GDPR states that there are two legal bases on which you can store and process candidates’ personal data.

  1. Consents for data processing and data retention or

  2. Legitimate interest to store their data

Imported candidates are the candidates that were imported into TalentLyft from another system or database using API, CSV, or JSON import.

Imported candidates didn’t apply for an active job opening in TalentLyft and were not sourced for a specific TalentLyft job.

They don’t have valid data processing and data retention consents and will end up on your Needs to be deleted list immediately.

To keep these candidates in the system and stay compliant with GDPR, you should send them a consent request after they are imported. The best way to do this is to send them an email from TalentLyft with the link to their Candidate portal where they can give you consents for data processing and data retention.

Because you will need to do this only once, we have an example consent request email that you can use.

Subject line: {CompanyName} GDPR consents request

Hi {FirstName},

we in {CompanyName} care about our candidates and their privacy. We are always trying to handle candidates’ personal data in accordance with GDPR.

With that in mind, we would like to keep your personal data for the purpose of potential hire in the future. To do so, we would like to ask you for your data processing and data retention consents. You can review your data here: {CandidatePortal}.

To give us your data processing and data retention consents, please follow this link: {ConsentRequest}

I hope you have a great day,


NOTE: While TalentLyft has consulted with legal professionals both in the creation of this article and for our own product features, we are not a law firm. All information that is used in this article is general information and is not intended as legal advice. Users should take independent legal advice regarding their own data protection policies.

Did this answer your question?