How can HR professionals ensure applicant privacy when using an ATS?

2 Set clear and consistent privacy policies

The second step is to establish and communicate your own privacy policies regarding the collection, use, storage, and deletion of applicant data. You should inform the applicants about the purpose and scope of the data processing, the rights and choices they have, and the contact details of the data controller and processor. You should also obtain their consent before collecting and processing their data, and respect their requests to access, correct, or erase their data.

3 Train and monitor your staff

The third step is to train and monitor your staff who are involved in the recruitment process, especially those who have access to the ATS. You should educate them about the best practices and ethical standards of handling applicant data, such as using strong passwords, logging out of the system when not in use, and avoiding unauthorized sharing or copying of the data. You should also audit and track their activities on the ATS, and enforce disciplinary measures for any violations or breaches.

4 Update and maintain your ATS

The fourth step is to update and maintain your ATS regularly, to ensure that it is functioning properly and securely. You should install the latest patches and updates from the provider, to fix any bugs or vulnerabilities that may compromise the system. You should also perform periodic backups and tests of the system, to prevent data loss or corruption. You should also review and evaluate your ATS performance and features, and consider switching to a better provider if needed.

5 Delete or anonymize old data

The fifth step is to delete or anonymize old data that is no longer relevant or necessary for the recruitment process. You should follow the retention periods and criteria that you have specified in your privacy policies, and comply with any legal or contractual obligations that may apply. You should also use secure methods to delete or anonymize the data, such as shredding, wiping, or masking, to prevent any unauthorized access or recovery of the data.