Employee records vs candidate records: what the Privacy Act actually covers in recruitment
The Privacy Act's employee-records exemption covers a business's own current and former employees, not the job candidates it recruits. Candidates are not your employees, so the exemption generally does not reach their data, and the Office of the Australian Information Commissioner has said the exemption is unlikely to apply to recruitment and HR-services providers at all. The practical result: the candidate files a recruitment agency is built on sit squarely under the Australian Privacy Principles.
By Jon Oates, Founder of Privaproof · Last updated
General information, not legal advice. Privaproof is not a law practice.
The distinction the whole industry blurs
The employee-records exemption (Privacy Act 1988 (Cth), s 7B(3)) takes certain acts and practices outside the Australian Privacy Principles, but only within a narrow frame: they must be directly related to a current or former employment relationship between the organisation and the individual, and must concern an employee record. Two conditions do a lot of work there:
- It is about your own staff. The exemption is about the relationship between you and your employee. It is not a general licence to handle anyone's employment-related information.
- A candidate is not an employee. Someone who has applied for a role, or whom you are sourcing and putting forward, has no employment relationship with you. Their application, CV, references, screening results and interview notes are candidate records, not employee records, so the exemption generally does not apply to them.
What the regulator actually says
This is not our inference. The OAIC states:
"The employee records exemption is unlikely to apply to organisations that provide recruitment, human resource management services, or medical, training or superannuation services under contract to an employer."
And it goes further, tying coverage to a concrete obligation: an organisation that is a contractor or subcontractor collecting employee records about an individual from an employer must comply with the Australian Privacy Principles in handling that information, including the notice requirements in APP 5.
So a recruitment agency does not get to treat candidate data, or even employee data it handles under contract for a client employer, as exempt. It is APP-covered, and it owes candidates a proper collection notice. Read: the candidate collection notice you need
What this means, by who you are
- A recruitment or staffing agency. Your core data is candidate data, which is not exempt, and the OAIC treats recruitment-services providers as unlikely to get the exemption anyway. Treat your candidate files as fully under the APPs: collection notice, purpose limits, security, retention, and the automated-decision disclosure if your ATS scores or screens them. Read: the ADM rule and your ATS
- An in-house HR team. For your organisation's own current and former employees, the exemption can apply to genuine employee records directly related to the employment relationship. But the moment you are handling job applicants who are not yet your employees, that is candidate data, and it generally sits under the APPs like any other personal information you collect. So even in-house, the exemption does not cover your hiring pipeline the way it covers your existing staff files. Read: in-house HR vs recruitment agency, who is covered?
A change on the horizon (not yet law)
The employee-records exemption has been under review as part of the wider Privacy Act reform, and there have been proposals to narrow or replace it. None of that changes the position today, and this page describes the current law. It is one more reason to work from documents that are kept current as the law changes, so that if the exemption is reformed, your policies move with it rather than going stale.
This is general information and document templates you tailor to your own business, not legal advice.
Common questions
We are an agency but we also employ our own internal staff. Which rule applies?
Both, to different data. Records directly related to your own internal employees' employment can fall within the exemption. The candidate data you handle to place people with client employers does not. Keep the two clearly separated, because they carry different obligations.
Are job applicants ever "employee records"?
Generally not while they are applicants. An employee record is tied to an employment relationship that exists or existed. A candidate you have not employed has no such relationship with you, so their application data is candidate data under the APPs. If you go on to employ them, records from then on may be a different matter.
Does this mean we need a privacy policy and collection notice for candidates?
If you are covered by the APPs, yes: an APP 1 privacy policy and an APP 5 collection notice for the points where you collect candidate data. The OAIC specifically flags the APP 5 notice for contractors handling this information. Read: what a recruitment agency's privacy policy must cover
Is financial or health information in a candidate file treated differently?
Some candidate information is sensitive information under the Privacy Act, for example a police check or a pre-employment medical, which carries a higher consent and handling standard. That is separate from the employee-versus-candidate question and applies regardless. Read: police checks and medicals, handling sensitive candidate information
This is general information and document templates you tailor to your own business, not legal advice. Privaproof is not a law practice and does not provide legal advice. Whether the employee-records exemption applies to any particular record depends on the facts, and the exemption is under review, so confirm you are working from the current law. Privaproof's recruitment documents are self-authored and are not independently reviewed by a solicitor. For advice on your specific circumstances, consult a qualified Australian legal practitioner.