TargetCW Privacy
Global Privacy & Data Protection Office


Worker, Vendor and Client Resource

Can you trust a staffing agency with your information?


When you register with a recruitment agency to find a job, you probably don’t think about the information you present other than to hope that it will be exciting enough to help you gain employment. You readily present a high volume of personal data about yourself, such as your social insurance number, address, date of birth, telephone number, past job history, educational achievements and connections. This information also includes personal or business references, with the names and telephone numbers of other people who know and can vouch for you.

Should you gain employment through the recruitment agency you will then hand over your banking details so that you can get paid, as well as your tax details. All things considered, this is a veritable treasure trove of information. Most of the time a person will have no problem in handing these details over for the purpose of gaining a job, and once the job is gained, no further thought goes into the existence of all those personal details which are still on file.

If you registered with a number of agencies over the years, the amount of times your information can be breached is exponential. In fact, compliance with data protection is unlikely to even be something that is considered when a person signs up with an agency.


What Data You Shared with Your Agency

Considering what type of information you had to provide to be considered for employment with your agency, it is right to say that you have shared most of the important personal information that you have. You will want to know that your agency is in full compliance with GDPR, so you can rest assured your private information is safe.

As a definite you would have shared enough private information to make it valuable to an identity thief, including your educational history, work history, home address, home telephone, certifications and other private information. While the agency is well positioned to ensure the safekeeping of your information, ultimately it is up to you to know where your information is going and to ask what procedures are in place for the safekeeping of that data. Even though the agency and all third parties do have a liability to ensure that safekeeping, without checking on the process yourself you cannot guarantee that the agency you chose is taking that seriously.


Data the Agency Shares of Yours

Since your CV will be sent to potential employers by the agency, your personal details will be shared with a third party whom you have not met yet personally. Given the potential for that third party to misplace or improperly file that CV, it is possible that your information could fall into unintended hands. If your CV is sent to ten potential employers for instance, you will only be able to take one of those roles ultimately, should they all offer you a role. That means the other 9 prospective employers will still hypothetically be holding your personal details, without any agreement as to what they will do with them at that stage.

The GDPR allows you to request a copy of any personal information that is held by another company on you or ask that it be deleted, if you choose to ask for that. Given that the GDPR puts all parties who share a person’s private details liable for any breach of that data, you will be able to request from your agency that they make contact with the companies whom your CV was sent to and ask for it to be destroyed. You might also want to allow them to keep it on file in case an opening arises, but you are the one that can decide how your information is dealt with.

If you are offered a full-time role from the employer and begin to work directly for that employer, your banking and tax details will also be shared with the new employer and you might want to ask for those details to be removed from the agency database at that stage.


Removing Information

You have the right to request an agency either give you a copy of all the information they hold on you, delete it from their records or send it to you after extracting it for deletion on their system. By writing to the agency and requesting any of the above you will be able to gain compliance with your request. You might just want to view a copy of all the data so that you can decide on the relevance of any of it in a contemporary standard; there might be some out of date or inaccurate information that you want deleted or changed.


Requesting a Copy of the Information

If you prefer, you can ask for a copy of the information that is being held by the agency on you and review it to determine if you are comfortable having it on file. If you want to have a portion of the information deleted but not all of it, you have the right to request that as well. All requests should be made in writing to the agency you gave your details to in the first instance.

Agencies have thirty days to answer any request for personal information that you make to them and all requests must be made in writing to the data protection officer of the company, or to the company in general if they have not assigned a person to deal with it yet. You should ask for a list of companies that your CV was sent to as a candidate and ask whether the agency has liaised with those companies about how such CVs are handled after a choice of employee is made among them. It might be the case that the company has a policy to shred all CVs provided to them after they finish considering and delete them permanently from their email database. The agency will have an understanding of the processes their customer companies use.



Looking for a job can be a fast-paced matter and often times applicants don’t think twice about the type of information they included on their CVs and the fact that they have just given them out to several unknown companies. When you are registered with an agency, this is not even as obvious as it would be if you were the one personally delivering your CVs across town, and you might not even realise how far your information has travelled or how often. By requesting clarification from your agency you can find out the status of your information, where it has been sent and what that included.

You can decide if you want to have some or all of it removed from their file, or from any of the companies the agency shared your CV with. The agency will know what procedures are in place in the companies they shared your information with, and it might be the case already that such information is properly destroyed in a set amount of time. With the implementation of the GDPR, finding out such information has become much easier, and something which agencies and companies are required to comply with.