Definition
A database of potential candidates who have been identified as suitable for future roles within an organisation. Talent pools include previous applicants, internal employees being developed for progression, referrals, and proactively sourced candidates.
UK Context
Under GDPR and the UK Data Protection Act 2018, employers must have a lawful basis for retaining candidate data in talent pools. Legitimate interest is the most commonly relied-upon basis, but candidates must be informed through a privacy notice and given the opportunity to opt out. Data retention should be reviewed regularly and limited to a reasonable period.
Best Practices
- Obtain clear consent or establish legitimate interest for retaining candidate data beyond the initial recruitment process
- Set maximum retention periods (typically 12 to 24 months) and purge data regularly
- Keep talent pool members engaged through periodic communication about relevant opportunities
Frequently Asked Questions
How long can candidate data be kept in a talent pool?
There is no fixed legal limit, but data must only be kept as long as necessary for its purpose. The ICO recommends reviewing retention regularly. Twelve to twenty-four months is generally considered reasonable, with candidates being invited to confirm their continued interest.
Do candidates need to consent to being in a talent pool?
If the employer relies on consent as the lawful basis, yes. Many employers rely on legitimate interest instead, but must still provide a clear privacy notice and easy opt-out mechanism. Either way, candidates must be informed that their data is being retained.