Talent Pool Checklist: Setup, GDPR, Import and Upkeep

What's Included in This Talent Pool Checklist

A talent pool is only an asset if people in it can be contacted lawfully and the data is current. This checklist has 45 points in six sections:

1. Purpose and responsibility: one-sentence purpose, groups in the pool, data fields, processor agreement.
2. Consent and legal basis: consent for rejected applicants, legitimate interest for people you found, the Art. 14 notice.
3. Retention and deletion: a delete-on date in every record, separation from the application file.
4. Import: what to do with Excel sheets, folders with CVs and network exports.
5. Upkeep: reactivation rhythm, bounces, notes, access, double outreach.
6. Rights of data subjects: access, erasure, objection, one-month deadline.

After the checklist you get a table of retention rules of thumb, nine metrics and six common mistakes.

Key Features That Save You Time

• Priorities A, B, C. Know what to settle before you start and what can follow in 30 days.
• The article behind each point. References to the GDPR, so your data protection officer can check quickly.
• Retention table. Rules of thumb for application files, consented pool entries and people you found yourself.
• Metrics without invented targets. You measure from your own baseline.
• Checkbox format. Tick, date and hand over.

How to Use This Talent Pool Checklist

1. Work through section A before you import anything.
2. Settle consent and legal basis per group in section B.
3. Set retention and a delete-on field in section C.
4. Import in section D only after the sample import looks right.
5. Put sections E and the metrics into a quarterly review.

Why This Talent Pool Checklist Works

In our conversations with recruitment agencies and recruiting teams we keep seeing the same picture: the pool is an Excel sheet plus a folder of CVs, and the real worry is that it turns into dead data. Data protection is usually a point to check, not a blocker, once hosting, retention, deletion and consent are answered concretely. The checklist turns those four answers into tasks.

It also keeps two things apart that are often mixed: the application file and the pool. For retention, read our guide on talent pool data retention under the GDPR.

Who Should Use This

• Recruiters and agencies who want to turn Excel and folders into a clean pool.
• HR teams who need a talent pool and have to satisfy their data protection officer.
• Data protection officers who want a structured list for a review.

For the product view, see the talent pool page.

A Worked Example: Turning an Excel Sheet into a Pool

A small recruitment agency keeps 1,800 candidates in an Excel sheet and a folder of CVs. Nobody knows which entries are consented, which were found on a network and which are old applications. With the checklist the agency first splits the records into three groups: applicants who agreed to be kept, people found by the team, and old application files. Each group gets its own legal basis and its own delete-on rule. Records without a known source or legal basis are not imported. The rest is imported with a sample first: ten records, checked field by field, before the full list follows. That order is the point of section D.

What the Pool Record Should Contain

Keep a record small. Name and contact, the source and date of first contact, the legal basis, the delete-on date, a short professional profile and the status of your last contact are enough. Free-text notes are where most data protection problems start: opinions about a person's character, health or private life do not belong there. A good rule is to write only what you would be willing to show the person if they asked for access under Art. 15 GDPR.

Metrics That Show Whether the Pool Is Alive

The checklist lists nine metrics. Three matter most at the start: the share of records with a current delete-on date, the share you contacted in the last twelve months, and the number of bounced emails. A pool where most records were never touched is a list, not a pool. Set your own baseline first and improve from there instead of copying a target from someone else.

Six Mistakes the Checklist Is Built Against

• Keeping rejected applicants "just in case" without consent.
• Importing old lists without checking source and age.
• Mixing the application file and the pool, so deletion deadlines get blurred.
• No named person who owns the pool and answers requests.
• Reactivating contacts with a mass mail instead of a personal, short message.
• Never deleting, so the pool grows while its value falls.

Sources

• Regulation (EU) 2016/679 (GDPR), Art. 5, 6, 7, 14, 15, 17 and 21
• Section 26 BDSG, data processing for employment purposes
• Section 15 AGG, compensation and the filing period

FAQs

How long may I keep candidate data in a talent pool?

The GDPR names no fixed period (Art. 5(1)(e)). In Germany about six months is a common benchmark for the application file. For a pool you need your own purpose and period, usually with documented consent. The checklist helps you set and record it.

Do I need consent for a talent pool?

For rejected applicants a separate, voluntary consent is the usual route. For people you found yourself, legitimate interest under Art. 6(1)(f) may apply, with a written balancing test and an Art. 14 notice.

Can I import my old Excel list?

Yes, after you check age, source and legal basis per record. Delete what is older than your retention period and inform the rest before you contact them.

Is this legal advice?

No. It is a working aid. Settle details with your data protection officer.

Who owns the pool inside my team?

Name one person who answers requests, keeps the records of processing up to date and runs the quarterly review. The checklist has a line for this in section A. Without an owner, deadlines slip.

How quickly must I answer a request for access or erasure?

Without undue delay and in any case within one month of receipt (Art. 12(3) GDPR). The period can be extended in complex cases, and you must then tell the person why. The checklist's section F lists the steps.

Should the pool live in a spreadsheet or a tool?

A spreadsheet can work for a few hundred records if access is limited and deletion is done by hand on a schedule. A tool helps when you need delete-on dates, consent status and contact history in one place. See talent pool software for what that looks like.

Can I keep rejected applicants in my pool?

Only with their separate, voluntary consent. Ask after the process ends, say what you store and for how long, and make withdrawal as easy as giving consent.