How Executive Search Firms Manage Candidate Consent and GDPR Compliance

Data privacy regulation isn't optional anymore. And for a search firm holding candidate data across the EU, the UK, California, or anywhere else with a privacy law on the books, that means someone on the team needs to be tracking consent. Clockwork is built to take that off your plate.

Behind the scenes, your firm sets the rules once: your privacy policy link; how often candidates get reminded to review and consent (24 hours, 7 days, or 30); and which fields you actually want candidates telling you about themselves, interest and self-identification. Both are built as custom fields you control.

Inviting a candidate takes one click from their record. Open the person panel, hit invite, and choose which email to send it to. For candidates outside regions that actually require a removal option, you can leave that off the invite entirely, so you're not showing UK-style data rights to someone the law doesn't apply to. Once they've created their login, that invited status flips to active, so you always know at a glance who's actually set up.

From there, it's the candidate's own data to manage. They review your privacy policy, consent to it, and from there can self-identify on the fields you've enabled, update their own position history, add documents, and indicate what they're actually interested in. Every bit of that shows up back within Clockwork.

The compliance card right on the person panel tracks the candidate's activity and timestamps the moment they opt into data retention, so there's a real record, not a guess about when someone agreed. Zoom out to the full compliance view, and you get the delivery side of it, too.

Every compliance email you've sent: opens, clicks, bounces, and spam reports, sortable and downloadable, so you can prove the notice actually went out.

When a candidate wants their data gone, that request lands in its own table: person ID, status, request date, removal date, who handled it, and what projects they were tied to, sortable and exportable like everything else. Complete the request, and their personal information is scrubbed from the record. And Clockwork backs that up automatically.

Try to re-import that same person later from a LinkedIn profile or a resume that matches their email, and the system blocks it and tells you why, so removal doesn't quietly get undone by accident six months later. If a candidate genuinely changes their mind, a partner or admin can override it; the candidate confirms by email, and the firm re-imports and re-invites them as a fresh start.

Consent captured, tracked, and provable, and removal handled the same way. Underneath all of it sits Clockwork's own security: SOC 2 Type II certified since 2022, hosted on AWS with data encrypted at rest and in transit, and single sign-on and multi-factor authentication built in. That's real compliance built into Clockwork.