Recruitment Privacy Notice Template for Germany

When recruiting employees in Germany, you are legally required to provide job applicants with a comprehensive privacy notice that explains how you collect, use, and protect their personal data. This document ensures transparency and compliance with both the General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (BDSG), protecting both your organization and applicants' rights throughout the recruitment process.

When do you need this document?

You must provide a Recruitment Privacy Notice before or at the time you collect any personal data from job applicants. This includes when candidates submit applications through your website, recruitment agencies forward CVs, or you collect information from LinkedIn or other professional platforms. The notice is also required when conducting background checks, requesting references, or using recruitment software that processes applicant data. German law mandates that this information must be provided in a clear, accessible format, typically as part of your application process or prominently displayed on recruitment platforms.

Key legal considerations

Your Recruitment Privacy Notice must clearly identify your legal basis for processing under GDPR Article 6, typically legitimate interest for recruitment activities or contract performance when hiring. You must specify exactly what personal data you collect, including CVs, contact information, qualifications, and any special category data like health information for occupational health assessments. The notice must explain data retention periods, which under German practice typically range from 6 months to 2 years after the recruitment process ends. You must also detail data subject rights, including access, rectification, erasure, and portability rights, along with clear contact information for your Data Protection Officer if required. Additionally, you must disclose any third-party recipients of data, such as background check providers, recruitment agencies, or HR software vendors.

Legal requirements in Germany

German law imposes additional requirements beyond standard GDPR obligations. Under the Works Constitution Act (BetrVG), you must involve your works council in recruitment data processing decisions and may need to reference this in your privacy notice. The German Federal Data Protection Act provides specific provisions for employee data protection, including stricter consent requirements for certain processing activities. Your notice must comply with the General Equal Treatment Act (AGG) by ensuring non-discriminatory data collection practices. German courts expect privacy notices to be written in clear German language, avoiding complex legal terminology that applicants cannot reasonably understand. You must also provide information about cross-border data transfers if you use international recruitment platforms or service providers, including appropriate safeguards under GDPR Chapter V. Finally, German data protection authorities require that privacy notices are easily accessible and prominently displayed throughout the entire recruitment process.