You own your talent pool, but only the data you can still get out. Under the GDPR your company is the controller of the candidate data and the software vendor is a processor, who must delete or return the data at the end of the contract (Art. 28 (3) (g) GDPR). What actually stays with you depends on the contract and the export function: notes, contact history, pipeline stages and consent records are what disappear first. Check this before you sign, not when you cancel.
Who is the owner of candidate data legally?
Your company decides why and how the data is processed, so it is the controller under Art. 4 (7) GDPR. The vendor processes the data on your behalf under a data processing agreement (Art. 28 GDPR). That gives you the legal claim to get the data back or have it deleted. It does not give you a technical export: the law says “return or delete”, it does not say “in a format you can reuse”.
A frequent misunderstanding concerns Art. 20 GDPR. The right to data portability belongs to the candidates, who can ask you for their own data in a machine-readable format. It does not oblige a vendor to give your company a clean database dump. In our conversations with recruiting teams and agencies, “what is left if I cancel?” is a standard question, and the honest answer is always in the contract and the export menu.
What disappears first when you cancel?
- Notes and tags that were never part of a CSV export.
- Message history from the tool’s own inbox or sequences.
- Pipeline stages and the history of who moved a person when.
- Consent records (date, wording, source), which you need for proof.
- Search projects and shortlists that live in a rented seat.
The extreme case is a rented seat on a professional network: the candidate work stays in the account, and it is gone when the seat ends. The numbers for one well-known tool are in own your candidate data.
Which seven questions should you ask before you sign?
| Question | What a good answer looks like |
|---|---|
| 1. Which formats can I export? | CSV or Excel for every list and view, including notes and tags |
| 2. Does the export include history? | Contact dates and message history, not only names and emails |
| 3. Are consent records exportable? | Date, wording and source per person |
| 4. What happens at contract end? | Return or deletion within a stated period, confirmed in writing |
| 5. How long do I have access after notice? | Read access until the end of the term, ideally with a grace period |
| 6. Where is the data stored? | Named hosting region; subprocessors listed in the data processing agreement |
| 7. Can I keep using the pool without a paid plan? | Yes or no, stated plainly |
Does the EU Data Act help you switch?
Possibly. Since 12 September 2025 the EU Data Act (Regulation (EU) 2023/2854), Chapter VI gives customers of cloud and other data processing services a right to switch provider: a notice period of at most two months, a transition period of at most 30 days, a contract that lists the data and digital assets you can export, and switching charges that may only cover actual costs until 12 January 2027 and are banned afterwards. Whether a specific recruiting tool counts as a data processing service in the sense of the Act is an open question that depends on the product and the contract, and the rules do not promise a ready-made export of every note. Use them as a negotiating argument: ask the vendor in writing which data are “exportable data” under the contract. This is no legal advice.
How do you test an export in 30 minutes?
Do not wait for the cancellation to find out. Create five test records in the live system, each with a different feature: one with a long note, one with three tags, one with a consent date, one with a sent message and one that you moved through two pipeline stages. Export every list and view the vendor offers, open the files and tick off what survived. Whatever is missing in the file will be missing after the cancellation. Repeat the test once a year and after every major update; keep the result with your vendor documentation.
What should an exit request say?
Please confirm in writing: (1) the formats in which we can export all candidate records including notes, tags, contact history and consent records; (2) the latest date until which we can export after notice; (3) that you will delete all candidate data and sub-processor copies within [30] days after our confirmation and certify it. Basis: Art. 28 (3) (g) GDPR and our data processing agreement.
Adapt the periods to your contract. A vendor who cannot answer these three points in a week has told you something about the exit.
How do you cancel without losing the pool?
- Export before the notice date, not on the last day. Test that the file opens and contains what you expect.
- Save consent proof and the retention date per person.
- Move the data to the new system in phases (see from Excel to a recruiting CRM).
- Request written deletion from the old vendor once the new system is checked.
- Document it in your record of processing activities.
Rented reach or an owned pool?
Platforms that charge per seat or per contact rent you access. A talent pool you own is a database you keep, with people who agreed to be in it. The difference decides what you can still search a year after a cancellation. The wider argument is in what a talent pool is and how to build one.
What does Sprad do here?
In Sprad the Talent Network is part of the free core: all found and invited talents stay saved, and it remains free to use after a paid plan ends. Every view can be exported. Invited people can get a free job & career agent that keeps their profile current. To be precise about limits: the export is a view of your lists and columns, we do not promise a raw dump of everything the system holds, and searches, screening and interviews need credits (100 a month are free, as of 29 Oct 2026, source: sprad.io/pricing). Search across LinkedIn, XING, GitHub and your own pool is described on the people search page.
FAQ
Who owns the data in my recruiting CRM?
Your company, as controller. The vendor processes it on your behalf and must return or delete it at the end of the contract. Technical exportability is a separate question that you settle in the contract.
Can the vendor keep my candidate data after I cancel?
Only as far as the data processing agreement allows. Under Art. 28 (3) (g) GDPR the vendor has to delete or return the data at your choice once the service ends, unless a law requires storage.
Do candidates have a right to export their data?
Yes, under Art. 20 GDPR, for data they provided and that is processed on consent or contract. This is their right against you; it is not a claim of your company against the vendor.
Should I export my talent pool regularly?
A regular export, for example every quarter, is a cheap safeguard. Test the file each time and store it with the same retention rules as the live data.
What if the vendor shuts down?
Then the export is your only protection. Include the exit scenario in the contract: export access during a wind-down and a deletion confirmation.
How is a talent pool different from a LinkedIn Recruiter project?
A project lives in a licence and ends with it. A talent pool in your own system stays with your company; see talent pools and GDPR for retention.
Jürgen Ulbrich
Jürgen Ulbrich has more than a decade of experience in developing and leading high-performing teams and companies. As an expert in employee referral programs as well as feedback and performance processes, Jürgen has helped over 100 organizations optimize their talent acquisition and development strategies.
