In-house HR vs recruitment agency: who is covered by the Privacy Act?
It depends on whose data and at what stage. An in-house HR team can rely on the employee-records exemption for its own current and former staff, but not for job applicants, because a candidate is not yet an employee. A recruitment agency handling candidates for client employers is squarely under the Australian Privacy Principles, and the regulator says the exemption is unlikely to apply to it at all. So both an agency and an in-house hiring team are generally covered for candidate data.
By Jon Oates, Founder of Privaproof · Last updated
General information, not legal advice. Privaproof is not a law practice.
Three situations, three answers
1. In-house HR, handling your own current or former staff. The employee-records exemption can apply here. It covers acts and practices directly related to a current or former employment relationship and an employee record. So a genuine employee file, once someone is or has been your employee, can fall outside the APPs on that basis.
2. In-house HR, handling job applicants. This is the part people miss. A job applicant is not yet your employee, so their application, CV, references and screening are candidate data, not employee records. The exemption does not reach them, and your hiring pipeline generally sits under the APPs like any other personal information you collect, even inside an organisation that relies on the exemption for its actual staff.
3. A recruitment or staffing agency. You are handling candidate data as your core business, usually under contract to employer clients. The OAIC states:
"The employee records exemption is unlikely to apply to organisations that provide recruitment, human resource management services, or medical, training or superannuation services under contract to an employer."
So an agency is squarely under the APPs for its candidate handling. Read the detail: employee records vs candidate records
What follows from each
- An agency should assume full APP coverage of candidate data: privacy policy, collection notice, sensitive-info care, overseas rules, retention limits, and the automated-decision disclosure. Read: does the Privacy Act apply to recruitment agencies?
- An in-house team should keep the two streams separate in its own mind: the exemption may cover its established staff files, but its recruitment and applicant handling should be run on the APP standard. The privacy policy and collection notices should cover candidates properly, not just employees.
A change on the horizon
The employee-records exemption has been under review as part of the wider Privacy Act reform, and there have been proposals to narrow it. That does not change the position today, and this page describes the current law, but it is one more reason to work from documents that are kept current as the law changes so your position moves with any reform rather than going stale.
This is general information and document templates you tailor to your own business, not legal advice.
Common questions
We are an employer, not an agency. Do we still need candidate privacy documents?
For your own established staff the exemption may apply, but for job applicants it generally does not, so yes, you need to handle candidate data on the APP standard, with a collection notice and proper policy coverage for applicants.
Our HR is outsourced to a provider. Who is covered?
The provider is handling employee or candidate data under contract, and the OAIC treats HR-services and recruitment providers as unlikely to get the exemption, so the provider is generally covered by the APPs for that information. Your contract should reflect that.
When does an applicant become an "employee" for the exemption?
Broadly, when an employment relationship exists. Before that, an applicant's information is candidate data under the APPs. Once employed, records directly related to that employment may fall within the exemption. The line matters, so treat pre-employment data as covered.
This is general information and document templates you tailor to your own business, not legal advice. Privaproof is not a law practice and does not provide legal advice. Whether the employee-records exemption applies to any particular record depends on the facts, and the exemption is under review, so confirm the current law. Privaproof's recruitment documents are self-authored and are not independently reviewed by a solicitor. For advice on your specific circumstances, consult a qualified Australian legal practitioner.