GDPR compliance in talent research

Yes, when it is scoped and documented properly. Talent mapping and talent research involve processing personal data, so GDPR applies in full — but GDPR does not prohibit processing personal data without consent. It requires a lawful basis, and for professional research of this kind that basis is normally legitimate interests under Article 6(1)(f).

What makes a particular project compliant is the discipline around it: a documented legitimate interests assessment, collection limited to professional information relevant to an agreed scope, a source recorded against every field, a defined retention period, and a route for individuals to exercise their rights. We do all five on every engagement and will show your DPO the evidence before work starts.

No, and we are careful about this because the word has a specific meaning. Under Article 42 a GDPR certification can only be issued by a certification body accredited by a supervisory authority or a national accreditation body, against an approved scheme. There is no official ‘GDPR logo’ and no general register of ‘GDPR certified’ companies.

What we are is GDPR compliant and able to evidence it: a documented lawful basis per jurisdiction, a legitimate interests assessment per engagement, defined retention, documented security measures, and a sub-processor list. Any supplier presenting you with a ‘GDPR certified’ badge is worth asking which accredited body issued it and under which approved scheme.

Legitimate interests under Article 6(1)(f) of the UK GDPR and the EU GDPR, supported by a documented legitimate interests assessment that records the purpose, the necessity test and the balancing test against the individual’s rights and reasonable expectations.

We do not rely on consent for research subjects, because consent obtained before any contact is neither practical nor, in most cases, meaningful. Consent is used where it is the right basis — for example marketing emails to business contacts in jurisdictions that require it.

Article 14 requires information to be provided to an individual when personal data is obtained from a source other than the individual, normally within one month or at first communication. We handle it three ways, in this order.

Where we contact an individual, the Article 14 information is provided at that first contact, with a link to this site. Where data is handed to a client who will contact the individual, the obligation passes with it and we set that out in writing in the engagement terms so nobody assumes the other party is doing it. And Article 14(5)(b) provides a limited exemption where provision would involve disproportionate effort — we rely on it only where it genuinely applies, document why, and publish this page as the compensating measure the Article requires.

Professional information only: name, current employer, job title and level, function, location at city or region level, tenure, publicly evidenced career history, professional qualifications and registrations, and where the engagement requires it, business contact details.

Every field carries the source it came from and the date it was collected, which is what makes the dataset auditable rather than merely plausible.

Special category data under Article 9 against named individuals: racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic or biometric data, health data, and data concerning sex life or sexual orientation. We also do not collect criminal offence data under Article 10.

We do not infer any of these from a name, a photograph, a school or an institution. Diversity and representation work is produced at aggregate population level from sources appropriate to that purpose, never as a characteristic flag against a named person.

Project datasets are retained for twelve months from delivery by default, so that a client can query or refresh the work, and are then deleted from our systems unless the client has a live retained programme or has asked in writing for a different period.

The client’s own copy of the deliverable is theirs and is governed by their retention policy, not ours. Enquiry and marketing data is retained for twenty-four months from last engagement. Contract and billing records are retained for the period UK company and tax law requires.

It depends on the stage, and we set it out in every engagement rather than leaving it ambiguous. When we determine how research is conducted — defining the population, choosing sources, deciding what is recorded — we act as controller for that processing.

Once a deliverable is handed to a client and they decide what to do with it, they are controller for their use of it. Where a client instructs us to process their own candidate or employee data, we act as processor under Article 28 terms.

Yes. Research is delivered from our London and Mumbai desks, so personal data relating to UK and EEA individuals may be accessed by our team in India, which is not the subject of a UK or EU adequacy decision.

Those transfers are made under the appropriate safeguards in Article 46 — standard contractual clauses, with the UK International Data Transfer Addendum where UK GDPR applies — supported by a transfer risk assessment and technical measures including encryption in transit and at rest and access control. The documentation is available to your DPO.

By emailing privacy@audentiaresearch.com or writing to our London office. Individuals have the right of access, rectification, erasure, restriction, data portability where it applies, and — because we rely on legitimate interests — the right to object under Article 21.

An objection to processing based on legitimate interests is honoured unless we can demonstrate compelling legitimate grounds that override the individual’s interests. In practice, on a research dataset, we remove the record. We respond within one month and do not charge.

Yes, where a project meets the Article 35 threshold — typically large-scale processing, systematic monitoring, or research involving a category of data or a population that raises a high risk to rights and freedoms.

Where a DPIA is required we complete it before fieldwork starts and share it with the client’s DPO. Where one is not required we record why.

We have a documented incident response procedure. A personal data breach is assessed immediately, contained, and where it is likely to result in a risk to individuals it is reported to the relevant supervisory authority within 72 hours of becoming aware of it, as Article 33 requires.

Affected clients are notified without undue delay regardless of whether the regulatory threshold is met, because a client acting as controller needs to make its own assessment.

We scope to the regime that applies in the market being researched. In the UAE, the federal Personal Data Protection Law, with DIFC and ADGM operating their own frameworks for entities inside those centres. In Australia, the Privacy Act 1988 and the Australian Privacy Principles. In the United States, state privacy laws, principally the CCPA as amended by the CPRA.

Where a client operates across several of these we default to the strictest applicable standard across the whole dataset, because maintaining two levels of rigour in one project is how mistakes happen.

A due diligence pack: the lawful basis we will rely on and the legitimate interests assessment, the categories of data to be collected and the explicit exclusions, our retention schedule, the sub-processor list, our technical and organisational measures, the international transfer mechanism and transfer risk assessment, our breach procedure, and the controller or processor position for each stage of the engagement.

We provide it before the engagement starts rather than in response to an audit, and we are happy to take your privacy team through it on a call.

Organisations processing personal data in the UK are generally required to pay the data protection fee and register with the Information Commissioner’s Office. Our current registration details are provided in the due diligence pack and can be checked against the ICO’s public register of fee payers.