The shortlist looked perfect until the candidate called. Her current employer had received the profile through a sister company, although she had only agreed to speak about one confidential vacancy. The consultant remembers a positive conversation. Nobody can show which recipient was approved.
What is a candidate submission approval log?
A candidate submission approval log connects an identifiable candidate, a specific client or confirmed recipient, the relevant vacancy, the approved information, timing, restrictions and the consultant who checked the disclosure. It records what the candidate understood and what the agency actually shared.
That operational approval is not automatically the same as GDPR consent under Article 6. Depending on the facts, a properly assessed legitimate interest, contractual steps or another lawful basis may apply; professional confirmation of candidate expectations remains valuable whatever basis is selected.
If the candidate cannot be told who will receive identifiable details, begin with information that is genuinely anonymous. Remove indirect clues as well as the person’s name; a niche job title, small employer and unusual location may still reveal the individual.
Describe the recipient before releasing the profile
The candidate should understand which organisation, decision-makers and assignment the proposed disclosure concerns.
A verbal “yes, sounds interesting” does not describe enough. Confirm the hiring entity, the vacancy or search brief, the team that will assess the profile and whether another adviser or group company is involved. If the client is confidential at first, agree on an anonymous introduction and postpone identifiable disclosure until the candidate understands the recipient.
This matters especially in executive search, where a subsidiary, investment fund and operating company can look like the same client to a consultant but create very different risks for the individual. Capture the legal entity where known, not merely a trading name, and note exclusions such as the candidate’s current employer or a former board colleague.
- Identify the hiring organisation or document why only an anonymous profile can be shared.
- Tie approval to a named mandate rather than every role held by the agency.
- Record prohibited recipients, group companies and professional conflicts.
- Name the consultant responsible for checking the final distribution.
Separate a professional approval from a lawful basis
Candidate preference, transparency and legal grounds are connected but different decisions.
The EDPB explains that personal-data processing needs an appropriate lawful basis. A recruitment business may consider legitimate interests after an actual assessment; steps requested by the individual before entering a contract may fit some circumstances. Consent is another possibility, but calling every routine approval “GDPR consent” can be misleading, especially where an individual does not feel free to refuse.
Record the agency’s documented legal assessment separately from the candidate’s operational instruction. One says why a particular processing activity may be lawful; the other says what this individual expects the recruiter to do. Neither a ticked box nor a generic privacy notice grants unlimited permission to send a CV across unrelated clients.
A candidate’s “please present me to this client” helps demonstrate scope and expectations. It does not, by itself, determine the only possible lawful basis.
Define exactly what the client may receive
A useful disclosure record describes the permitted package rather than treating the entire CRM profile as one attachment.
Decide whether the client needs a redacted biography, a full CV, compensation expectations, notice period, location preferences or interview notes. Salary history, family circumstances and informal personality commentary often exceed what a hiring manager needs at the first stage. Keep research notes and recruiter speculation out of the presentation unless there is a specific, defensible reason to include them.
The same caution applies to contact details. A candidate may want the consultant to organise the first conversation instead of receiving an unexpected message from the employer. Mark whether direct outreach is allowed, which address or number may be used and whether documents contain hidden metadata, tracked changes or references to another search.
- Record the approved document version and whether direct contact details are visible.
- Separate candidate-confirmed facts from researcher notes or inferred information.
- Exclude unnecessary health, family and other especially sensitive material.
- Confirm whether client forwarding or additional reviewer access is allowed.
Build the record around mandate-level events
Approval becomes useful when it follows the candidate-to-vacancy relationship rather than disappearing into a general profile note.
Create an entry for the discussion, another for the approved profile or summary and a final entry when the material is sent. Preserve the recipient, document version, date, relevant restrictions and the person responsible. A recruiting CRM can organise these facts around the mandate, but the real control is the process: somebody checks the facts before disclosure.
When an assignment changes, review the boundary. A different subsidiary, newly appointed hiring manager, replacement vacancy or wider search panel may require updated information and a fresh conversation. Treat approval as specific and current; do not silently transfer it from a closed search to a convenient new opportunity.
Prevent duplicate submissions without claiming to own people
A submission history helps coordinate introductions; it does not give an agency ownership of a candidate.
Two consultants can represent the same person to the same employer without realising another desk already made contact. Before sending a profile, review previous presentations, active mandates, exclusions and client relationships. The goal is to protect the candidate from confusion and avoid a preventable commercial dispute, not to stop that person speaking with other agencies.
Keep commercial ownership rules separate from personal autonomy. If the candidate has already applied directly or chosen another representative, document the situation accurately and respect the instruction. The client contract may determine fee entitlement; it cannot turn an individual into an asset controlled by a consultant.
Handle changes, objections and recipient corrections
A disclosure record should show what changed, who responded and which downstream recipients needed to know.
Suppose a candidate approves an introduction on Monday and learns on Tuesday that a former manager has joined the client’s selection panel. Pause any unsent distribution immediately. If a profile has already been shared, assess what communication with the recipient is appropriate, ask for restricted onward handling where possible and document the response.
Do not promise that every objection erases a completed transaction or automatically rewrites the legal basis. Rights, retention needs and contractual obligations depend on context. What the team can do reliably is identify the decision, restrict unnecessary future sharing, preserve a proportionate accountability record and escalate difficult cases to qualified privacy advisers.
- Locate the exact mandate, recipient and profile version affected by the candidate’s updated instruction.
- Pause any pending presentation or direct-contact permission that conflicts with the new boundary.
- Assess completed disclosures, applicable individual rights and the next communication needed.
- Record the resolution, owner, date and any recipient confirmation without retaining unnecessary material.
Test a real executive-search scenario
The control should survive confidentiality, multiple corporate entities and recruiter handovers.
Consider a finance director who agrees to meet an investor-backed manufacturer but will not reveal the search to the parent group. The initial message names the operating company, excludes the parent entity, permits a CV without a personal mobile number and limits access to two interviewers. A second consultant later proposes copying the investment team.
The second consultant should see the original restriction before sending anything. If the investment team genuinely needs access, the recruiter explains the change and checks the candidate’s position before updating the record. This is not complicated technology. It is a careful handover, a specific recipient and evidence that the team honoured the boundary.
Keep the evidence proportionate and reviewable
Retain enough information to explain a disclosure while avoiding a second uncontrolled archive of candidate material.
A submission log can often use the mandate reference, recipient, document identifier, decision date and a concise summary of the candidate’s instruction. It does not necessarily need another complete CV, a call recording or screenshots of every message. Restrict access to the people who need the information and define a retention period suited to the relevant purpose.
Review exceptions with the consultants who actually run searches. Missing recipient names, presentations sent before confirmation and conflicting group-company instructions are useful signals. Resolve the workflow rather than building a reporting project; a small agency needs fewer surprises, not another system nobody maintains.
Candidate submission approval record: practical fields
Use these fields as a starting point, then adapt the record to the mandate, applicable law and the level of candidate risk.
| Record field | What to capture | Practical control |
|---|---|---|
| Candidate and mandate | Stable candidate identifier, named role and search reference | Prevent approval drifting between unrelated vacancies |
| Client recipient | Hiring entity, authorised reviewers and excluded organisations | Block unapproved group companies and onward forwarding |
| Information scope | Document version, visible contact details and excluded notes | Send only information relevant to the current decision |
| Candidate instruction | Date, channel, specific boundaries and responsible consultant | Preserve what the individual actually agreed or requested |
| Disclosure event | Recipient, date, transmission method and record owner | Show who received the identifiable information |
| Later restriction | Objection, recipient change, pause and follow-up outcome | Keep subsequent actions aligned with the latest instruction |
What an approval log does not prove
A well-kept log does not establish a lawful basis on its own, guarantee regulatory compliance or decide every question about retention, international access or employment law. Agencies should assess their specific processing and seek qualified advice where needed.
A candidate’s preference cannot guarantee that every external recipient behaves perfectly. Limit what is shared, agree sensible client handling expectations and respond promptly when a material boundary changes.
Candidate submission approval questions
These answers separate everyday recruiting discipline from the legal assessment required for each processing context.
Do recruiters always need GDPR consent before sharing a CV?
No. Consent is one possible legal basis, not a universal rule. Depending on the facts, a documented legitimate interest or another appropriate basis may apply. A clear, candidate-specific presentation approval remains good operational practice.
Can an agency introduce someone before naming the employer?
A properly anonymised initial summary may be appropriate where the client is confidential. Do not release identifiable details before the candidate understands the relevant recipient and the agency has assessed the applicable obligations.
What if another consultant already submitted the candidate?
Check the existing mandate, client, timing and candidate instruction before making a second introduction. Resolve fee or representation questions separately; a recruiter never owns the individual.
Should we store a full copy of every submitted CV?
Not automatically. A document reference, recipient, date and approval context may provide the necessary accountability evidence without creating an unnecessary duplicate archive. Retention should fit the stated purpose.
Official guidance on lawful disclosure and recruitment
The EU regulation and EDPB guidance explain legal grounds; the ICO recruitment material is expressly presented as draft and applies to the UK framework.
- EUR-Lex: General Data Protection Regulation, including lawful processing, transparency and data minimisation
- European Data Protection Board: Process personal data lawfully
- UK Information Commissioner’s Office: Recruitment and selection guidance, currently identified as draft
Improve candidate and client coordination
Set sensible candidate ownership rules · Document candidate-approved reference checks · Explore the recruiting CRM for agencies · Review secure client collaboration
Keep every candidate introduction connected to the search
See how Yena brings candidate relationships, client context and recruiting workflows together so your team can maintain clear handovers and professional boundaries.
Explore Yena for recruiting agencies