GDPR states that there are two legal bases on which you can store and process candidates’ personal data.

  1. Consents for data processing and data retention or

  2. Legitimate interest to store their data

Sourced candidates are passive candidates that you or your colleagues found and added to your system. These candidates didn’t apply for the job themselves and they haven’t given you their data processing and data retention consents. The legal base for you to use their personal data is your legitimate interest to hire them.

Sourced candidates will appear on the Needs to be deleted list when:

  • The job they applied for is archived or

  • The inactivity period has expired.

You should always inform sourced candidates that you stored their profile information in your database and give them access to the personal data that you stored. TalentLyft candidate portal allows candidates to view, export, update and delete their data, so you should send them the link to the portal via email. As this is an email that you will be sending regularly, we suggest creating an email template for this purpose.

To help you with this, we have created an example of this template.

Subject line: {CompanyName} is looking for a {JobTitle}

Hi {FirstName},

I am {MyName}, {MyHeadline} at {CompanyName}. I found your profile online and I was really impressed by your experience, knowledge and skills.

We are currently looking for a {JobTitle} to join our team. You look like a great candidate for the position and I wanted to let you know that we stored your profile information in our database with the purpose of potential hire for this position.

You can view, update, export or delete the stored data and read our privacy policy on this link: {CandidatePortal}

I hope you have a great day,


When editing your email message, you can also add links to specific words or to a piece of text. It will look much better than sharing the entire URL link in an email message.

NOTE: While TalentLyft has consulted with legal professionals both in the creation of this article and for our own product features, we are not a law firm. All information that is used in this article is general information and is not intended as legal advice. Users should take independent legal advice regarding their own data protection policies.

Did this answer your question?