GDPR Compliance for Recruitment Agencies: What You Need to Know
Can you believe it? 25 May is almost here. And with GDPR‘s fast approaching date, the issue of compliance has ever been more important. Previously, we’ve discussed some top technology considerations to help you be compliant. But what steps should you take to ensure compliance with GDPR rules and regulation? Here are three key steps to take.
Note: This blog is for informational purposes only and not for the purpose of providing legal advice. You should contact your legal counsel with respect to any questions or issues regarding GDPR.
Read GDPR Explained—an ebook for recruitment agencies
Audit
A key starting point for any agency is to conduct a Data Retention & Data Processing Audit. In this audit, agencies should assess the risks that you create for others in processing their data: candidates, clients, and employees.
Take Action
It’s important to enact company policies to mitigate the risks you create for others in processing their data and to enable your team to be GDPR-compliant. Taking action comes in two forms: Preventative measures and proactive response.
1) Take organisational measures to protect data
You must enact organisational policies and staff training(s) to ensure you follow proper data protocol. Do all of your employees understand GDPR and what actions do they need to take on a daily basis to ensure your agency is compliant? Do any of your employees store personal information outside of company systems (personal devices, USB drives, laptops, etc.)? Additionally, the ICO recommends appointing a specific person to oversee GDPR for your businesses, a Data Protection Officer (DPO).
2) Monitor and report breaches within 72 hours
GDPR demands that businesses act swiftly in the wake of data breaches. If you’re subject to a breach, you must report it within three days.
Document
In the event of a breach or other serious incident, you need to be able to demonstrate the steps you took. GDPR doesn’t require perfection out of businesses, but it does require them to take reasonable steps to comply. Documentation is critical in illustrating that you took this compliance seriously.
Is your recruitment agency ready for the GDPR? Read GDPR Explained for a breakdown of how the GDPR impacts recruitment agencies and practical advice to help you prepare your business.