Employee records vs candidate records: what the Privacy Act actually covers in recruitment
The Privacy Act's employee-records exemption covers a business's own current and former employees, not the job candidates it recruits. Candidates are not your employees, so the exemption does not reach their data, and the Office of the Australian Information Commissioner has said the exemption is unlikely to apply to recruitment and HR-services providers at all. The practical result: where the Australian Privacy Principles reach your agency, your candidate files sit inside them. The exemption is not the door out.
By Jon Oates, Founder of Privaproof · Last updated
General information, not legal advice. Privaproof is not a law practice.
The distinction the whole industry blurs
The employee-records exemption (Privacy Act 1988 (Cth), s 7B(3)) exempts an act of an organisation "that is or was an employer of an individual", and only where that act is directly related to both "a current or former employment relationship between the employer and the individual" and "an employee record held by the organisation and relating to the individual". Two conditions do a lot of work there:
- It is about your own staff. The exemption is about the relationship between you and your employee. It is not a general licence to handle anyone's employment-related information.
- A candidate is not an employee. Someone who has applied for a role, or whom you are sourcing and putting forward, has no employment relationship with you. The OAIC is flat about this: the exemption "does not cover future employment relationships", and will not apply to information collected about prospective employees who are not subsequently employed. Their application, CV, references, screening results and interview notes are candidate records, not employee records.
What the regulator actually says
This is not our inference. The OAIC states:
"This exemption does not cover contractors and subcontractors when they handle the personal information of the employees of another organisation, notwithstanding their contractual arrangements."
"The employee records exemption is unlikely to apply to organisations that provide recruitment, human resource management services, or medical, training or superannuation services under contract to an employer."
And it goes further, tying coverage to a concrete obligation: an organisation that is a contractor or subcontractor collecting employee records about an individual from an employer must comply with the Australian Privacy Principles in handling that information, including the notice requirements in APP 5.
So a recruitment agency does not get to treat candidate data, or even employee data it handles under contract for a client employer, as exempt. Whether the APPs reach you is a separate question, but the exemption is not your way out of them, and if they do reach you, you owe candidates a collection notice. Read: the candidate collection notice you need
What this means, by who you are
- A recruitment or staffing agency. Your core data is candidate data, which is not exempt, and the OAIC treats recruitment-services providers as unlikely to get the exemption anyway. Treat your candidate files as fully under the APPs: collection notice, purpose limits, security, retention, and, from 10 December 2026, disclosure in your privacy policy if your ATS scores or screens candidates. Read: the ADM rule and your ATS
- An in-house HR team. For your organisation's own current and former employees, the exemption can apply to genuine employee records directly related to the employment relationship, and the OAIC says that once you employ someone, the records of their pre-employment checks become exempt too. Applicants you do not employ never reach that point, so their data sits under the APPs like any other personal information you collect. An agency never gets even that, because it does not become the employer, so its candidate files never convert. Read: in-house HR vs recruitment agency, who is covered?
A change on the horizon (not yet law)
The employee-records exemption has been under review since the Attorney-General's Department's Privacy Act Review Report (February 2023), whose Proposal 7.1 was that "Enhanced privacy protections should be extended to private sector employees". None of that is law. Section 7B(3) still reads as quoted above in Compilation No. 104 of the Privacy Act, compiled 4 June 2026, and this page describes the current law. It is one more reason to work from documents that are kept current as the law changes, so that if the exemption is reformed, your policies move with it rather than going stale.
This is general information and document templates you tailor to your own business, not legal advice.
Common questions
We are an agency but we also employ our own internal staff. Which rule applies?
Both, to different data. Records directly related to your own internal employees' employment can fall within the exemption. The candidate data you handle to place people with client employers does not. Keep the two clearly separated, because they carry different obligations.
What is the employee records exemption?
It is s 7B(3) of the Privacy Act 1988 (Cth), and it is narrower than its name suggests. It exempts an act of an organisation "that is or was an employer of an individual", and only where that act is directly related to both "a current or former employment relationship between the employer and the individual" and "an employee record held by the organisation and relating to the individual". Both conditions must hold. A candidate you have not employed is not in an employment relationship with you, so their file is not an employee record and the exemption does not reach it.
Are job applicants ever "employee records"?
Not while they are applicants. An employee record is tied to an employment relationship that exists or existed, so a candidate you have not employed has no such relationship with you and their application data is candidate data. The OAIC adds one qualification, and it is for employers rather than agencies: "once an employment relationship is formed with an individual, the records the employer holds relating to that individual's pre-employment checks become exempt". An agency that places a candidate with a client never becomes that employer, so nothing in its own candidate files converts.
Does this mean we need a privacy policy and collection notice for candidates?
If you are covered by the APPs, yes: an APP 1 privacy policy and an APP 5 collection notice for the points where you collect candidate data. The OAIC specifically flags the APP 5 notice for contractors handling this information. Read: what a recruitment agency's privacy policy must cover
Is financial or health information in a candidate file treated differently?
Some candidate information is sensitive information under the Privacy Act: a police check result is information about a person's "criminal record" and a pre-employment medical is health information, and both are named in the s 6(1) definition. APP 3.3 generally requires the individual's consent before you collect it. That is separate from the employee-versus-candidate question and applies regardless. Read: police checks and medicals, handling sensitive candidate information
This is general information and document templates you tailor to your own business, not legal advice. Privaproof is not a law practice and does not provide legal advice. Whether the employee-records exemption applies to any particular record depends on the facts, and the exemption is under review, so confirm you are working from the current law. For advice on your specific circumstances, consult a qualified Australian legal practitioner.