PIPEDA for Recruitment Agencies: Candidate Data Privacy Compliance

Recruitment and staffing agencies are data intermediaries — they collect sensitive personal information from candidates and share it with client employers. This creates layered PIPEDA obligations that go beyond what most single-employer HR departments face. Here's what Canadian recruitment agencies need to know.

Last updated: April 2026

How PIPEDA Applies to Recruitment Agencies

Recruitment agencies collect personal information from candidates and share it with employer clients for the purpose of facilitating employment. PIPEDA applies because:

• Collection, use, and disclosure of personal information is core to the business
• Agencies act as commercial intermediaries in employment markets
• Both candidates (natural persons) and client employers (whose information the agency may hold) can be data subjects

Note for Alberta and BC: PIPA Alberta and PIPA BC apply to provincially regulated employment activities in those provinces, including staffing agencies operating within those provinces.

What Personal Information Do Recruitment Agencies Collect?

Candidate Information

• Contact details (name, address, email, phone)
• Resume and work history
• Education credentials
• Professional certifications and licences
• References and reference letters
• Interview notes and assessment scores
• Skills test results
• Salary history and expectations
• Work authorisation status (SIN may be requested for tax purposes once placed)
• Background check results (criminal record, credit, reference)
• Health information (for safety-sensitive placements or accommodation purposes)
• Photograph (where requested by some employers)

Client Employer Information

• Key contact names and roles
• Job descriptions and requirements
• Salary budgets
• Feedback on candidates
• Confidential business information about the role (may be shared by the employer)

Key PIPEDA Obligations for Recruitment Agencies

1. Candidate Consent

When candidates submit their resume or enter your talent database, they must understand and consent to:

• What personal information you'll collect about them
• How you'll use it (active job search, talent pool/database, future matching)
• Who you'll share it with (client employers, background check providers, third parties)
• How long you'll retain their information

Common consent points:

• Active placement consent: Candidate submitting for a specific role implies consent for sharing with that employer
• Talent pool consent: Retaining a resume for future opportunities requires explicit consent — including how long you'll hold it
• Background check consent: Always requires express consent, typically a separate authorization form

What you cannot do without consent:

• Share a candidate's resume with an employer without the candidate knowing which employer
• Add candidates to your database from LinkedIn scraping without direct consent
• Forward a resume you received for Role A to an employer with a different Role B without candidate knowledge

2. Limiting Disclosure to the Purpose

Candidates consent to resume sharing for placement purposes. You cannot:

• Share candidate information with your own clients for purposes other than the specific placement
• Use candidate data for your own marketing without separate consent
• Sell or license your candidate database to third parties

3. Background Checks

Background checks (criminal record, credit, education verification) involve highly sensitive personal information. PIPEDA requirements:

• Express consent — always required, before the check is conducted
• Specific purpose — the check must be relevant to the role (credit check for a financial role; criminal check for a childcare role)
• Proportionality — conduct only checks relevant to the job requirements

In some provinces, human rights legislation restricts when certain background checks (like criminal record checks) can be requested. Check applicable provincial human rights rules in addition to PIPEDA.

4. Retention of Candidate Information

This is one of the most common PIPEDA issues for recruitment agencies. Many agencies maintain candidate files indefinitely — which violates PIPEDA's limiting retention principle.

Best practice:

• Set retention periods for active vs. passive candidates
• Notify candidates when their file is due to be deleted, with an option to reactivate
• Delete or anonymise records that are no longer needed

Recommended retention approach:

Situation	Retention
Active placement (placed candidate)	Duration of placement relationship + 2 years
Active candidate (current job search)	Duration of expressed job search + 1 year
Passive talent pool (with consent)	Up to 2-3 years with annual re-confirmation
Unsuccessful candidate	1-2 years (unless candidate requests deletion)
Reference check notes	1-2 years

5. Sharing Candidate Information with Employer Clients

When submitting candidate profiles to employers:

• Share only what's relevant and what the candidate has consented to share
• Don't include protected characteristics (age, religion, disability, family status) in candidate profiles unless the candidate volunteered the information in a relevant context
• Brief employer clients that candidate information received from your agency is personal information subject to confidentiality and PIPEDA

6. Candidate Right of Access

Candidates have the right to access their file. This includes:

• Resume and work history on file
• Assessment notes and test results
• Interview notes (though internal work product notes may be withheld)
• Reference check results

You have 30 days to respond. You may withhold information about third parties (e.g., specific feedback from reference providers if they were promised confidentiality).

7. Technology Platforms

Recruitment agencies typically use ATS (Applicant Tracking Systems) like Workday, Greenhouse, Bullhorn, or PCRecruiter. These platforms hold your candidate database. Key obligations:

• Review the vendor's data security and privacy practices
• Ensure there's a data processing agreement covering how they handle candidate data
• Understand where data is stored (Canadian vs. US servers)
• Set up proper retention and deletion workflows within the ATS

Practical Compliance Checklist for Recruitment Agencies

• Update candidate intake form to include PIPEDA consent language
• Create a separate background check authorization form
• Publish a privacy policy covering both candidates and clients
• Designate a Privacy Officer
• Set and document candidate data retention periods
• Establish a process for access requests (30-day deadline)
• Review ATS data agreements and security practices
• Train all recruiters on privacy obligations
• Create a breach response procedure

Frequently Asked Questions

Q: We found a great candidate on LinkedIn and want to add them to our database. Do we need their consent? A: Proactively collecting someone's information from LinkedIn and adding them to your recruitment database constitutes collecting personal information. Reaching out to ask if they're interested in being added — and obtaining their consent — is the PIPEDA-compliant approach.

Q: A candidate placed with a client 3 years ago wants their file deleted. What do we do? A: Unless you have a legal or regulatory reason to retain the information, honour the deletion request. Review whether any ongoing obligations (tax records for contractor placements) require retaining certain elements before deleting.

Q: Can we share candidate profiles across our franchise network without specific candidate consent? A: If your consent language says candidates' information may be shared within your network for placement purposes, sharing within the franchise may be covered. But sharing with external partner agencies would typically require specific disclosure and consent.

---

Privacy Compliance for the Talent Business

Canada Compliance AI helps recruitment and staffing agencies build PIPEDA-compliant candidate data programmes — from intake consent forms to retention schedules.

Start your free trial today — your talent pipeline deserves proper protection.

Related reading: PIPEDA Compliance Guide | PIPEDA Access Requests | PIPEDA Personal Information