Recruitment Agencies as Processors
The relationship is usually documented wrongly, which matters because it determines who answers when a candidate asks or something goes wrong.
AGENCY RELATIONSHIP
Establish which this is before anything else
- Agency sources candidates for youThey act on your instructionsProcessor. Contract required
- Agency maintains its own candidate databaseThey decide purposes for their own poolController for that, in their own right
- Both, in the same engagementCommon, and needs separatingJoint or sequential, documented either way
- Who tells the candidateNamed in the agency notice and yoursCandidates routinely told by neither
- InstructionsWhat the agency may and may not do with the dataIncluding using it for other clients
- RetentionWhat they keep after your decisionUsually longer than you, under their own basis
- BreachHow quickly they tell youYour clock runs from their awareness
- Sub-processorsWho they useThe screening tool behind the agency
An employer using a recruitment agency is in one of several relationships, and the documentation usually describes none of them accurately.
The supplier test in “Recruitment Agencies as Processors” should cover the real data flow, not only the contract summary. Organisations considering Monitask for how employee monitoring works should document hosting, subprocessors, permissions, deletion and export before rollout, then verify those controls during renewal and exit.
The three situations
The agency acts entirely on your instructions, sourcing for your role with your criteria. It is a processor and you need a contract with the required terms.
For a separate benchmark relevant to “Recruitment Agencies as Processors”, consult the NIST Privacy Framework. Use it to test purpose, data flow, retention, access and response procedures rather than substituting a generic checklist for the organisation’s actual records.
The agency maintains its own candidate pool, approaches people independently, and presents those who fit. For its own pool it is a controller in its own right, with its own basis and its own notice.
Both at once, which is the common case and the one that goes undocumented.
Why it matters practically
Who answers a request. A candidate asking what is held must be answered by whoever holds it in which capacity, and if neither party is clear, both delay.
Who tells them anything at all. Candidates sourced through agencies are routinely told nothing by either party, each assuming the other did.
Who is liable when something goes wrong. A processor acting outside instructions becomes a controller for that processing, and the employer who gave no instructions cannot show what was outside them.
The contract terms that are actually required
Processing only on documented instructions. Confidentiality. Security measures. Conditions on sub-processors. Assistance with requests and breaches. Deletion or return at the end. Audit rights.
Agency standard terms frequently cover some of these and almost never all. Reading them once, before the first engagement, is an hour.
What they do with the data afterwards
An agency keeping candidates it sourced for you, to present to other clients, is processing for its own purpose.
That may be legitimate and it needs to be on its own basis, with its own notice to the candidate, and it should not be happening under your instruction without anybody saying so.
The sub-processor behind them
Agencies use screening tools, assessment platforms and database providers.
Those are sub-processors and they should be disclosed. An employer that has not asked does not know where candidate data for its roles actually sits, which is the question a regulator asks second.
The sub-processor behind the agency
Screening tools, assessment platforms, database providers. An employer that has not asked does not know where candidate data for its own roles sits, which is the question asked immediately after where is the data.
Who tells the candidate
Named in both notices, and in practice named in neither. Candidates sourced through agencies are routinely told nothing by either party, each assuming the other did it.
Three relationships, usually undocumented
Agency sourcing for you is a processor. Agency maintaining its own pool is a controller for that pool. Both at once is the common case and the one nobody writes down.
The required contract terms
Instructions, confidentiality, security, sub-processors, assistance, breach notification, deletion or return, audit. Agency standard terms cover some and almost never all.
What they do with it afterwards
An agency keeping candidates it sourced for you, to present elsewhere, is processing for its own purpose. That needs its own basis and its own notice, and it should not be happening under your instruction.
Establishing which relationship it is
Before the first engagement, in writing. The answer determines who answers a candidate's request, who tells them anything, and who is liable when something goes wrong.