The General Data Protection Regulation (GDPR), which came into force in May 2018, gives individuals greater privacy rights and places increased responsibilities on organizations that process personal data. For recruitment and staffing agencies, compliance is essential and affects how you manage candidates, contacts, and employee data within Carerix.

GDPR establishes key principles that every data controller must follow:

Lawful basis for processing: You must have a legal reason to process personal data — such as explicit consent, a contract, legal obligation, or legitimate interest.
Consent management: When consent is your legal basis, you must document when and how it was obtained, and allow subjects to withdraw consent at any time.
Right to erasure: Data subjects can request deletion of their personal data when there is no legal basis to keep it.
Data minimization: Collect and retain only the personal data you actually need for your specified purpose.
Data subject rights: Individuals have the right to access, correct, port, and object to processing of their data.

Getting Started: External Guidance

Use these trusted resources to understand your GDPR obligations:

Steps to Implement GDPR Compliance in Your Organization

Step 1: Map Your Data Flows

Create a comprehensive inventory of your data collection, storage, and sharing practices. Document:

Data categories: Types of personal data you collect (names, email, phone, salary, medical info, etc.)
Legal basis: Why you collect each type of data (consent, contract, legal obligation, legitimate interest)
Data flow: Where data comes from, how it flows through your systems, where it goes, and how long you keep it
Data subjects: Categories of individuals whose data you process (candidates, employees, contacts, suppliers)
Data processors: Third parties who process data on your behalf (Carerix, email providers, integrations)

Step 2: Create and Publish a Privacy Statement

Publish a clear privacy statement that tells data subjects how you handle their personal data. At minimum, include:

Who you are and how to contact you
What data you collect and why (legal basis)
How long you retain the data
Data subject rights (access, correction, deletion, portability, objection)
How to exercise those rights
Withdrawal of consent procedures (if applicable)

Step 3: Set Up Procedures for Data Subject Rights

Establish internal workflows to handle requests from individuals who wish to:

Access their data: Provide a complete copy within 30 days
Correct their data: Allow them to update outdated or incorrect information
Delete their data: Erase personal information when there is no legal basis to retain it
Port their data: Provide data in a structured, commonly used format for transfer to another service
Withdraw consent: Stop processing when consent was the legal basis

Step 4: Execute a Data Processing Agreement (DPA) with Carerix

Since Carerix processes personal data on your behalf, you must have a written Data Processing Agreement (DPA) in place. This contract specifies:

What data Carerix processes and for what purposes
Security measures Carerix implements
How Carerix supports your GDPR obligations
Sub-processor arrangements (third parties used by Carerix)

If you do not have a current DPA with Carerix, contact helpdesk@carerix.com to request one.

Carerix provides integrated features to help you work compliantly with personal data:

Carerix tracks consent for processing personal data on candidate and contact records. Available fields include:

Consent status: Whether consent has been given, refused, or is pending
Consent date: When consent was obtained
Consent expiry: When consent expires (if applicable)
Consent type: The specific data processing activity(ies) consent covers

These fields are available in both the Carerix user interface and the REST API, allowing integration with external systems. You can filter and search records by consent status and expiry date to manage renewal campaigns or compliance reviews.

💡 Tip: Use Carerix triggers and workflows to automatically send consent renewal emails when consent is about to expire, and log the response (yes/no) back to the candidate record automatically.

Sensitive Field Hiding via Configuration Profiles

Use configuration profiles to hide sensitive search fields from users who do not need to see them. For example, you can hide salary fields or age-related information from certain user roles, reducing the risk of unauthorized access to sensitive data.

Candidate and Placement Anonymization

When a data subject requests deletion, or when you no longer have a legal basis to retain their data, use Carerix's anonymization function to protect their privacy while maintaining your reporting and audit trails.

How Anonymization Works

Anonymization removes or masks all personally identifiable information (PII) from a candidate record, while optionally retaining non-personal fields for reporting and analysis. When you anonymize a candidate:

Personal details are deleted: Name, email, phone, address, and custom personal fields are erased or replaced with placeholder text
Related records are processed: All associated matches and placements are also anonymized
Documents and attachments are removed: CVs, cover letters, and other uploaded files are deleted
Communication history is cleared: Email messages, notes, and activity logs are purged
Reporting fields are retained: You can configure which non-PII fields (e.g., job title, department, placement status, hire date) are kept for statistical analysis and business reporting

Configuring Anonymization Attributes

As an Administrator, you can specify which candidate and placement attributes should be excluded from anonymization and retained for reporting purposes. This allows you to maintain business analytics without exposing personal identifiers:

For Candidates: Configure which fields (e.g., source, created date, hire status, internal ID) to keep
For Placements: Configure which fields (e.g., placement date, job type, department, end date, status) to keep
By default, all fields are included in anonymization — you decide which non-sensitive fields should be excluded

Triggering Anonymization

Anonymization is available through:

Carerix user interface: Administrators can anonymize individual records from the candidate or contact details page
Bulk operations: Use scheduled jobs to anonymize multiple candidates based on criteria (e.g., all candidates with expired consent, or candidates inactive for 3+ years)
REST API: Third-party systems (such as HR systems or automation platforms) can request anonymization via the API endpoint

Data Export for Portability Requests

When a data subject requests their data in a portable format (as is their right under GDPR), Carerix allows you to export candidate and contact records including all personal data and documents. The export can be provided in structured formats suitable for transfer to another service.

Attachment Dating for Retention Management

Documents and attachments in Carerix are automatically dated when uploaded. This allows you to identify and delete old files that have exceeded your data retention period, supporting data minimization.

Standard Email Templates for Consent and Rights

Carerix provides pre-configured email templates for common GDPR scenarios:

Request for consent: Initial request to a candidate or contact for permission to process their data
Renewal of consent: Reminder to renew consent when it is about to expire
Consent confirmation: Automated acknowledgment when consent is received (yes/no response is automatically logged)
Notification of rights: Inform candidates of their right to access, correct, or delete their data

Use Carerix automation features to build compliant data-handling workflows:

Example 1: Automatic Consent Renewal Reminder

Create a scheduled job that runs monthly to identify candidates with consent expiring within 30 days
Send a consent renewal email using Carerix's built-in template
Use a trigger to log the response (yes/no) to the candidate record and update the consent status automatically
For candidates who do not respond within 30 days, either anonymize their record or delete it, depending on your data retention policy

Example 2: Automatic Anonymization on Consent Expiry

Configure a business rule: if consent status = "No" or consent expiry date has passed, move the candidate to an "anonymization queue"
Run a scheduled anonymization job on the queued candidates
Generate a report of anonymized records for audit purposes

GDPR Best Practices for Carerix Users

✓ Document everything: Maintain records of when and how you obtained consent, what legal basis supports each type of data processing, and when/why data is deleted. This documentation is essential if a data protection authority questions your compliance.

✓ Minimize data collection: Collect only the personal information you actually need. Remove fields from candidate forms that are "nice to have" but not essential.

✓ Set clear retention periods: Define how long you keep data for each purpose and document it in your privacy statement. Use Carerix's scheduling features to clean up data automatically after the retention period expires.

✓ Test your workflows: Before going live with automated consent or anonymization workflows, test them thoroughly to ensure they work as intended and do not accidentally delete or corrupt data.

✓ Train your team: Ensure all users who handle personal data understand GDPR principles and your organization's policies. Regularly remind them of their responsibilities.

Need Help?

If you have questions about GDPR compliance, how to configure consent workflows, or how to use anonymization features, contact our support team at helpdesk@carerix.com. We can help you set up processes that meet your organization's specific compliance requirements.

Carerix & GDPR - Complete Guide

Understanding GDPR and Your Obligations