Skip to main content

GDPR Tools for Candidates

Included in:
  • SmartStart
  • SmartRecruit


All candidates who apply to a SmartRecruiters job get access to a Candidate Portal, which provides them with tools for managing their applications, personal information, and consent in accordance with GDPR requirements.


SmartRecruiters’ Candidate Control feature supports compliance with GDPR’s data subject rights:

Provide consent

Declining consent

Candidates who were added to a company’s SmartRecruiters but did not actually apply (e.g., those referred, found via LinkedIn, or added by an external recruiting agency) may not have provided consent for the use of their information.

Companies can request consent by email. Candidates will receive an email asking them to provide consent or decline the request in their candidate portal. 


Once it’s requested, candidates have up to 30 days to accept  and provide consent. SmartRecruiters will actually remind them twice to provide consent:

  • 7 days prior to the deadline, and
  • 48 hours prior.

If the candidate declines, or does not take action, and the company has activated GDPR settings for the job, SmartRecruiters deletes their profile at the company.

Edit profile

All candidates who apply to a job through SmartRecruiters get a Candidate Portal. Here, they can access their SmartProfile, which is a current snapshot of the information that SmartRecruiters has on file for the candidate. 

This is the Recruiter view, which is what hiring teams see on the candidate's applications in their company's SmartRecruiters account.


Candidates can modify this information by clicking Edit Profile.

EditView.pngIn this view, candidates can edit, add, or delete the experience, education, and personal information after applying to a job.

Once edits are saved, candidates can click Publish Now to publish the edits to their existing active applications.


Publication syncs the SmartProfile with all existing, active applications at all companies to which the candidate has applied using the same email. Hiring team members working on these job will see the edits immediately, but will not receive a notification that updates were made.


Download profile

Candidates can download the contents of their SmartProfile from the Candidate Portal. Just navigate to the Settings page, and click Export as JSON to download this information in JSON format.


This file contains the most recent profile data, including any edits made by the hiring team, such as changing your contact information.

Revoke consent to company

When a candidate applies to a company, SmartRecruiters creates a candidate profile for them in the company's account. Any applications submitted to the company are associated with that profile, as long as the candidate uses the same email address for each application. 

Candidates can revoke their consent to a specific company for the use of their information by deleting their candidate profile at the company. Doing so will delete their profile at the company, all applications associated with that profile, and all information contained in the profile and applications.

To delete a candidate profile from a specific company:

  1. In the candidate portal, click My Applications in the left-hand navigation menu.MyApplications.png
  2. In the list of companies, find that company and click on the application.
  3. Click View Options at the bottom of the page.ViewOptions_CP.png
  4. In the popup, select Delete my profile from [Company Name] from the list.DeleteProfile.png
  5. Check the options to confirm awareness of the consequences of deleting. 
  6. Confirm the action.

Once completed, SmartRecruiters will delete all of the information contained in that profile from the company account. The company will be able to see that a candidate existed, but no one will be able to identify the candidate. SmartRecruiters will retain the candidate information in their Candidate Portal, including their SmartProfile and any other applications to other companies.

Thus, if a candidate has applied to more than one company, they'll have more than one candidate profile. If they've applied to the same company and used a different email addresses, they'll have more than one candidate profile at the company. This is because SmartRecruiters uses email as the unique identifier, and treats candidate profiles with different email addresses as belonging to different people.

Revoke consent to SmartRecruiters

Candidates can also revoke their consent to SmartRecruiters for the use of their information by deleting their Candidate Portal account.

Each Candidate Portal account collects applications that a candidate submits using the same email address. Applications are grouped by company, and associated with a single candidate profile at each company.

Thus, if a candidate has applied to more than one company, they'll have more than one candidate profile, but if they use the same email address to apply, they'll be able to access all of those applications in the same Candidate Portal. Candidates can totally delete all information in SmartRecruiters that is associated with that email address (applications and candidate profiles at different companies) by deleting their Candidate Portal account. 

To delete a Candidate Portal account:

  1. In the Candidate Portal, click Settings in the left-hand navigation menu.CandidatePortal_Settings.png
  2. Click Delete My SmartRecruiters account at the bottom of the page, in the Manage your account section.DeleteCandidatePortal.png
  3. Check the options to confirm that awareness of the consequences of deleting the account.DeleteCandidateProfile.png
  4. Confirm the action.

Deleting a Candidate Portal account is the same as deleting, one by one, all profiles at each company to which the candidate applied using the same email address. SmartRecruiters will also delete the Candidate Portal account associated with that email address, and all information associated with that email. The candidate will not be able to log in using the same email address again.

Remember that if candidates who've submitted multiple applications using different email addresses will receive a Candidate Portal account for each email. Deleting one of these accounts will not affect the others.

Deleting candidate data

SmartRecruiters deletes data in a candidate's profile at a company when:

  • the candidate has no prior consent on file and declines to provide consent to a company (e.g., a referral).
  • the candidate has no prior consent on file and does not reply to the company request for consent within 30 days (GDPR setting is active).
  • the candidate has prior consent, but revokes that consent.
  • the candidate withdraws or is rejected, and the data retention period ends.
  • the candidate deletes their candidate profile in the Candidate Portal. 

In each case, SmartRecruiters immediately deletes the candidate's profile from the company's account, and notifies them with this email:

Subject: Deletion Confirmation at [Company]
Text: Dear [Candidate First Name] [Candidate Last Name], 

We confirm that your profile was deleted from [Company]'s account. 

Thank you, 

We’ll also notify:

  • Recruiters on the hiring team, if any.
  • If no recruiters, then the hiring manager(s) on the team.
  • If no recruiters or hiring managers, then executives on the team.

Recruiters will receive this email:

Subject: [Candidate First Name Last Name] deleted their profile

Text: [Candidate First Name Candidate Last Name], candidate for [JobTitle] in [JobLocation] has deleted their profile. You won't be able to access this candidate's profile anymore.  


Thank you, 

Deleting a candidate profile for a particular company will also withdraw all applications to that company. If a candidate deletes their profile, this action cannot be undone and the profile cannot be retrieved.

Deleting a profile only affects the company's access to the profile. SmartRecruiters will retain the candidate's information until they delete their Candidate Portal account.