrite.
- Keep a version history. Note the date and what changed, so you can show which notice a candidate saw.
Mistakes to avoid
| Mistake | Why it is a problem | Fix |
|---|---|---|
| Copying a notice from another company | It describes their processes, not yours | Write from your own data map |
| Saying “we keep data as long as necessary” | Candidates and regulators expect a clear period | Give a specific time for each record type |
| Hiding the notice in the footer | Applicants cannot see it before they submit | Place it next to the form |
| Describing a feature that you do not use | The notice becomes untrue | Review with the recruiters who use the system |
| Promising never to share data, while using many providers | This is untrue and risky | Name categories of recipients |
FastHire is being built to support a clear and open process. It shows each job requirement next to the exact CV passage that supports it. People make every decision. FastHire does not rank, score or reject candidates, and it is coming soon.
Layered notices: a short summary and a full text
Long notices go unread. A layered format helps. The first layer is a box of five or six lines next to the form. The second layer is the full notice, one click away. Both layers must agree with each other and with what you do.
| Layer | Content | Length |
|---|---|---|
| Layer 1: summary box | Who we are, why we use your data, who sees it, how long we keep it, how to see or delete it, link to full notice | About 60 to 100 words |
| Layer 2: full notice | All items in the table above, with headings | One to two pages |
| Layer 3: just-in-time messages | A short line next to sensitive questions, such as “This question is optional and is used only for monitoring” | One sentence |
Here is a fictional example of a layer 1 box: “We use your CV and answers to assess your application for this role. Our recruiting team and our software provider can see them. If we do not hire you, we delete your data after six months unless you ask us to keep it. You can ask to see, correct or delete your data at any time. Read the full notice.” The six months in this example is invented. Choose your own period on advice for your country.
Review checklist before you publish
- Does every data type in the notice match a field in the form and a field in the system?
- Does every tool that touches applicant data appear in the list of recipients?
- Is each retention period real, and does the system enforce it?
- Does the notice say what happens if a candidate refuses to give an optional item?
- Has someone who does not work in HR read it, and could they explain it back?
- Is there a named person who updates it when the process changes?
Put a calendar reminder to review the notice every six months. Also review it when you add a country, change a vendor or turn on a new automated feature. Keep the older versions with dates.
One last point on tone. A privacy notice is also a message to candidates about how you treat people. Plain, honest wording shows respect, and it is easier to defend than clever wording. If a sentence could be read two ways, choose the plainer way and cut the rest.
Frequently asked questions
Is a privacy notice the same as a cookie banner?
No. A cookie banner is about cookies on your website. An applicant privacy notice is about how you use the data of people who apply for jobs. You may need both.
Do I need candidate consent to process their application?
Often no. In the UK and EU, other lawful bases can apply. Consent is common for talent pools and for optional questions. See our guide to GDPR for job applicants.
How long should a notice be?
As short as possible while covering the required items. A layered format works well: a short summary with a link to the full text.
Do I need to update the notice when I change software?
Yes, if the change affects what data you collect, who receives it, where it is stored or how decisions are supported.
Does a US employer need this notice?
There is no single federal rule, but state laws may require a notice. Check the states where you hire, and consider a notice as good practice.
Related guides
- Hiring guides for fair and compliant hiring
- GDPR for job applicants: what employers must do
- Applicant tracking system compliance checklist: GDPR and US records
- EU AI Act and hiring tools
- All hiring guides for employers
- How long to keep rejected applicant data
- How to handle candidate data requests under GDPR
This is general information, not legal advice.