Yes, but only on the basis of a legitimate interest under GDPR Article 6(1)(f), limited to publicly visible, job-relevant signals, and with a clear right to object for the person concerned. A talent pool may track whether someone has become openly open to a move again - because their LinkedIn profile was updated or a new title appears, for instance - but it may not build a broad behavioural profile out of it.

This question is distinct from how long a talent pool may simply store data. How long application data may generally be retained is covered in Talent pools and GDPR: how long may you keep applicant data?. This article addresses a different question: for people already stored in the pool, may a company actively watch whether their professional status changes?

Why this is legally different from plain storage

Plain storage is a passive state: data sits there until deleted or updated. Actively monitoring job-search signals, by contrast, is ongoing processing - the system has to repeatedly check whether something has changed, such as a new title, a new employer, or an updated profile. Under data-protection law that is its own category: a form of profiling under GDPR Article 4(4), even without any automated individual decision under Article 22 attached to it.

The legal basis: legitimate interest with a balancing test

GDPR Article 6(1)(f) permits processing that is necessary for the legitimate interests of the controller, provided those interests do not override the interests or fundamental rights of the person concerned. For a talent pool, such an interest is fairly easy to justify: a company that already knows a person and once assessed them as relevant has an understandable interest in knowing when that person becomes approachable again, instead of starting from zero for every open role.

That balancing test does not automatically come out in the company's favour, though. Three factors support the company's interest outweighing the individual's:

Where the line sits

Monitoring publicly visible, clearly job-relevant signals is permitted - an updated title, a new employer, a new availability note in a profile. Monitoring that goes beyond the professional context is not: private posts, network activity with no professional relevance, or linking the data to entirely separate sources the person never associated with the talent pool.

Equally important: the person must always be able to find out that this monitoring is happening, and must be able to object to it (GDPR Article 21). A talent pool that runs this monitoring quietly, mentioning it neither in its privacy notice nor when someone joins the pool, crosses the line regardless of how narrowly the monitored signals are defined.

What this means in practice

In practice, this means: joining a talent pool should make it transparent that the company will monitor relevant, publicly visible signals going forward in order to reach out again at the right moment - not as a hidden feature, but as an openly communicated part of the pool that also benefits the person themselves (faster, better-targeted outreach instead of random mass messages). Documented, voluntary consent when joining the pool is not strictly required if the Article 6(1)(f) balancing test holds up on its own, but it makes the processing considerably more robust and is, in practice, the simpler, safer route.

A limit that cannot be automated away

Even a system that implements these rules cleanly does not remove the duty to check, case by case, whether a specific piece of monitoring still fits within the original balancing test. New signal sources - new data partnerships or additional networks, for instance - shift that balance and need to be reassessed each time, rather than relying on a judgment made once and never revisited.

A practical example

Someone applied for a role 18 months ago, was not hired, but was assessed as a good general fit and - having been told how their data would be kept - joined the talent pool. The system notices that this person now holds a new, similarly titled role at a different employer and recently updated their public profile. Both signals are clearly job-relevant and publicly visible - reaching out again on that basis sits within the balancing test.

The case would look different if the system also evaluated private social-media posts to infer, say, general dissatisfaction with a current employer. That would be a considerably deeper form of monitoring, going beyond the professional context the person could reasonably expect when joining the pool - and it would tip the balance back in favour of the individual.

Frequently asked questions about job-search signals in a talent pool

Does this apply to people who never agreed to stay in the talent pool?

No. Without a valid legal basis for keeping someone in the pool at all, the question of signal monitoring does not even arise - lawful storage in the pool is the baseline requirement.

Can I evaluate signals from private social networks?

That is considerably riskier than evaluating professional networks such as LinkedIn or XING, because private and professional content mix there and users' expectations differ. Limiting monitoring to clearly professional contexts is the safer path.

Do I have to document every observed change?

GDPR does not explicitly require documenting every single observation. From 250 employees upward, though, the general duty to record the processing activity in the record of processing under Article 30 GDPR applies anyway; smaller companies are exempt unless the processing carries a risk to the rights of the person concerned (Article 30(5) GDPR) - which an ongoing signal-monitoring process plausibly does.

How is this different from a classic talent pool without signal monitoring?

A classic talent pool stores profiles passively and gets searched manually when a new role opens up. A pool with signal monitoring proactively flags when a stored person's status changes - which correspondingly raises the data-protection diligence required.

Can a person have this monitoring stopped after the fact?

Yes, the right to object under GDPR Article 21 applies on an ongoing basis. A talent pool needs a simple way to honour that objection without necessarily having to remove the person from the pool entirely, if they do not want that either.

This article does not replace legal advice for a specific case. For what a talent pool fundamentally is and how it differs from an ATS or CRM, see Talent Pool: Definition, Structure and How It Differs From an ATS or CRM. For how a self-maintaining talent pool that detects renewed job-search interest actually works, see the Atlas candidate portal, with more articles in the talent pool & re-engagement topic hub.