Section 164A for recruitment agencies
For recruiters the complaints come from candidates, not clients. CVs sent onward without permission and databases nobody prunes are the two complaints you will see most, and both are section 164A complaints.
Does section 164A apply to you?
An agency is a controller of its candidate database and of the data it collects from clients' staff, even where it also acts for clients.
The complaints you are most likely to get
- A CV sent to a client the candidate did not agree to
- Approaches to candidates whose details came from a bought list or a scrape
- Candidate records kept for years after a placement or rejection
- Notes about candidates that are subjective, inaccurate or unflattering
- References taken up before the candidate agreed
Channels to watch
The 30-day clock starts when a complaint reaches your organisation by any route, so every channel below needs a named owner.
- Consultants' individual inboxes, where most candidate contact lives
- The main agency inbox
- LinkedIn and other social messaging
- Phone calls to consultants
- The website contact form
Worked examples
| What arrives | How to treat it |
|---|---|
| A candidate asks who you sent their CV to and objects that they were not asked | A complaint. It usually needs a subject access style search of consultant mailboxes as well as the CRM |
| Someone who never registered asks how you got their details | A complaint about sourcing. Be able to say where the data came from, or you have a bigger problem than the complaint |
| A candidate objects to internal notes about them | A complaint touching accuracy. Notes in the CRM are personal data and are disclosable |
A minimum viable process
- Publish a complaints route with an electronic option and another means. Use the complaints policy template.
- Add the section 164A wording to your privacy notice and your subject access request template. Use the privacy notice wording.
- Log every complaint with the date it was received. Use the complaints log template.
- Acknowledge within days, not weeks. See the 30-day acknowledgement rule.
- Investigate, update the person, decide, tell them the outcome and signpost the ICO. See how to handle a data protection complaint.
Prove you met the duty, not just that you meant to
The work in section 164A is operational: spotting the complaint, dating it, acknowledging it within 30 days, keeping the person informed and recording the outcome. PrivacyComplaints does that part for small organisations.