Candidate Consent First: Why GDPR Compliance Builds Trust

A recruiter sends a candidate's CV to an employer. The candidate never agreed to it. A week later the employer calls — and the candidate has no idea who they are.

That candidate now thinks twice about working with that recruiter, and tells their network. The legal exposure is the headline; the reputation damage is what actually costs you placements. Because in a market this small, candidates and employers both talk.

What GDPR actually requires

Under GDPR, a CV is personal data. Sharing it with an employer is processing it — and it needs a lawful basis. The clean one is consent: the candidate has agreed, specifically and freely, to their details going to this employer for this role.

Three qualities, and each one matters:

• Specific. Consent is for this employer, this role — not "any opportunity you find". "Any opportunity" is not consent; it's a blank cheque.
• Informed. The candidate knows what's being shared, with whom, and why. Surprise is the enemy of consent.
• Reversible. They can say no now, or withdraw later, with no penalty and no hard feelings.

That's the whole legal framework in three words. The rest of this article is the business case — because done well, consent isn't compliance overhead. It's a selling tool.

What send-first costs you

Send-first trades a two-minute message for a week of fallout. The maths never works.

Consent is a filter — and a selling moment

When you ask for consent, you're also telling a candidate they've been shortlisted. That's not an admin task. It's the moment you tell them they're good enough to put forward — and you get to do it before the employer ever calls.

The message does three jobs at once:

Three things happen: the candidate feels respected, hears about the role, and if they say yes, they're engaged before the employer calls. That's a better shortlist — every CV the employer receives comes with a person who wants to be in it.

Running the consent step properly

1. Ask early, in writing. Email is fine. A recorded "yes" is the record you'll rely on later.
2. Name the role, not "a role". Specificity is what makes it consent. "A Security Cloud Engineer role with an energy-sector company" — not "some opportunities".
3. Make yes easy. One-line reply. Never a form, never a portal, never "confirm your consent by logging in".
4. Keep the record. Date, what was shared, what they agreed to. Two years of history is cheap insurance if anything is ever questioned.

Handling no — and later withdrawals

"No" is information, not rejection. It tells you this candidate isn't open to this kind of role right now — and it costs you nothing to find out early rather than at interview stage.

Withdrawals work the same way: if a candidate pulls consent after saying yes, you stop sharing, thank them, and move on. Grace here is remembered. The recruiter who makes withdrawal painless is the recruiter a candidate comes back to when their circumstances change.

Monday morning

• Write your consent message — specific, informed, reversible, one-line yes
• Audit your last ten placements: how many had consent before the CV was shared? Be honest
• Set the rule: no CV leaves your inbox without a recorded yes
• Reply to one candidate who declined last month — no pitch, just thanks — and see what happens

---

Consent-first isn't compliance theatre. It's how you protect candidates, protect your reputation, and send employers shortlists where every person in the pack wants to be there. In a business built on relationships, the way you ask is part of the product.