Managing HR and recruiting accounts

For each job board and HR system account, HR and recruiting teams decide who may use it and how they’ll know who used it. They also decide how access starts and ends as people join, change roles and leave. These accounts hold applicants’ and employees’ personal data, so the same decisions affect how you meet US privacy and record-keeping rules.

Where shared logins show up in HR

Job boards, applicant tracking systems and payroll tools are outside services that HR can sign up for and run itself. Some connect to your company’s identity provider, the service that holds your company logins, such as Okta or Microsoft Entra ID. Others don’t. A shared account, one username and password used by several people, tends to stick around in four places.

• Job board employer accounts. Recruiters review and download applicants there, and where a board or portal offers only one company login, the whole team signs in with it.
• RPO partners. RPO, recruitment process outsourcing, means hiring an outside firm to run part of your recruiting. When adding the partner’s recruiters as users takes too long, or a tool can’t add them, someone hands over the company login. Some job boards forbid that: Indeed’s terms say account access “may not be shared with others.”
• Admin logins on HR, payroll and background-check portals. One admin login may be used by both HR and IT.
• Seasonal help. When the hiring rush brings in temps, short-term hires or people from other teams, telling them a password feels faster than creating logins for a few weeks.

The problems with shared accounts are the same everywhere. People who leave still know the password, the tool’s history shows only the account name, and two-step codes reach one person’s phone. Managing shared accounts covers them. How job boards split roles is in Job board roles and shared logins, and working with an outside recruiting firm is in Handing job board accounts to an RPO partner. For admin logins, see Why a shared admin login in HR and payroll systems is a problem.

Which US rules reach applicant and employee data

No single US law covers all applicant and employee data. Several rules each cover a piece.

The California Consumer Privacy Act (CCPA) gives privacy rights to California residents. The California Privacy Protection Agency says this includes employees and job applicants. The exemption for employment data expired on December 31, 2022, so that data has been covered since January 1, 2023. The CCPA applies only to for-profit businesses that do business in California and meet at least one threshold (Cal. Civ. Code 1798.140(d)). One is annual gross revenue of $26,625,000 or more, the inflation-adjusted figure in effect since January 1, 2025, per the CPPA. The others are buying, selling or sharing personal information about 100,000 or more California residents or households, or earning half or more of revenue from selling or sharing it.

A covered business must use “reasonable security procedures and practices” to protect personal information from unauthorized access (1798.100(e)). Section 1798.150 lets people sue when certain personal information is exposed because a business failed to meet that duty.

Federal record-keeping rules add a duty to keep data, not only to protect it. Under the EEOC’s rule at 29 CFR 1602.14, an employer keeps “any personnel or employment record” it made or kept, including application forms, for one year. The year runs from when the record was made or the personnel action was taken, whichever is later. For an employee let go involuntarily, it runs from the termination date. Once a discrimination charge is filed, relevant records must be kept until the matter is finally resolved. The EEOC says these rules apply to all employers covered by federal anti-discrimination laws.

Background checks have their own rule. When you hire a screening company to run background checks, the Fair Credit Reporting Act applies, and the FTC’s guide for employers treats its report as a consumer report. The FTC’s Disposal Rule, 16 CFR Part 682, requires “reasonable measures to protect against unauthorized access to or use of the information in connection with its disposal.” The same guide says the reports, and any information gathered from them, must be disposed of securely.

Section 5 of the FTC Act (15 U.S.C. 45) applies more broadly. It makes unfair or deceptive acts or practices in commerce unlawful. The FTC’s guide Protecting Personal Information says the FTC Act may require reasonable security for sensitive information. The same guide says to limit access to employees with a need to know. It also says to terminate the passwords of employees who leave, as part of the check-out routine.

For accounts, these rules point to two practices. Limit applicant data to the people working on hiring, as the FTC guide says. End access when a person’s role ends, while keeping the records as long as 29 CFR 1602.14 requires. A third practice lets you check the first two: be able to tell who opened the data. With one shared login, no one can say who downloaded a file after a leak. How to keep applicant data from leaving your hiring tools turns these into steps.

Onboarding and offboarding in short

HR learns first when someone joins, moves or leaves, so HR’s dates drive account changes. NIST SP 800-53 Rev. 5 is a US catalog of security controls, required for federal systems and voluntary for others. Its control AC-2 l asks you to align account management with personnel termination and transfer processes. PS-4 lists what to do when employment ends, and PS-5 covers transfers.

At the start, the person gets their own login with only the access the job needs, and goes onto the user list of any shared account they use. At a role change, access from the old role comes off. At exit, the person’s logins are disabled, shared passwords they knew are changed, and company property comes back. The terms are defined in What do onboarding and offboarding mean for account access? The item-by-item version is the account checklist for onboarding and offboarding employees.

Shared accounts are the hard part. You can’t disable a person inside a shared login, so you change the password and give the new one to everyone who stays. The limits of changing shared passwords every time someone leaves explains the cost.

Ways to manage the accounts

The basic choice is between splitting into personal accounts and keeping a shared account while controlling who uses it. There are four ways to do the second.

Comparing ways for several people to use one shared account goes deeper into the last four. You can choose per account. For job boards with users, see Managing Indeed employer account users with an RPO partner or a hiring team. For the hiring rush, see Giving seasonal hiring staff job board access without sharing passwords.

Where to start

Start with a list of every account HR and recruiting use. For each one, write down the tool, the account, and who uses it now: employees, temps, short-term hires or a partner’s recruiters. Add whether it holds applicant or employee data, where two-step codes go, and who shuts off access when someone leaves. How to take inventory of shared accounts and what to record shows what to capture.

Next, split what can be split. Check each tool’s help center to see whether it supports separate users and access levels, and move those accounts to personal logins. What’s left are boards with one company login, systems with a single admin login, and cases where a partner’s recruiters can’t be added in time. Pick a method for those from the table above.

Last, put account steps into HR’s hire, transfer and exit steps. Set a deadline for turning access off and apply it to shared password changes too. For the hiring rush, keep a roster with each person’s start and end dates, and shut off access on the end date.