Active sourcing is GDPR-compliant when you collect only role-relevant professional data, document a legitimate-interest assessment under Article 6(1)(f), and inform the person under Article 14 at the latest in your first message. If you store a profile but never write to the person, you must inform them within one month or delete the record. A person’s objection must stop the process in every system. In Germany, email and phone outreach also need a separate check under section 7 UWG. This is practical guidance based on sources accessed on 30 October 2026, not legal advice.
The GDPR candidate sourcing checklist: eight checks before the first message
The table is the compact version. Each row names the question, the legal anchor and the one piece of evidence worth keeping if a data-protection authority or a candidate ever asks. The sections below explain each step.
| Check | Question to answer | Legal anchor | Evidence to keep |
|---|---|---|---|
| 1. Purpose | Is there a real, specific vacancy or mandate? | Art. 5(1)(b) | Role ID or mandate reference |
| 2. Legal basis | Which interest, is it necessary, does the person’s interest outweigh it? | Art. 6(1)(f) | Three-line balancing note per role |
| 3. Source | Is the data professional, public and traceable? | Art. 5(1)(a), Art. 14(2)(f) | Source field on every record |
| 4. Minimisation | Do we store only what the role needs, and nothing sensitive? | Art. 5(1)(c), Art. 9 | Fixed field list |
| 5. Information | Does the person get the Art. 14 notice in time? | Art. 14(1)–(3) | Notice template, send date |
| 6. Retention | When is the record deleted, and who checks? | Art. 5(1)(e), Art. 17 | Deletion date on the record |
| 7. Objection | Is the right to object stated, and does a “no” stop everything? | Art. 21 | Suppression entry with date |
| 8. Channel | Is email, phone or platform message allowed for a first approach? | § 7 UWG, local law | Channel approval per campaign |
What active sourcing means under the GDPR
Active sourcing is the purposeful identification of people who may fit a role, followed by an approach before they apply. The processing starts when a recruiter records or enriches a profile, not when a message leaves the outbox. The AI active sourcing and people search hub explains the operational side; the legal side begins with the source and intended use of each data point.
A sound process separates three decisions. First, is collecting and using the data lawful? Second, has the person received the required information? Third, does the selected channel comply with the applicable direct-marketing and communications rules? A GDPR legal basis does not itself permit a cold email or call.
Which legal basis applies to active sourcing?
For a limited search and initial assessment, organisations commonly rely on legitimate interests under Article 6(1)(f) GDPR on EUR-Lex. Filling a genuine vacancy or performing a defined recruitment mandate can be a legitimate interest. The Court of Justice confirmed on 4 October 2024 that even a purely commercial interest can qualify, provided it is lawful and the other conditions are met (case C-621/22). The provision only works where the individual’s interests, rights and freedoms do not override that interest.
That calls for a recorded three-part assessment, the structure also used in the European Data Protection Board’s Guidelines 1/2024 on legitimate interest (consultation version, October 2024). Define the interest precisely, such as hiring for a particular engineering role. Confirm necessity: could the role be filled without this specific data, or with less of it? Then balance the person’s reasonable expectations and the impact on them against the business need. Someone who has presented skills and work contact details in a professional setting is in a different position from someone whose information is private or socially contextual. The Hessian data-protection authority draws the same distinction in its published discussion of active sourcing.
Consent is rarely the better route for a first approach: you would need it before you contact the person, which is the point you cannot yet ask for it. Legitimate interest with good documentation is the realistic basis; consent becomes useful once someone has replied and agrees to be kept for future roles.
Which sources are safe to use, and which are not?
Usually lower-risk sources are public professional profiles on networks such as LinkedIn or XING, a person’s work-focused website, or a publicly accessible CV where the information is relevant to the position. A candidate database may also be usable where the source is traceable and its terms permit the intended recruitment use. Limit the record to what supports the role: professional experience, relevant skills and an appropriate contact route.
Higher-risk sources include private social-network activity, closed communities, information visible only after a connection is accepted, and opaque data-broker lists that cannot explain provenance. Data being searchable does not make it fair to repurpose. The Hessian authority specifically notes that restricted professional-network data are not generally accessible; transparency about the recruiter role at the connection-request stage matters. Also read the platform’s terms: scraping or bulk export may breach them even where the GDPR analysis is favourable.
Do not turn sensitive information into sourcing criteria or recruiter notes. Data that reveal health, religion, political views, trade-union membership, ethnicity, sexual orientation or similar matters fall within the special categories of Article 9 GDPR. A profile may disclose more than a recruiter needs; the safer practice is not to collect, infer, rank or retain those details.
What must the Article 14 notice contain, and when is it due?
When personal data were not collected from the person, Article 14 GDPR requires the controller to provide, among other things: its identity and, where relevant, its data-protection officer; the purpose and legal basis (and the legitimate interest itself, where Article 6(1)(f) applies); the data categories; recipients and relevant third-country transfers; the retention period or criteria; the data subject’s rights and the complaint route; and the source, including whether it was publicly accessible. If profiling or an automated decision is involved, the notice expands.
Timing follows Article 14(3), and there are three triggers. Reasonable period, at the latest one month after obtaining the data. At the latest at the first communication, if you use the data to contact the person. At the latest at first disclosure, if you pass the data to another recipient. The earliest applicable trigger wins. In practice: put a short notice with a link to the full privacy information into the first message, and be able to name the concrete source of each record when asked.
One more rule is easy to miss: under Article 21(4) GDPR, the right to object must be brought to the person’s attention clearly and separately from other information, at the latest at the first communication. A sentence buried in a privacy-policy link does not meet that standard.
What if you never contact the person?
This is where many teams slip. The one-month limit also applies to profiles you saved but never wrote to. Article 14(5)(b) allows an exception where informing the person is impossible or would take disproportionate effort, but it must be applied narrowly and backed by safeguards, and a list of a few hundred named people is rarely “impossible” to notify. The cleaner rule: do not save a profile you have no plan to contact, and delete shortlisted but dropped profiles within the month.
One-time approach or candidate pool?
A one-time approach for a defined role has a narrow purpose: identify a suitable person, make contact, process the response and close the activity. That supports minimal fields, a short operational retention period and no automatic reuse. Silence is not permission to keep a person available for future campaigns.
A talent pool has an ongoing purpose and a longer impact. Before moving a profile into one, document the purpose, access rights, review dates, deletion criteria and legal basis separately. A voluntary, documented opt-in for future opportunities is often clearer after someone has expressed interest; an organisation relying on legitimate interests instead needs a more demanding, well-documented balancing exercise. Resources on talent-pool reactivation and a candidate portal for self-managed profiles can help design the experience, but neither replaces the legal assessment.
How long may you keep sourcing data?
The GDPR sets no universal active-sourcing retention period. Its storage-limitation principle in Article 5(1)(e) requires identifiable data to be kept no longer than necessary for the purpose. Set a short, justified period for the role before launching the search, write the deletion date on the record, and apply it. A common planning assumption is a few weeks after the role closes for people who never replied; this is an assumption to justify per search, not a legal value.
If a person replies and applies, the applicant rules take over. Under section 15(4) AGG, claims for discrimination must be asserted in writing within two months of the rejection reaching the applicant, which is why many German employers keep rejected applications for a few months. That reasoning applies to applicants, not to people you only found and never heard from.
A minimal suppression record may be needed so that a later import cannot override an objection. Keep it tightly scoped: an identifier, the date, the objection’s scope and suitable access controls, not a full candidate profile. Article 17 GDPR requires erasure where data are no longer needed or an objection prevails.
How do you handle an objection?
People must be told about their right to object when processing rests on Article 6(1)(f). When an objection arrives, log the date, channel, scope and action taken, then suppress further sourcing and outreach across the relevant systems. Under Article 21(1), processing based on legitimate interests must stop unless the controller can demonstrate compelling overriding grounds. For direct marketing, Article 21(2) and (3) are stricter: processing for that purpose must cease. Treat an explicit “do not contact me again” as a firm stop for recruitment outreach, including for other roles and other recruiters in your organisation.
Can you cold-email or call candidates in Germany?
For German outreach, section 7 UWG addresses unreasonable nuisance independently of data protection. Telephone advertising to consumers requires prior express consent; towards other market participants, at least presumed consent. Advertising by email generally requires prior express consent (section 7(2) no. 2); the existing-customer exception in section 7(3) will rarely fit a first approach to an unknown candidate. Whether an individual recruitment message counts as advertising in a given case needs legal analysis, so do not treat legitimate interest under the GDPR as a substitute for a channel review. A message inside a professional network is a different channel from a mail to a private address, and each has its own platform rules. For EU and US campaigns, also assess local e-privacy, direct-marketing and employment rules.
The most common mistakes in practice
- Saving first, deciding later: profiles pile up without a role, notice or deletion date.
- No source on the record: you cannot answer “where did you get my data?” when the person asks.
- Notice without objection wording: the Art. 14 link is there, the clearly separate objection hint is not.
- Notes with private details: remarks on health, family or religion end up in the CRM and in subject-access responses.
- Objection handled in one tool only: the person is removed from the sequence but re-imported from the next search.
- Silence treated as a pool opt-in: ongoing storage without purpose or notice.
Where tooling helps, and where it does not
Technology can structure research, approvals, notices and suppression lists, but it cannot create a legal basis or turn an unsuitable channel into a lawful one. Of the checks above, the tool side matters most for source capture, a single record per person, and objection handling across channels. Sprad is built for that: one search across LinkedIn, XING, GitHub and your own talent pool, outreach by LinkedIn and email in one inbox per person (so a prior contact is visible before a colleague writes again), data hosted in the EU and a full export of your data. Notice wording, balancing test and retention period remain your decisions, and the Art. 14 text goes into your message templates.
Teams using People Search for active sourcing should make source capture, human approval, Article 14 notice, deletion runs and objection suppression part of the configured workflow. The AI sourcing tools category helps compare approaches; compliance still depends on how the organisation uses the tool.
An explicit limitation
This framework cannot decide every individual message, platform clause or international transfer. The outcome may change with a staffing-agency mandate, works-council arrangements, group-company access, transfers outside the EEA or the precise legal classification of a message. Before scaling outreach or creating a long-lived candidate pool, involve the data-protection officer or qualified local counsel in the specific design.
FAQ
Do I need consent to contact a candidate I found online?
Not for the first approach in most cases. Legitimate interest under Article 6(1)(f) can carry a narrow, documented approach for a real vacancy. Consent becomes relevant when you want to keep someone for future roles.
Can I use a public LinkedIn profile for active sourcing?
A public, work-focused profile can support a legitimate-interest assessment for a relevant approach. It does not remove the duties of transparency, data minimisation and source documentation. Do not use private-context information or data that are only visible to accepted connections as if they were public.
When must the Article 14 notice be given?
If you use the data to contact the person, at the latest with that first communication. Where you store the data but do not write, within a reasonable period and at the latest one month after collection. The notice should name the source and make the objection route easy to use.
How long can I keep a candidate’s data after sourcing?
As long as necessary for the defined purpose, and no longer. Set a short period per search and write the deletion date on the record. Applicants fall under separate rules.
May we retain people who do not reply in a pool?
No response is not an opt-in. Ongoing storage needs a defined purpose, a documented lawful basis, a proportionate retention period and transparent notice. A voluntary opt-in for future opportunities often creates a clearer and more respectful relationship.
Is an unsubscribe link enough to honour an objection?
Only if the resulting instruction reaches every system used for sourcing and outreach. Record the objection, prevent future imports from reactivating the person and retain only the minimal suppression data needed to honour it. A reply requesting no further contact should trigger the same operational result.
Is a LinkedIn message treated differently from an email?
Under the GDPR the duties are the same. Under German unfair-competition law the channel is assessed separately, and the platform’s own rules apply on top. Check the channel per campaign, not per tool.
Read next: Hiring without agencies: what you can take in-house
Jürgen Ulbrich
Jürgen Ulbrich has more than a decade of experience in developing and leading high-performing teams and companies. As an expert in employee referral programs as well as feedback and performance processes, Jürgen has helped over 100 organizations optimize their talent acquisition and development strategies.
