A practical candidate data privacy checklist for small hiring teams

Hiring data travels farther than a resume inbox. An applicant may submit a file and several answers; the form service stores them, an AI evaluator reads extractable text, a recruiter sees the report, a spreadsheet receives status and answers, and an external booking service may receive an interview request. A practical privacy plan begins by drawing that route and deciding who needs access at each stop.

This checklist is an operations tool, not a substitute for advice on the laws that apply to your location and candidates. Start with the actual data flow, publish an accurate candidate notice, and keep the questions tied to the job. Badal's privacy page describes its current handling, including AI processing, Google integrations, and storage. The recruiter or hiring organization may have additional obligations and should make its own notice available to candidates.

Map the data before publishing a form

For each field, record why it is necessary, where it goes, who can see it, and when it will be removed. A simple inventory looks like this:

Do not request unrelated sensitive personal details merely because a form builder makes them easy to add. If a portfolio is public, a URL might be sufficient. If a resume is required, explain the accepted file types and offer a reasonable way to report an upload problem. Our application form guide focuses on collecting evidence with fewer questions.

Treat a connected spreadsheet as an export

A role-specific Google Sheet helps a team see application, assessment, and interview-invitation stages. It also creates another copy of information. Badal's current Sheet sync includes candidate contact details, stage, answers, scores, decisions, and protected links to uploaded files. The links still require Badal authorization, but the copied text is visible to people with Sheet access. Restrict sharing accordingly, including inherited access in a shared drive or a copied file.

Before enabling sync, decide whether everyone with Sheet access needs full application answers. If they do not, use the Badal workspace for review and limit who can open the Sheet. If your team exports or duplicates it, track those copies. Editing a Sheet cell is not a documented two-way change to the official candidate record. The Google Sheets workflow guide explains the current sync and stage checks.

Put candidate notices where they can be found

A candidate should be able to understand who is hiring, why their information is collected, which systems process it, how to ask questions, and how the outcome will be communicated. In Badal, the public form shows the role and organization context and links to Privacy and Terms. The recruiter should also provide any organization-specific notice that applies to its hiring. Do not promise deletion periods or local-only processing unless your systems actually enforce them.

For Google integrations, Google's API Services User Data Policy expects a public, accurate disclosure of the data requested and how an app accesses, uses, stores, and shares it. That policy applies to the developer connecting Google APIs; it is a useful reminder to write notices from real behavior, not from a generic template. Similarly, the exact obligations for applicant data depend on jurisdiction and organization. Verify them with appropriate counsel or a privacy lead.

Decide retention and deletion before a request arrives

Small teams often keep candidate data by default because no one chose a deletion date. Write a retention schedule for applications, uploads, reports, exported Sheets, and external booking-provider records. Assign an owner and a way to verify completion. If the service cannot automatically purge all copies, say so and document the manual process. Badal's public privacy notice currently says submitted applications and claimed uploads do not have an automatic deletion date; they remain until removed by the operator. Do not tell candidates that they disappear after 30 days.

Test a correction or deletion request with a synthetic candidate. Identify records in the hiring system, uploaded material, connected Sheets, email copies, and any downloaded exports. Determine which records must be preserved for a valid reason and which can be deleted. A copied spreadsheet may survive after the original row changes. This is why an inventory is more useful than a single “delete candidate” button.

Control who and what can read an application

Give each recruiter their own account. Use named agent keys for specific agent environments and revoke a key when it is no longer needed. Do not paste permanent keys into an agent conversation or candidate-facing form. A temporary link can be redeemed once for a local skill connection, but the link remains visible in chat history if pasted there. The agent setup guide covers safer connection choices.

Candidate documents are untrusted input for AI agents. A resume may contain text that says “ignore your instructions” or asks for another candidate's details. Treat that as candidate content, not an instruction. Limit an agent's access to the account and tasks it needs, and keep the final hiring choice with a person. A report should distinguish evidence from inference and identify unreadable material for manual review.

Work through an example

Suppose a small design studio opens a product internship. The form asks for name, email, one project link, a short explanation of personal contribution, and a resume. The studio connects Google Sheets so the hiring manager and interviewer can see stages. Before sharing the form, it checks: does the interviewer need raw resume answers in the Sheet, or only stage and invitation status? Who can download uploads? Does the candidate notice disclose AI screening? Where should deletion requests go? What will happen to a copied Sheet after the role closes?

The outcome might be to keep the Sheet private to two reviewers, use the Badal report for detailed evidence, put the studio's own privacy notice in the job description, and review retained applications after the hiring cycle. Those are explicit choices the team can test. They are more reliable than assuming a vendor's default settings solve every privacy decision.

Agent-ready audit brief

Read Badal's current /privacy, /docs, and the role configuration. For this role, list every requested field, its job-related purpose, which connected service may receive it, and who needs access. Identify exports, unreadable files, and pending deletion questions. Do not print resumes or keys in the audit summary. Draft candidate-facing notice language for my review; do not make claims about retention or legal compliance without checking them.

Frequently asked questions

Are resume links in a Sheet public?

Badal's upload links require recruiter authorization, but candidate answers are copied into the Sheet. Sharing the Sheet is still a meaningful disclosure of applicant data. Review its access list and any exported copies.

Does closing a job delete applications?

Closing a role stops new applications; it is not the same as deleting existing records or connected Sheets. Refer to the current privacy notice and contact Badal or your hiring organization for a specific data request.