Candidate consent as the basis for data processing
The data processing consent of a candidate in a recruitment process should be voluntary and informed. While obtaining personal data from the candidate, the controller should supply all the information included in Art. 13 of the GDPR, including, inter alia, the identity of the controller and the purposes of data processing. If the candidate’s consent is given in the context of a written declaration which also concerns other matters, the request for consent must be presented in a manner which is clearly distinguishable from the other matters, in an intelligible and easily accessible form, using clear and plain language. It should also be remembered that consent can be withdrawn at any point without any negative consequences. You should review your consent clauses and make them GDPR-compliant where necessary. However, you should also remember that if there are other grounds for personal data processing, e.g. its necessity for the conclusion of an agreement or the controller's legitimate interests, it is not necessary to obtain an additional consent.