Handing job board accounts to an RPO partner

RPO, recruitment process outsourcing, means hiring an outside firm to run part of your recruiting. An RPO partner can get into your job boards in three ways. You add its recruiters as users on your employer account, its recruiters post from their own accounts, or you hand over a shared company login. Check what each board allows before you pick. Whichever way you pick, the partner sees applicant data, so the contract has to cover that too. The general idea of checking on a vendor is in What is vendor oversight?

What the boards’ own rules say

Indeed’s Terms of Service settle the shared-login question. Section D.7 says account credentials and access “may not be shared with others.” The terms define “Employer” to include any authorized user who manages the account or acts for the employer. They also say that working through an agency “does not exempt you from the Terms.” Under Section B.1.4, adding a user to a role confirms that you are authorized to give that user your account data, including candidates’ personal data. So on Indeed, the partner’s recruiters get their own users, and you stay responsible for them. Setting those users up is covered in Managing Indeed employer account users with an RPO partner or a hiring team.

ZipRecruiter’s help center says yes to giving others access. An admin adds a user under Settings and then Users, and the new user gets an email invite. Each user is an Account Owner, with full access to every feature, or a Restricted User, with some access settings turned off. Its articles on users don’t mention outside firms, so check your agreement or ask ZipRecruiter before you add a partner’s staff.

LinkedIn works differently. Its help center says jobs “must be posted from individual member accounts,” from a profile with the person’s real name. Applicants who apply on LinkedIn are visible only to the member who posted the job. If the partner’s recruiter posts your job from their own profile, your applicants sit in that recruiter’s account. Decide who posts before the first job goes up. Roles and removal on each board are compared in Job board roles and shared logins.

What the CCPA asks of the contract

The California Consumer Privacy Act (CCPA) applies here if your company is covered and your applicants include California residents. Applicant data has been in scope since the employment exemption in Civil Code 1798.145(m) became inoperative on January 1, 2023. Who is covered, and the other US rules on applicant data, are in Managing HR and recruiting accounts.

A firm that handles personal information for you is a “service provider” only under a written contract that limits what it may do with the data (1798.140(ag)). Section 1798.100(d) requires that contract, and the regulations list its terms in 11 CCR 7051(a). Two terms bear most on accounts. The contract must name the specific business purpose instead of pointing to the whole contract (7051(a)(2)). It must also give you the right to take reasonable steps to check the partner’s use, such as an assessment at least once every 12 months (7051(a)(6)). Without a contract that meets 7051(a), the partner isn’t a service provider. Handing it applicant data may then count as a sale or sharing of personal information (7050(e)).

The law also limits scope. Section 1798.100(c) says collecting, using, keeping and sharing personal information must be “reasonably necessary and proportionate” to the purpose. On a job board, you apply that limit through the access level. If the partner handles only some openings, Indeed’s Limited access covers reviewing and messaging candidates for specific jobs. A shared login gives the partner everything that login can do.

Three ways to hand over access

Sample wording for these clauses is in What your vendor contract should say about accounts. If the partner already works from a shared login, see What to check when a vendor says its team uses one shared login.

When the engagement ends or a recruiter leaves

Each way ends differently. On Indeed, an admin removes the user from the Users page. Indeed doesn’t notify removed users, so tell the partner yourself. On ZipRecruiter, an admin opens Settings and then Users, chooses Deactivate from the Actions button next to the name, and confirms. With a shared login, you change the password and give the new one to the people who stay.

LinkedIn needs planning before the end date. Job posts can’t be deleted, only closed, and a closed post can’t be reopened. LinkedIn says you can still review the applicant list of a closed post if you collected applications on LinkedIn. So applicants from a partner’s post stay in that recruiter’s account after the contract ends. Agree in advance that the partner closes its posts for your jobs and deletes applicant data it copied out.

Data on the partner’s laptops and in its own systems is out of your reach. The CCPA regulations require the contract to let you take reasonable steps to stop and fix unauthorized use (7051(a)(8)). Their example is proof that the provider no longer keeps data about people who asked you to delete it. For the end of the contract, write your own clause: the partner deletes the applicant data it kept and confirms it in writing. The order of steps is in the Checklist for taking back access when a vendor contract ends.

Recruiters at the partner change during an engagement, and you won’t hear about it unless the partner tells you. NIST SP 800-53, the federal catalog of security controls, covers this in control PS-7. It asks you to require outside providers to report transfers and terminations of their staff who hold your logins. Put that duty in the contract, and when a notice arrives, remove that one recruiter the same way.