Ask before sharing
Tell the candidate the client’s identity, the role, the information you plan to share, and the purpose. Give them time to review the version of their profile or CV that will be sent.
Record their decision for that client and vacancy. A general expression of interest should not be treated as permission to send a CV to unrelated employers or future roles.
Minimise and secure the information
Share only information needed for the introduction. Remove private notes, irrelevant contact details, and sensitive information that the client does not need at this stage.
Use approved secure storage and access controls. Keep each client’s candidate records separate, review who can access them, and follow your organisation’s retention and deletion schedule.
Respect changes of mind
Make it easy for candidates to ask what has been shared, correct an error, or withdraw permission for future sharing. Explain what action you can take and any copies already sent to a client.
Record consent changes promptly, stop additional sharing, and notify the relevant client when appropriate. Follow applicable privacy requirements and your organisation’s process for responding to access or deletion requests.
Action checklist
- Client, role, purpose, and exact materials disclosed.
- Permission recorded for that specific introduction.
- Only necessary information shared through approved tools.
- Candidate can correct details or change future permissions.
- Consent changes and data-retention actions documented.