Skip to content
Join the founding list

Home › Recruitment & staffing agencies › The candidate collection notice: what recruiters must tell applicants (APP 5)

The candidate collection notice: what recruiters must tell applicants (APP 5)

When you collect a candidate's personal information, APP 5 says you must take reasonable steps, at or before the time you collect it, to make the candidate aware of certain things: who you are, why you are collecting it, who you usually disclose it to, and how they can access it or complain. For a recruiter this bites in two easy-to-miss places: the many points where you collect candidate data, and the fact that the notice is required even when you collect information about a candidate from someone else, like a referee.

By Jon Oates, Founder of Privaproof · Last updated

General information, not legal advice. Privaproof is not a law practice.

Where recruiters actually collect candidate data

A collection notice has to cover the real collection points, not just a form. For an agency those usually include:

You need the candidate to be made aware of the APP 5 matters at or before each of these, which in practice means a clear collection notice on the application path and a plan for the third-party points below.

What the notice has to cover

Under APP 5, take reasonable steps to make the candidate aware of, among other things:

The part generic templates miss: collecting from third parties

Recruiters routinely collect information about a candidate from someone else, most obviously a referee, but also a current or former employer or a verification provider. APP 5 still applies to that collection. Where you collect a candidate's personal information from a third party, you take reasonable steps to make the candidate aware of the APP 5 matters, including the fact that you collected from that source. A generic website privacy notice does not handle this. Your process needs to tell the candidate, at or around the time, that you will or did collect from referees and the like.

Two overlaps to get right

Common questions

A privacy policy and a collection notice do different jobs. The policy is the general standing document; the collection notice is the specific, at-the-point-of-collection notice of the APP 5 matters. In practice you point to the policy from a short collection notice on the application path, but relying on the policy alone, with nothing at the collection point, is the common gap.

Do we need a notice for a candidate who just emails us a CV?

Take reasonable steps to make them aware of the APP 5 matters when you collect and keep their information. A brief acknowledgement that points to your privacy policy and explains how you will use and who you may share their details with is the practical approach for speculative applications.

What about referees, do we notify them too?

A referee is also an individual whose personal information you collect (their name, role and what they tell you), so your handling of referee information also engages the APPs. Keep your notice and purpose clear for referees as well as candidates.

This is general information and document templates you tailor to your own business, not legal advice. Privaproof is not a law practice and does not provide legal advice. Privaproof's recruitment documents are self-authored and are not independently reviewed by a solicitor. For advice on your specific circumstances, consult a qualified Australian legal practitioner.

Keep reading