What privacy and consent requirements apply to reusing candidate data at enterprise scale?

Reusing candidate data at an enterprise scale requires adherence to data retention limits and the original scope of consent given by the candidate during their application. This becomes more complex when operating across multiple regions and business units at the same time. Under GDPR and similar frameworks, an organization can only hold and reuse candidate data if it has a lawful basis to do so.

Three requirements are particularly important at this scale. First, retention limits must be consistently enforced across all business units and regions. A candidate whose data should be deleted under one division's policy remains a liability if another division still holds their profile. Second, the scope of consent usually covers consideration for future roles at the company in general, not just the specific job for which someone applied.

However, this depends on the exact wording in the privacy notice used in each region's application process. Third, data subject rights, including access, correction, and deletion requests, apply globally under frameworks like GDPR. A candidate can exercise these rights regardless of which regional entity or system processed their application.

Cross-border data transfer introduces another requirement at the enterprise level. Moving candidate data between regions, such as from an EU entity's system to a US-based analytics platform, requires a valid transfer mechanism under GDPR. This applies even when the transfer occurs internally between business units of the same company.

Legal and compliance teams should audit retention policies for consistency across all regions and business units before approving any organization-wide rediscovery process. A policy that works in one jurisdiction may not meet the requirements in another.