The employee-records exemption does not cover the candidates you place

There is no anti-money-laundering trigger for recruitment and no single 2026 switch-on date. But the common assumption, "we are a small agency, so we are exempt", is weaker here than in most industries, for two reasons:

• The employee-records exemption is about your own staff, not candidates. It covers records directly related to your current or former employees' employment. Job applicants and candidates are not your employees, so the exemption generally does not reach the data you hold about them. The Office of the Australian Information Commissioner has said the exemption is unlikely to apply to organisations providing recruitment or human-resource-management services under contract to an employer . So the very data an agency is built on, candidate files, sits under the Australian Privacy Principles.
• The small-business exemption may not save you either. A business under A$3 million turnover is often outside the APPs (s 6D), but that exemption can be lost if you disclose personal information about someone to another person for a benefit, or provide a service to collect it. A recruitment agency that provides candidate information to employer clients for a fee engages those words. The carve-out matters though, and it usually helps you: s 6D(7) takes out disclosures the individual consented to, and a candidate who asked to be put forward has consented to exactly that. So the limb bites mainly where you go beyond the consent, which is one of the things that removes the small-business exemption . Read: does the Privacy Act apply to recruitment agencies?

So the honest first step is not to assume you are exempt. Read: employee records vs candidate records, what the Privacy Act actually covers

You hold a concentrated pool of other people's most sensitive career and identity information: identity and right-to-work documents, CVs and references, background and police checks, pre-employment medicals, and increasingly candidate scores and rankings produced by your tools. Two categories raise the bar:

• Police checks and pre-employment medicals are sensitive information under the Privacy Act, which carries a higher consent and handling standard than ordinary personal information. Read: police checks and medicals, handling sensitive candidate information
• Candidate data often crosses borders, through offshore recruiters, overseas screening providers or virtual assistants, which brings APP 8 into play. Read: offshore recruiters and overseas screening, your APP 8 duty

A breach of these files exposes people who trusted you with their livelihood. Read: a data-breach response plan for recruitment agencies

1. Your ATS and the 10 December 2026 automated-decision rule. From 10 December 2026, if you use automated decision-making that significantly affects a person, your privacy policy must disclose it (APP 1.7). Hiring is squarely in scope: an applicant-tracking system that scores, ranks, shortlists or auto-rejects candidates is making an automated decision about them. This is a transparency and disclosure duty, not a ban, but a generic privacy policy will not mention it, and from that date it is expected to. Read: the ADM rule and your ATS, what recruiters must disclose

2. Employee records versus candidate records. The line between the staff you employ (partly covered by the employee-records exemption) and the candidates you place (under the APPs) is the single most misunderstood point in recruitment privacy, and it changes what notice, consent and access obligations you owe for each. Most templates blur the two. Read: employee records vs candidate records

• A privacy policy written for a recruitment or staffing business, including the APP 1.7 automated-decision disclosure for your ATS, not a generic website template.
• A candidate collection notice (APP 5) for the real collection points: the job ad, the application form, the ATS, and information you gather about a candidate from third parties such as referees.
• A sensitive-information procedure for police checks and medicals, with the higher consent standard built in.
• A data-breach response plan for the Notifiable Data Breaches scheme, tuned to candidate identity and background data.
• A retention and destruction schedule. There is no AML record-keeping floor here and, for unsuccessful candidates, generally no statutory minimum at all, so the risk is keeping candidate files far longer than you can justify. Your own employee records are a separate matter (Fair Work record-keeping applies to staff). Read: how long should a recruitment agency keep candidate records?

A blanket privacy-policy generator covers none of this: not the ATS disclosure, not the candidate-versus-employee line, not sensitive screening, not the retention problem.