How to keep applicant data from leaving your hiring tools

Keeping applicant data in your hiring tools takes two steps. First, limit who can see it to the people working on hiring. Second, put a limit and a record on each way the data leaves. There are four: exports from a job board or applicant tracking system, résumé files, copies for interviewers, and personal devices. Which US rules reach applicant data, and why, is in Managing HR and recruiting accounts.

What counts as data leaving

The California Consumer Privacy Act (CCPA) frames the risk for businesses it covers. A covered business must use reasonable security to guard personal information against “unauthorized or illegal access, destruction, use, modification, or disclosure” (Civil Code 1798.100(e)). Section 1798.150 lets a California resident sue when certain personal information that was neither encrypted nor redacted suffers “unauthorized access and exfiltration, theft, or disclosure” because the business failed that duty. Exfiltration means data being copied out to someone who shouldn’t have it.

So every copy outside the hiring tool is a copy you have to protect. That includes an export on a recruiter’s laptop, a résumé saved to a personal folder, and a printout handed to an interviewer.

Copies also have to be kept or thrown away correctly. The EEOC’s rule at 29 CFR 1602.14 requires employers covered by federal anti-discrimination laws to keep application forms and other hiring records for one year. The year runs from when the record was made or the personnel action was taken, whichever is later. Once a discrimination charge is filed, relevant records, including other candidates’ applications for the same job, must be kept until the matter is resolved. So keep one copy of each record in one place for the required time and delete the stray copies, but not while a related charge is open.

Background check reports have their own disposal rule. A report from a consumer reporting agency used for “employment purposes” is a consumer report under the Fair Credit Reporting Act (15 U.S.C. 1681a(d) and (h)). The FTC’s Disposal Rule (16 CFR Part 682) applies to anyone under the FTC’s jurisdiction who keeps consumer report information for a business purpose. Section 682.3 requires reasonable measures against unauthorized access when you dispose of it. Its examples are shredding paper so it can’t be read or put back together, and destroying or erasing electronic media.

Limits and records for each path

NIST SP 800-53, the federal catalog of security controls, has controls that fit these paths. The ones used below are AC-6 (least privilege), AU-6 (reviewing activity records), MP-7 (removable media) and AC-20 (devices the company doesn’t own).

Exports from a job board or tracking system

A recruiter downloads the applicant list and works from a spreadsheet. Limit exports to the recruiters on the job. Where the board’s roles can’t separate that, decide who may export and for what. Record who exported, when, and how many applicants. Job board roles and shared logins shows how each board divides access.

A shared login breaks that record. The board’s history shows the company account, not the person, so you have to keep the record of use yourself. NIST control AU-6 asks you to review activity records for unusual activity, and AC-2(12) gives examples such as use at odd hours or from unusual places. A review can catch a pattern like a large export the day before someone leaves.

Résumé and application files

Résumés end up as email attachments, in personal folders and in chat threads. Pick one place to store them and limit who can open it. Then delete extra copies, and delete the kept copy when the retention period above has passed. Record where files are kept and the date you deleted each batch.

Copies for interviewers

Interviewers need a résumé for a short window. Share a link to the stored file for that window instead of attaching the file to an email. Collect printouts after the interview and shred them. Record who received which applicant’s file, and when access ended or the paper came back.

Personal phones, laptops, USB drives and personal cloud storage

Recruiters may check applicants on a personal phone or sync files to a personal cloud account. NIST control AC-20 asks you to decide whether personally owned devices may handle company information. If you allow it, set terms; if not, prohibit it. MP-7 asks you to restrict or prohibit removable media, for example by allowing only company-issued drives. Record who may use a personal device and which devices they use.

When a recruiter leaves

A recruiter who has given notice keeps all their access until the last day. Between the notice and the last day, limit exports to what the handover needs. On the last day, disable their logins and change any shared password they knew. The full exit routine is in the Account checklist for onboarding and offboarding employees.

Telling your team what is recorded

Records of account use are records about your own employees. The discussion under NIST control AC-2(12) notes that monitoring use can create privacy risks, because the data may reveal things about how people behave. Say what you record, why, and who can see it.

New York requires a notice of its own. Its Civil Rights Law 52-c covers employers that have a place of business in New York and monitor employees’ email or internet use. They must give written notice at hiring, have employees acknowledge it, and post the notice where those employees can see it. Check the rules in the other states where your recruiters work.

When an applicant asks how their data is handled

Since the employment exemption ended, California applicants of a covered business can use the CCPA’s consumer rights. Answer from the limits and records above. You can say who can open applicant data, how long you keep it, and how copies are controlled and destroyed.