A talent pool is a list of people you may contact about future roles. To build one fairly, ask each person clearly, explain what you will do with their data and how long you will keep it, make saying no easy, contact them only about jobs, and review the list on a schedule. In the UK and EU, consent must be freely given, specific and easy to withdraw.
Key takeaways
- Ask for consent separately from the job application, with a clear yes or no choice that is not pre-ticked.
- Say what you will send, how often, how long you will keep the data and how to leave.
- Do not add people to the pool without asking. That includes declined applicants and people you found online.
- Review the pool at set times, delete expired entries and honour withdrawals fast.
- Only contact people about jobs that match what they told you they want.
What a talent pool is, and is not
A talent pool is a group of people who have agreed to hear from you about future openings. It can include past applicants who were close, former employees, people who met you at events and people who joined your careers page mailing list. It is not a database of everyone whose CV you have ever received. Keeping CVs “just in case” without asking is a common mistake and a data protection risk.
A pool can save time. When a role opens, you can start with people who already know you and have shown interest. But a pool is worth only as much as its freshness and its trust. An out-of-date list of people who never agreed to be there harms both.
The legal picture, in outline
| Region | Main points | Official source |
|---|---|---|
| EU | GDPR: consent must be freely given, specific, informed and unambiguous, shown by a clear affirmative act, and as easy to withdraw as to give. You must also have a lawful basis for any other use and give a privacy notice. Marketing-style messages are also subject to e-privacy rules in member states | GDPR; European Data Protection Board |
| UK | UK GDPR and the Data Protection Act 2018 apply. Rules on electronic messages (PECR) can apply to emails and texts. The regulator publishes guidance on consent and on recruitment | ICO recruitment and selection |
| US | No single federal rule on talent pools. Federal and state laws on email, telephone and text messaging, and some state privacy laws, may apply. Check each state where you hire | Check state attorney general pages and the Federal Trade Commission for email rules |
Some employers rely on legitimate interests to contact people they have found through public sources. In the UK and EU, this requires a balance test and a prompt notice to the person, usually within one month. Many privacy regulators expect special care with unsolicited approaches. Consent is the simpler path for a pool. Ask a data protection adviser which basis fits your case. Our guide on GDPR for job applicants explains the lawful bases.
Eight steps to build a pool with consent
- Decide the purpose. For example: “to tell you about roles in customer support and operations in Berlin and remote”. The narrower the purpose, the clearer the consent.
- Write the promise. What will you send, how often, and for how long will you keep the data? Examples: “no more than one message a month, only about roles that match”, “deleted after 12 months unless you renew”. The figures here are examples. Choose your own.
- Build an opt-in. A separate checkbox that is not pre-ticked, on the application form or a sign-up page. Keep the wording simple. Keep it independent from the application, so that saying no does not affect the application.
- Collect the minimum. Name, contact details, interests, location and work authorisation if needed. Skip anything not needed to match roles.
- Confirm. Send an email that confirms what the person agreed to, with a link to change or withdraw.
- Record consent. Store the date, the wording they saw, the source and what they agreed to. You may need to show this later.
- Segment. Tag people by role family and location so you can match them to the right roles.
- Review and refresh. Remove people after the period you promised, or ask them to renew. Delete anyone who withdraws within the legal time limit, and aim for the same day.
Wording for the opt-in
Stay in touch
Would you like us to keep your details and tell you about future roles at [Company] that match your interests? You can say no and still apply for this job.
[ ] Yes, keep my details for [period] and email me about roles in [areas]. We will email no more than [frequency] and you can leave at any time with one click.
We use your details only for this purpose. Read our privacy notice at [link].
Do not use a pre-ticked box, bundle this with the application consent or hide it in long terms. In the EU and UK these methods are not valid consent.
Where people come from, and what to do
| Source | What you can do | What to avoid |
|---|---|---|
| Candidates who applied and were declined | Ask in the decline message if they would like to stay in touch. Link to the opt-in | Adding them to the pool automatically |
| People who sign up on your careers page | Use the sign-up as the opt-in, with a clear confirmation | Using the email for general marketing |
| Event contacts | Ask in person or by follow-up email whether they agree to hear about roles | Typing every business card into the system without asking |
| Former employees | Ask in the exit process whether they want alumni updates | Assuming they agreed in their employment contract |
| People found on public profiles | Send a short individual message that explains who you are and how you found them, and ask if they want to hear from you. Respect any request not to contact them | Bulk-loading them into the pool or scraping profiles |
Be careful about scraping profile sites. Platforms have terms that restrict automated collection, and data protection law still applies to public information. Contact people one by one, with a clear and honest message.
How to use the pool fairly
- Match on skills and interests, not on traits that could be protected. Do not filter on age, sex, nationality or family status.
- Record the evidence for each match. Use the same job-related criteria as for any other applicant. See screening resumes against must-haves with evidence.
- Give pool members the same process. They do not skip the structured interview because you know them.
- Tell them the outcome. A person who agreed to hear from you deserves a reply if they apply for a role through the pool.
- Check who your pool leaves out. If the pool is mostly people from the same schools or networks, widen your sources.
Measure and clean
Track four numbers: the size of the pool, the share who open or reply, the number of hires from the pool and the number of withdrawals. These are your own numbers. Do not compare them to industry benchmarks unless you have an official source. A pool with many silent entries needs cleaning. Remove people who have not engaged after the period you promised. A shorter, current pool is more useful and lower risk than a long one that nobody trusts.
Set a calendar date for a full clean every six months. Export the list, remove expired entries, delete from every place (system, email tools, spreadsheets) and keep a short log of what you removed. See how long to keep rejected applicant data for the retention method.
What to send, and what not to send
| Good message | Poor message |
|---|---|
| “A role opened in operations in Lisbon that matches your interests. Here is the advert. Reply if you want to apply, or tell us if you no longer want to hear from us.” | “We have many exciting roles! Click here!” sent to everyone |
| Short, specific, easy to leave | Long, vague, with a hidden unsubscribe link |
| Sent only when a match exists | Sent weekly because the system allows it |
FastHire is being built for the step where you read applications. It shows each job requirement next to the exact CV passage that supports it, so a person can check the evidence quickly, whether the CV came from a talent pool or a new application. FastHire is coming soon. It does not rank, score or reject candidates. People make every decision.
A consent record template
Keep one record for every pool member. You need it to show what the person agreed to, and to find them when they ask to leave.
| Field | Example (fictional) |
|---|---|
| Person ID | TP-0042 |
| Date and time of consent | Date and time |
| Source | Careers page sign-up form |
| Exact wording and version shown | Version 2 of the opt-in text, link to a saved copy |
| What they agreed to | Emails about operations roles in Lisbon, up to once a month |
| Review or expiry date | Date set from the period you promised |
| Withdrawal date | Blank until withdrawn |
| Last contact and outcome | Date; applied / no reply / opted out |
Store the record where only the recruiting team can see it. Keep a copy of each version of the opt-in wording with the date it was in use. If the wording changes in a way that widens the purpose, ask existing members again.
Monthly routine for the pool owner
- Process every withdrawal request received. Aim to complete it within one working day.
- Check for entries that reach their expiry date in the next 30 days, and send the renewal message.
- Remove expired entries from all systems.
- Review bounced emails and remove invalid addresses.
- Match new roles against the pool using the written criteria, and record the evidence for each match.
- Update the four numbers: pool size, response share, hires from the pool and withdrawals.
The routine takes under an hour a month for a small pool. It keeps the list honest, and it gives you a short record to show a regulator or a candidate if they ask how the pool works.
When a pool is not the right tool
A talent pool takes effort to run well. If you hire a handful of people a year, the cost may be higher than the benefit. In that case, a simple option works: keep a short list of people who asked to be told about specific roles, and write to them when one opens. Or invite declined candidates to re-apply when a new role appears. These options need less data and less upkeep, and they are easier to explain.
Frequently asked questions
Is a talent pool the same as keeping CVs on file?
No. Keeping CVs on file for the current process is one purpose. A pool for future roles is a different purpose and needs its own basis, often consent, and its own retention period.
Can I add declined applicants to the pool?
Only if they agree. Ask in the decline message and give a link to opt in. Do not add them automatically.
How long can I keep pool entries?
Choose a period you can justify, state it in the opt-in, and ask people to renew before it ends. Many employers choose a year or less; your adviser can confirm what fits.
Do I need to remove people when they ask?
Yes. In the UK and EU, withdrawal of consent must be easy and acted on promptly. In the US, state laws and email rules may also give opt-out rights.
Can I contact people from a public professional profile?
You can send a first, individual message that explains who you are, where you found their details and what you want. Respect a request to end contact. Check the rules in each country.
Related guides
- Hiring guides for recruiters and HR teams
- GDPR for job applicants: what employers must do
- How long to keep rejected applicant data
- Recruiter outreach messages
- All hiring guides for employers
- How long can you keep applicant data? US, UK and EU
This is general information, not legal advice.