Candidate data in pharmaceutical recruitment: a practical privacy guide

Start with purpose and identity

A candidate should be able to identify the organisation receiving their information and understand why it is being processed. A defined vacancy, agreed talent search and optional future-opportunity service are different purposes and should not be silently treated as one unlimited permission.

Recruiters and employers should explain their respective roles where information is shared. Privacy information should be accessible before or when data is collected, written clearly and consistent with what the platform and people actually do.

Collect what the decision needs

A recruitment process normally needs identity, contact, employment, qualification and role-fit information, but not every possible detail. Application forms, interview notes and assessments should be connected to a legitimate selection or administration purpose.

Special-category or highly sensitive information requires particular care and an appropriate basis and safeguard. Interviewers should avoid recording irrelevant personal observations. If a check is necessary, explain the stage, purpose and access rather than gathering it speculatively.

Control sharing and access

Candidates should know whether their identifiable profile will be shared with a named employer. Internal access should follow role and need: a hiring manager may need application evidence, while unrelated platform users do not. Downloads and email attachments require the same discipline as records inside a system.

Where a recruiter first presents anonymised information, the transition to identifiable sharing should be deliberate and recorded. International transfers, vendors and integrations need appropriate contractual and technical controls rather than relying on a broad privacy statement.

Make automation accountable

Matching, CV analysis and workflow automation can assist people, but the user should understand the purpose and material limitations. Unknown experience must not be silently converted into a negative fact, and generated suggestions must not overwrite the candidate’s source history.

For consequential decisions, preserve human accountability, correction routes and relevant records. Security controls should protect raw documents, derived profiles, cached outputs and exports—not only the fields visible on screen.

Retention, correction and deletion

Retention should reflect the stated purpose, legal obligations and the need to handle disputes or future opportunities. Different records may have different periods. Keeping every unsuccessful application indefinitely because storage is cheap is not a defensible operating principle.

Provide routes for people to update inaccurate information, ask questions and exercise applicable rights. Deletion requests should be handled consistently across primary records, document storage, search indexes and downstream processors while preserving only records that must lawfully remain.

A candidate-data control checklist

For every recruitment data flow identify the person, purpose, data fields, source, recipient, access role, storage location, retention rule, processor, international transfer and correction or deletion route. Repeat the map for derived scores, summaries and exported files rather than checking only the original CV.

Test the workflow using an unsuccessful candidate, a withdrawn application and a deletion request. Confirm that permissions, search indexes, caches, documents and human processes behave consistently. Record exceptions and ownership instead of assuming the privacy notice alone creates compliance.

Sources and further reading

Authoritative sources support the regulated or employment context. The practical framework and interpretation are original PTTF editorial work.

1. Employment practices and data protection: recruitment and selection — Information Commissioner's Office
2. Employment practices supplementary guidance — Information Commissioner's Office