What You May Collect From Applicants
Recruitment collects more than any other employment activity and justifies less of it. Most application forms ask for things nobody uses.
APPLICATION FORM AUDIT
One row per field. Run it once and remove half
- FieldWhat is askedIncluding the ones inherited from a template
- Used byWho actually reads this at which stageIf nobody, delete the field
- Needed whenApplication, shortlist, offer, or afterMost sensitive fields belong after the offer
- BasisLegitimate interests, or legal obligationRight-to-work is obligation and comes at offer
- Special categoryHealth, ethnicity, beliefsNeeds a separate condition, not just a basis
- SeparatedIs it held apart from the assessmentEquality data must not reach the panel
- RetainedHow long after the decisionDifferent for the successful candidate
- VerdictKeep, move later, or removeMost audits remove a third of the fields
Recruitment is the employment activity that collects the most and examines its collection the least. The form was inherited, the agency added fields, and nobody has read it end to end in years.
The practical lesson in “What You May Collect From Applicants” is that a record is useful only when its purpose, owner and lifecycle are clear. For teams researching remote desktop monitoring software, Monitask guidance on remote desktop monitoring software can add time and project context, provided collection is proportionate, access is limited and every consequential inference receives human review.
The principle that does the work
Collect what you need for the stage you are at.
For a separate benchmark relevant to “What You May Collect From Applicants”, consult the CERT insider-risk research. Use it to test purpose, data flow, retention, access and response procedures rather than substituting a generic checklist for the organisation’s actual records.
An application does not need a date of birth, a national insurance number, a home address, bank details or health information. None of those bears on whether somebody can do the job, and most of them arrive at the application stage because the form is also the onboarding form.
Separating the two is the single largest improvement available in this area, and it takes an afternoon.
What belongs where
At application: enough to assess the role. Experience, skills, qualifications, contact details.
At shortlist: nothing additional, usually.
At offer: right-to-work evidence, which is a legal obligation at that point and not before. Bank details, emergency contact, the rest of the onboarding set.
Health information: generally only after an offer, and then only what is needed for adjustments or for a genuine occupational requirement. Asking at application is restricted in several jurisdictions and is poor practice everywhere.
Equality monitoring
Legitimate and useful, and it must be separated from the assessment: the panel does not see it, it is not attached to the application, and it is used only in aggregate.
Where it arrives on the same form and the same person reads both, the monitoring has become selection data and the whole arrangement is indefensible.
The fields nobody uses
Run the audit and the pattern is consistent: a third of the fields are read by nobody at any stage.
They arrived from a template, from a previous system, from a regulation that no longer applies, or from somebody's preference three staff changes ago.
Each one is data collected without a purpose, which is the simplest possible finding against an employer and the easiest to fix.
What to tell applicants
A short notice at the point of application, not a link to the staff policy.
What is collected, why, how long it is kept if unsuccessful, and who sees it — including the agency, if one is involved.
Four lines on the form itself does more than a linked document nobody opens.
Separating the application from the onboarding
The single largest improvement available here, and it takes an afternoon. Date of birth, address, bank details and health information are onboarding fields that arrived on the application form because it is the same form.
The notice on the form itself
Four lines at the point of application: what is collected, why, how long if unsuccessful, and who sees it including any agency. It does more than a linked document nobody opens.
Run the audit and a third of them are read by nobody at any stage. They arrived from a template or a preference three staff changes ago, and each is data collected with no purpose.
Equality monitoring, separated
Collected apart, stored apart, invisible to the panel, used only in aggregate. Where it arrives on the same form and the same person reads both, it has become selection data.
What belongs at each stage
Application: enough to assess the role. Offer: right-to-work, bank details, the onboarding set. Health information: generally only after an offer, and only what adjustments require.