The problem
A small agency adds candidates every week from job boards, LinkedIn and referrals, and many are never placed. UK GDPR expects you to have a lawful basis for keeping each one, tell them how their data is used and not keep it longer than needed. At 40 new candidates a week, that's about 170 new records a month (40 × 4.3) to inform, track and eventually clear, and a spreadsheet of consent dates soon falls behind.
What the AI does
Recruitly's GDPR automation page says it can send consent requests when candidates are added, manage approvals, rejections and renewals, archive or anonymise records based on consent status, rejection or non-response, and keep an audit trail of consent activity. It can also gather the personal data held on one person when they make a subject access request. You set the triggers, actions and timeframes. The page doesn't name a plan, and the pricing page says every feature is on every plan.
A worked example
A one-person recruitment agency in Bristol placing warehouse and logistics staff adds about 40 candidates a week. Consent dates sit in a spreadsheet that is months out of date, and CVs from 2022 are still on file.
Before
About 170 new candidate records a month with consent tracked by hand, and no regular clear-out
After
A consent request sent as each of the 170 or so records is added, with renewals and anonymising run on the timetable the owner sets
What it's worth
A compliance record rather than a money saving: every candidate has a recorded consent status, and old records are cleared on a timetable you choose. Cost: Solo is $25 (about $25£19€23A$36C$36) a month for 1 user, with up to 10,000 candidates and 25 jobs; Professional is $80 (about $80£60€71A$115C$113) per user. The time saved on manual consent emails is real but isn't counted here.
How to set it up
- Write your retention policy first: the lawful basis you rely on for candidates, how long you keep unplaced candidates and when you ask again. Put it in your privacy notice.
- Turn on consent requests for new candidates and check the wording of the request email against your privacy notice.
- Set the renewal and non-response rules, and choose whether records are archived or anonymised at the end.
- Run the rules on a test batch of 20 old records and check what happened to each before applying them to the whole database.
- Each month, check the audit trail and the list of pending requests, and answer deletion or access requests within one month, as UK GDPR requires.
What goes wrong
- Automation can fail silently, for example if request emails land in spam or a rule is set wrongly. Check the pending list and audit trail every month rather than assuming it works.
- Anonymising a record removes it from searches. Exclude placed candidates and any records you must keep, such as those the Conduct of Employment Agencies Regulations require.
- Consent isn't the only lawful basis, and asking for it when you rely on legitimate interests can confuse candidates. Decide your basis first and take advice if unsure.
- Solo covers one user. A second consultant moves you to Professional at $80 (about $80£60€71A$115C$113) per user.