GDPR for Recruitment Agencies: ID Copies, Privacy Notices and Clients

A compliance officer at an agency branch in Eindhoven types "paspoort" into the search bar of the shared recruitment inbox. The results include candidates who registered last spring and never worked a shift. The planner's spreadsheet has a tab of photos someone pasted in on a busy Monday. Every copy was made for a reason. Nobody decided how long any of them should live.

When a candidate moves from agency to client, their data moves too, and each copy is one more place where the General Data Protection Regulation (GDPR) requires it to be accurate, secure and kept no longer than needed (Article 5(1)(d) to (f)). This article follows staffing agency candidate data under the GDPR and Dutch law, before and after hiring. We label each point as law in force, official guidance or our own reading, and mark recommended safeguards as good practice.

Who may hold a copy of a candidate's ID, and for how long?

It depends on who holds it, the stage, and the worker's nationality.

Can a staffing agency keep a copy of a candidate's ID?

Yes, but before hiring only briefly. Article 7c of the Waadi (Wet allocatie arbeidskrachten door intermediairs), the Dutch law on placing workers through intermediaries, is law in force:

Four weeks is a maximum, counted from when the copy enters the records, not from the end of the registration. A copy from last spring, for someone who never worked a shift, should be gone.

The Dutch Data Protection Authority (Autoriteit Persoonsgegevens, AP) adds two points. A candidate may black out their citizen service number (BSN) on the copy, because the agency may not record it at registration. And an agency may not copy the ID of a self-employed person (zzp'er) who takes an assignment through it. In our reading, that fits a genuinely self-employed assignment, since Article 7c covers people placed under a client's supervision and direction, or helped into an employment contract. If a "self-employed" assignment is in fact such a placement, Article 7c may apply after all.

What changes once the candidate becomes the agency's employee?

Payroll-tax rules replace the four-week rule. Article 28(1)(f) of the Wage Tax Act 1964 (Wet op de loonbelasting 1964) applies to an employee receiving wages from current employment. In our reading, the exception in Article 7c therefore starts when the person actually enters the agency's employment, not at registration. The AP says the same.

The Wage Tax Implementing Regulation 2011 (Uitvoeringsregeling loonbelasting 2011), Article 7.5, law in force, sets the details:

Rijksoverheid and Ondernemersplein use the same calendar-year rule. The AP's shorter wording, time in service plus five years, is a simplification; use the regulation's. The general seven-year rule for tax records (General Tax Act, Article 52(4)) applies only where tax law sets no other period. In our reading, Article 7.5(4) is that other period.

In practice, in our reading of these texts:

Employers that hire directly: the AP says an employer may look at an applicant's original ID but may not copy, scan or photograph it during the application. Verifying Frontline Candidates: Which Identity, Right to Work and Certificate Checks Can Happen Before the Offer? covers checks before the offer.

May the client keep a copy of an agency worker's ID?

Usually not, according to government guidance. Rijksoverheid says a company that hires an agency worker (the inlener) checks the original ID itself before work starts but may not keep a copy, because the agency is the employer. Ondernemersplein adds that the client records the worker's personal details. We found no statute that sets this general check for EEA and Swiss workers, so treat it as guidance. For the hirer's own checks and fines, see Hiring agency workers: Dutch chain liability, checks and Wav fines.

The exception is a worker from outside the EU, EEA and Switzerland. Under the Wav (Wet arbeid vreemdelingen), the agency must make sure the client receives a copy of the worker's ID without delay once work starts. The client checks identity against it, files it, and keeps it until at least five years after the end of the calendar year in which the work ended (Article 15(1) to (4), law in force).

If an agency forwards a scan for an EEA worker anyway, the client holds a copy that guidance says it should not keep.

What may an agency ask for at registration?

Only what it needs to place the candidate. Each use of data needs a lawful basis under GDPR Article 6(1), such as steps at the candidate's request before a contract, a legal obligation, or a legitimate interest, and data must be limited to what is necessary (Article 5(1)(c)).

Consent is rarely the right basis. The AP says applicants depend on the organisation, so their consent is not freely given. The European Data Protection Board (EDPB) calls relying on the consent of current or future employees problematic, though not ruled out in every case.

What the AP says an agency may not do at registration (official guidance):

Candidate data retention: no law sets a period for an agency's candidate pool. The GDPR rule is no longer than needed (Article 5(1)(e)), so set and document one. For an employer's own applicants, AP guidance is deletion usually within four weeks after the procedure ends, or up to one year with consent.

What must candidates be told under the GDPR, and by whom?

Every controller must tell them. A controller decides, alone or with others, why and how personal data is processed (Article 4(7)); a processor works on a controller's behalf (Article 4(8)).

The agency, at collection: who it is, why it uses the data, on what legal basis, and who receives it, including clients by name or category (Article 13(1)).

The client, within a month: a client that receives the data and is a controller must inform the candidate itself, including where the data came from. At the latest, it does so within one month, or at first contact or first disclosure if earlier (Article 14(2)(f) and (3)).

Does the agency's notice cover the client? Only where and insofar as the candidate already has the information the client must give (Article 14(5)(a)). EU transparency guidance, endorsed by the EDPB, says the Article 14 exceptions should be read narrowly, and that a controller relying on what a person already knows must be able to show it. Naming the client as a recipient does not tell the candidate the client's own purposes, retention period or contact details. In our reading, the client should usually give its own short notice, for example at the ID check before the first shift.

Good practice: an agency can hand over the client's notice with the shift details, in line with the one notice per move that Radius Hire's 2026 research paper on frontline hiring handoffs suggests.

GDPR roles for recruitment agencies: who is responsible for candidate data?

It depends on what each party actually decides. The EDPB says roles follow actual activities, not the label in a contract (Guidelines 07/2020, paragraph 12). Three patterns fit agency work:

Good practice: record the role for each data flow between agency and client, and check that both privacy notices match.

What should the agency pass on to the client?

Only what the client needs for the placement (GDPR, Article 5(1)(b) and (c)). For a first shift, Radius Hire's research paper suggests sending the practical details the day before: a name list, the start time, and slots for the ID check and the induction. For an EEA or Swiss worker, that does not include an ID copy.

Do automated assessments or AI tools change the rules?

Yes, if no person makes the decision. Under GDPR Article 22, candidates may not be subject to a decision based solely on automated processing with legal or similarly significant effects. The AP says a fully automated score that decides an application affects the applicant significantly in almost all cases. For an employer or agency, it names two routes: the decision is necessary to enter into a contract, or the candidate gives explicit consent, which it calls less obvious. The candidate can then obtain human intervention, give their view and contest the decision (Article 22(3)), and must be told beforehand.

There is no automated decision, the AP says, where a competent person can change or overrule the outcome in practice. A person who must always follow the score does not count.

When is a data protection impact assessment (DPIA) needed? Where processing is likely to be high risk, in particular systematic and extensive automated evaluation, including profiling, behind decisions with significant effects (Article 35(3)(a)). The AP's mandatory DPIA list includes profiling such as assessing work performance, and blacklists of worker misconduct shared with third parties, naming agencies as an example. Otherwise the AP's rule of thumb is a DPIA where two or more of the European regulators' nine criteria apply. The EU AI Act adds separate rules, outside this article: see the EU AI Act in recruitment.

How do you reduce the number of ID copies?

Count them first. Radius Hire's research paper treats ID copies differently from every other item in its cost table: "Not a cost: count it and aim to reduce it".

Good-practice steps, drawn from the paper:

How Radius helps

Radius Hire is an AI hiring platform for frontline roles, built in Amsterdam for staffing agencies and employers who hire for the work floor. It is built to source, interview and verify applicants, while a person makes every hiring decision. In the Radius ATS, WhatsApp and email threads, notes, the interview, offers and contracts sit on one candidate record, and agencies run every client's roles in one workspace with permissions per team. Each verification check keeps its source and its date, and candidate data is hosted in the EU. That gives your team one place to look when you count where candidate data sits. Which copies you keep, and for how long, stays your decision.