Why does GDPR matter more for sourcing than for applications?
When someone applies, they hand you their CV and know you have it. With sourcing, you collect data about people who have no idea you are looking at them. That changes three things: you cannot rely on the application as context, you have to inform people yourself, and you need a lawful basis that works without their prior involvement.
The fact that a LinkedIn profile is public does not make it free to use. The Dutch data protection authority (Autoriteit Persoonsgegevens) states explicitly that its rules on looking up applicants online also apply to public information, such as a public social media profile.
Which lawful basis do you use for sourcing?
For sourcing, the realistic basis is almost always legitimate interest (Article 6(1)(f) GDPR). Consent does not work, because you do not have contact with the person yet, and a contract does not exist yet either.
Legitimate interest is not a free pass. You have to be able to show that you passed three tests, and document it, for example in a legitimate interest assessment. The European Data Protection Board explains the approach in its Guidelines 1/2024.
The three tests applied to sourcing
Work through them per type of sourcing activity, not once for the whole company:
- Legitimate interest. Filling a specific vacancy, or an agency filling a client's vacancy, is a real and concrete interest. 'Building a big database just in case' is much weaker.
- Necessity. Is processing this person's data necessary for that interest? Professional experience and skills, yes. Family photos, political posts or health information, no.
- Balancing. Would a professional with a public work profile reasonably expect to be approached about a relevant job? Usually yes. Would they expect to be profiled on all their online activity or kept in a list for years? No.
What does GDPR ask at each sourcing step?
A sourcing workflow touches personal data at every step. This overview links each step to the GDPR principle most at stake.
How do you inform candidates you sourced (Article 14)?
Article 14 GDPR covers data you did not get from the person. You must inform them within a reasonable period and at the latest within one month; if you use the data to contact the person, at the latest at the moment of that first contact. In sourcing, the first outreach message is therefore the natural moment.
You do not need to paste a privacy statement into a LinkedIn message. A short sentence and a link work well, for example: 'I found your profile on LinkedIn while looking for a candidate for this role. How we handle your data: [link]. Not interested? Let me know and I will remove your details.'
What the privacy notice should cover
Under Article 14 the information includes, among other things:
- Who you are and how to contact you (and your data protection officer, if you have one).
- The purpose (this vacancy or similar roles) and the lawful basis, including your legitimate interest.
- Which categories of data you hold and where you got them, for example LinkedIn.
- Who receives the data, such as a client in the case of an agency, and any processors.
- How long you keep the data, or the criteria that determine that.
- The candidate's rights: access, correction, erasure, objection and the right to complain to a supervisory authority.
- Whether automated decision-making including profiling takes place, and what that means.
How long may you keep data of sourced candidates?
GDPR sets no fixed number of weeks. It requires you not to keep data longer than necessary for the purpose, and to define that period in advance. For applicants, the Autoriteit Persoonsgegevens considers it customary to delete data no later than four weeks after the end of the procedure, and considers up to one year reasonable if the applicant consents to longer retention.
For sourced candidates, that guidance is a useful reference point. A defensible approach: keep data for the duration of the vacancy plus a short period, delete people who did not respond or were not interested, and move someone to a longer-term talent pool only when they agree to it.
- Set a retention period per workflow, not per recruiter.
- Delete automatically where possible; manual clean-ups tend to be forgotten.
- Record consent for longer retention with a date, so you know when it expires.
- Remember your ATS, spreadsheets, mailboxes and sourcing tools all hold copies.
Does AI ranking count as automated decision-making (Article 22)?
Article 22 gives people the right not to be subject to a decision based solely on automated processing, including profiling, that has legal effects or similarly significantly affects them. Rejecting a candidate purely on a score without human involvement can fall within that.
The Autoriteit Persoonsgegevens has explained, for online and game-based assessments, that the outcome of a tool can be decisive for the employer's decision and then count as an automated decision. Such decisions are only allowed under strict exceptions, such as necessity for entering into a contract or explicit consent, and the AP notes that freely given consent is hard to achieve in recruitment.
How to keep ranking on the right side of Article 22
The safest design is one where a person genuinely decides:
- A recruiter reviews the ranked list and can add, remove or re-rank people.
- Every score has reasons the recruiter can check against the profile.
- Nobody is automatically excluded from a vacancy on the score alone.
- Human review is real, not a click-through: the reviewer has time, information and authority.
And the EU AI Act?
AI that evaluates candidates is also high-risk under the EU AI Act, with obligations that come on top of GDPR. Read our EU AI Act recruitment guide for the timeline and the duties of users.
Privacy by design in an agentic sourcing workflow
GDPR is easier to meet when the workflow enforces it instead of relying on every recruiter to remember. In AIcruiters, data access, use and retention are limited per workflow, and approval rules decide what happens automatically. Privacy and hosting are discussed in detail in the technical review; see our security page.
- Retention and data use configured per workflow.
- Explainable ranking; your approval rules decide whether a recruiter checks the selection before outreach.
- Outreach tone and rules set by the team; how the privacy line is included is agreed per implementation.
- Uncertain cases routed to a person, see human in the loop.
GDPR checklist for candidate sourcing
Use this list to review your sourcing process with your privacy officer.
- 01
Record your lawful basis
Write down your legitimate interest assessment per sourcing activity, including the balancing test.
- 02
Limit the data
Define which profile fields you collect and exclude special categories of data such as health, religion or political views.
- 03
Update your privacy notice
Add sourcing explicitly: sources such as LinkedIn, purpose, recipients, retention and rights.
- 04
Inform in the first message
Every first outreach includes a short explanation and a link to the privacy notice, and an easy way to opt out.
- 05
Handle objections quickly
Keep a suppression list so people who objected are not approached again by a colleague or a tool.
- 06
Set and automate retention
Define how long data is kept per workflow and delete automatically, including exports and copies.
- 07
Keep humans in decisions
No automatic rejections on a score; recruiters review and can override rankings.
- 08
Check your vendors
Sign a data processing agreement, check where data is processed and assess whether a DPIA is needed for AI-based ranking.