Before you start: Have you determined your GDPR strategy? Established a processing register? Do you know which automated actions you want to build into your GDPR process? Then it's time to configure your processes in Carerix. This guide shows you modern, scalable workflows available in 2026.

Managing Legal Basis and Retention Periods

One of the first steps in GDPR compliance is clearly documenting the legal basis on which you process candidates' personal data. Carerix makes this intuitive.

Available Legal Bases in Carerix

Legal Obligation: You are legally required to retain the data (e.g., tax authority, employment insurance)
Contract Performance: Data needed to perform an employment contract or service
Legitimate Interest: You have a legitimate business interest in processing (e.g., recruitment pipeline management)
Consent: The candidate has explicitly agreed to processing
No Consent: For candidates who have not consented (e.g., LinkedIn sourcing, indirect contact)

Configuring Retention Periods

Each legal basis has an associated retention period — the duration for which you may retain data. This is critical for GDPR compliance:

Candidate gives consent: 2 years (for recruitment purposes)
After hire: legal basis changes to Contract Performance (duration of employment contract)
After employment ends: may change to Legal Obligation (e.g., 7 years for tax purposes)

ℹ️ Important: Carerix automatically calculates expiration dates based on configured retention periods. Ensure periods are accurate to avoid false positives during monitoring.

Candidates can provide consent directly when applying. This is the preferred method for GDPR compliance.

Step 1: Publish privacy statement on your website
Step 2: Add checkbox to application form: "I have read the privacy statement and agree to processing of my data"
Step 3: Web builder or REST API integrates the field with Carerix
Step 4: Carerix automatically records the date and status in the candidate record

If you found a candidate on LinkedIn, Monsterboard, etc., you must first inform them and request consent. Here's how:

Send an email using the "Request Initial Consent (GDPR)" template (available in Carerix email library)
This template contains Yes/No links that feed directly back into Carerix
Carerix automatically records:
- Consent status (Yes/No)
- Response date
- Legal basis (changes to "Consent" if Yes)
- Expiration date (calculated from retention period)

💡 Practical Tip: Create multiple consent email variants. One for "recent contacts" (2-3 months ago), one for "expired contacts" (over 1 year), one for "frequently matched" candidates. Personalization improves response rates and compliance documentation.

A new report gives you direct visibility into all consent statuses. This report shows:

All candidates with their consent status
Date consent was given/refused
Expiration date of legal basis
Months remaining until expiration
Export to CSV for bulk processing

Automation with Triggers

What Are Triggers?

Triggers are automated actions that execute when specific conditions are met. They are essential for scalable GDPR compliance.

Example: Consent Renewal Reminder

IF (Condition): "Consent expires within 30 days"
THEN (Action): "Automatically send 'Request Consent Renewal (GDPR)' email"

How it works:

Trigger checks all candidates daily
Filters those expiring within 30 days
Sends personalized reminder email
Marks candidate as "reminder sent" to prevent duplicates

Example: Automatic Status Change Upon Hire

IF: "Placement Status = Approved" (candidate hired)
THEN: "Change Legal Basis to 'Contract Performance'; Update Retention Period to duration of employment"

This ensures your GDPR status automatically aligns with employment status.

Example: Activate Anonymization Upon Expiration

IF: "Legal basis expires" + "No contact for 3 months"
THEN: "Add candidate to 'Anonymization Queue'"

An administrator can then execute bulk anonymization weekly for all candidates in the queue.

ℹ️ Important: Test triggers on a small group before deploying site-wide. Ensure email templates are appropriate and reminder links actually feed back into Carerix.

Monitoring and Reporting

Filters in Candidate List

Carerix offers three critical filters for GDPR monitoring in the candidate list view:

"Legal basis expires": Filter candidates expiring on a specific date. Quickly see what action is needed.
"Legal Basis": Filter candidates by their current legal basis. Useful to see how many candidates are on "Consent" vs. "Legal Obligation".
"No Consent": Candidates from indirect sources who have not yet given consent

Indicator in Candidate/Match Record

At the top of each candidate and match record, you now see at a glance:

Current legal basis (color-coded: green = valid, orange = expiring soon, red = expired)
Expiration date
Days until expiration
Quick "Renew Consent" button for immediate action

Anonymization and Deletion

When to Anonymize?

Anonymization is the GDPR-compliant way to delete personal data while retaining historical records:

No valid legal basis: Basis expired and candidate did not respond to renewal requests
Right to be Forgotten: Candidate explicitly requests deletion ("Delete my data")
Opt-out: Candidate says "Stop matching me"

What Gets Anonymized?

Deleted: Name, email, phone, address, all personal fields
Deleted: CVs, attachments, and all documents
Deleted: Email communication and notes
Retained: Historical data (matches, placement status, employer, employment period)
Retained: Reporting data (stats, trends, analytics)

How to Anonymize?

Option 1: Manual Per Candidate

Open candidate record → Click "Anonymize"
Confirm action (irreversible!)
Ideal for individual requests

Option 2: Bulk via Triggers (Recommended for 2026+)

Add candidates to "Anonymization Queue" via trigger
Administrator executes bulk anonymization weekly
Faster and scalable for larger organizations

Option 3: REST API

For system-integrated organizations: anonymization via REST API endpoint

⚠️ Warning: Anonymization is permanent and irreversible. Ensure you have valid reasons and document them for audit trail. Keep a screenshot of the record for your records.

Practical Examples

Scenario 1: New Candidate via Application Form

Candidate sees privacy statement → reads and checks agreement
Application submitted → Carerix records "Consent given" + date
Legal basis automatically set to "Consent"
Expiration date calculated (e.g., 2 years = July 28, 2028)
Trigger: 30 days before expiration (June 28, 2028) → email "Renew consent?"
Candidate replies Yes → term extends to 2028
Candidate replies No → Trigger adds to Anonymization Queue

Scenario 2: Candidate from LinkedIn (Indirect)

You import LinkedIn profile → Carerix marks as "No consent"
You send "Request Initial Consent" email via Carerix
Candidate clicks "Yes" in email → Carerix records consent + date
Then follows same flow as Scenario 1

Scenario 3: Candidate Hired — Legal Basis Changes

Candidate is "placed" (placement approved)
Trigger activates: "Change Legal Basis to Contract Performance"
Retention period changes to "Duration of employment contract" (e.g., 3 years)
Expiration date: now July 28, 2029
When employment ends: Legal basis changes to "Legal Obligation", period 7 years (tax authority)

Scenario 4: Candidate Requests Deletion

Candidate emails: "Please delete my data"
You open candidate record → Click "Anonymize"
Confirm reason: "Legal Request - User Requested Deletion"
Carerix removes personal data but retains historical references for audit trail
You document in log: "Anonymized July 28, 2026 upon request"

Questions?

Do you have questions about configuring GDPR workflows, triggers, or anonymization? Contact our support team at helpdesk@carerix.com. We're happy to help you set up compliant processes tailored to your organization.

GDPR Flows in Carerix