Data Protection on Recruitment and Hiring Platforms

This page is a translation of the original Portuguese text, provided for convenience. It deals with Brazilian law. If there is any discrepancy, the Portuguese version prevails. Read the original in Portuguese

Recruitment and hiring platforms process sensitive personal data from millions of candidates, and complying with the LGPD (Brazil’s General Data Protection Law) in this setting demands extra attention from companies and HR professionals.

The Current State of Data Processing in Hiring

The job market has undergone a profound digital transformation in recent years. Recruitment and hiring platforms, both Brazilian and international, have become the main channel connecting companies and candidates. In this environment, large volumes of personal data move through the system every day: complete résumés, work histories, salary expectations, information about disabilities, union membership, and even biometric data collected in video interviews that use facial recognition.

When you look at this ecosystem through the lens of Brazil’s General Data Protection Law (Law 13.709/2018), you find a complex chain of processing agents. The hiring company acts as the data controller, while the recruitment platform may act as a processor or, in some situations, as a joint controller. This distinction is not merely theoretical: each role carries different legal responsibilities in the event of a security incident or misuse of the information.

Data due diligence in this context means checking how each link in the chain handles candidate information, from initial collection to disposal. We have observed that many organizations still neglect this analysis, relying blindly on platforms’ privacy policies without verifying that those policies actually meet legal requirements. This is a considerable legal risk, because responsibility for improper processing can fall on every agent involved.

Applicable Legal Bases and the Limits of Consent

One of the most common mistakes in practice is the belief that a candidate’s consent settles every compliance question. Although consent is one of the legal bases listed in Article 7 of the LGPD, it has significant weaknesses in recruitment and hiring. The relationship between candidate and company is marked by an obvious imbalance of power: a candidate who refuses to consent to the processing of their data simply does not take part in the hiring process. That dynamic undermines the freedom that valid consent is supposed to involve.

For this reason, other legal bases may be better suited to justify data processing in hiring. Carrying out preliminary procedures related to a contract (Article 7, item V, of the LGPD) is a good fit when the processing is necessary to assess whether the candidate is right for the position. The controller’s legitimate interest (Article 7, item IX) may also be invoked, provided it is preceded by a proportionality test that weighs the company’s interests against the candidate’s rights.

When the hiring process involves sensitive data (such as health information, racial origin, or religious beliefs), the legal bases become even narrower. Article 11 of the LGPD sets out an exhaustive list of situations in which this information may be processed. Many platforms collect sensitive data indiscriminately, without adequate legal grounds, exposing companies and candidates to unnecessary risks.

Data due diligence on recruitment platforms is not a regulatory luxury but a strategic necessity for companies that want to hire with legal certainty and respect for candidates’ rights.

Data collection must strictly follow the necessity principle set out in Article 6, item III, of the LGPD. This means that only the information strictly necessary to evaluate the candidate should be requested at each stage of the process. Questions about marital status, family planning, or political orientation, for example, have no bearing on professional ability and amount to excessive collection.

Practical Due Diligence: What to Check on the Platforms

When we conduct data due diligence on recruitment platforms, we organize the analysis around core areas that let us assess how well the system complies with current law. The first area is transparency: does the platform state clearly and accessibly what data it collects, for what purposes, how long it stores the data, and with whom it shares it? The privacy policy must be written in plain language, as Article 9 of the LGPD requires.

The second area is information security. We examine whether the platform uses appropriate technical and administrative measures to protect data from unauthorized access, leaks, and security incidents. This includes checking for encryption in transit and at rest, role-based access controls, audit logs, and incident response plans. The absence of these measures may amount to negligence on the platform’s part and, by extension, on the part of the company that hired it.

The third area concerns data subjects’ rights. The LGPD gives candidates several rights, including access, correction, deletion, and portability of their data. We check whether the platform offers effective ways for candidates to exercise those rights. In practice, many platforms make it hard to delete profiles or keep data indefinitely, even after the hiring process ends, which goes against the necessity principle.

The fourth area covers international data transfers. Many recruitment platforms store information on servers located outside Brazil. In those cases, the transfer must meet one of the situations listed in Article 33 of the LGPD, which include the existence of adequate legislation in the destination country or the adoption of specific contractual clauses. Brazil’s National Data Protection Authority (ANPD) has been gradually regulating this subject, and companies should keep up with its guidance.

Finally, the fifth area addresses the use of artificial intelligence and automated decisions in hiring. Automatic résumé filters, algorithmic analysis of behavioral profiles, and interviews assessed by emotion-recognition systems are increasingly common. Article 20 of the LGPD gives data subjects the right to request review of decisions made solely on the basis of automated processing, including decisions that affect their interests, such as being eliminated from a hiring process.

The Hiring Company’s Responsibilities and Best Practices

We have found that many companies hand off responsibility for data processing entirely to recruitment platforms without properly formalizing the relationship. This is legally risky. The LGPD provides that the controller is liable for damages resulting from data processing, and hiring a processor does not automatically shift that liability.

A written contract is essential. The agreement between the company and the recruitment platform should include specific data protection clauses, including a clear definition of each party’s role (controller and processor), the purposes for which processing is authorized, the required security measures, the procedures to follow in case of incidents, and the conditions for subcontracting. We also recommend including audit clauses that allow the company to check the platform’s compliance periodically.

Preparing a Personal Data Protection Impact Report (RIPD), provided for in Article 38 of the LGPD, is a sensible step before engaging any recruitment platform. This document describes the data processing activities that may create risks to candidates’ civil liberties and fundamental rights, along with the mitigation measures adopted. Although the ANPD has not yet fully regulated the cases in which the RIPD is mandatory, preparing one shows diligence and good faith on the company’s part.

Another important point concerns data retention after the hiring process ends. It is common for platforms to keep the résumés and information of unsuccessful candidates indefinitely, building talent pools. This practice can be legitimate, as long as the candidate is informed and there is an adequate legal basis. The retention period must be set and communicated in advance, and the candidate must be able to request deletion of their data at any time.

Training human resources teams is also part of good practice. The professionals who operate recruitment platforms must understand the principles of the LGPD and know how to spot risky situations. Regular training on data protection in the recruitment context helps build an organizational culture of privacy.

Consequences of Noncompliance and Regulatory Trends

The penalties the LGPD sets for violating data protection rules are significant. The ANPD may issue warnings, impose fines of up to 2% of the company’s revenue (capped at R$ 50 million per violation), block or delete the personal data involved in the violation, and publicize the violation. In the employment context, improper processing of candidate data can lead to lawsuits seeking moral damages (compensation for non-economic harm), especially when sensitive information is leaked or data is used in a discriminatory way.

We have observed that the ANPD has stepped up its enforcement and that employment relationships are among the authority’s priority topics. The trend is for data processing in recruitment to receive growing attention, following the European regulatory movement, where data protection authorities in several countries have already issued specific guidance on the subject.

In Brazil, there has also been a marked increase in lawsuits over the misuse of personal data in employment and recruitment. Labor courts have recognized the right to compensation for moral damages in cases involving excessive data collection, unauthorized sharing of candidate information, and the use of discriminatory criteria in automated hiring processes. This developing case law reinforces the importance of adopting preventive practices.

Companies that invest in data due diligence for their recruitment platforms not only reduce legal risk but also strengthen their reputation as employers committed to ethics and respect for fundamental rights. In a job market where competition for talent keeps growing, showing care for candidates’ personal data can be a real advantage in attracting qualified professionals.

This topic is directly related to data protection in education, which we cover in a dedicated article.

This topic is directly related to data protection impact reports, which we cover in a dedicated article.

As informações deste artigo são de caráter informativo e não substituem consulta jurídica individualizada. Cada caso possui particularidades que exigem análise específica.