What California consumers can ask of a recruitment database

The exemptions that once kept employment and applicant data outside the main body of the CCPA have expired. Job applicants, candidates in a sourcing database and former employees hold consumer rights over their records: to know what is collected, to access it, to have it deleted, to have it corrected, and to limit certain uses.

For a recruitment firm that is a bigger change than it looks, because a candidate database is largely made of people who never applied. They were sourced, forwarded, imported or bought in a list, and none of those origins removes the rights. A firm that can answer for its applicants but not for its sourced records has answered half the question.

The practical consequence is that the database has to be searchable by person rather than by pipeline. A request arrives as a name, an email address or a phone number, and the answer has to find every record that person appears in, including duplicates created by three recruiters importing the same list.

The notice tells the person what categories are collected and why, at or before the point of collection. For an application form that is straightforward: the notice sits with the form and the version shown is recorded. For sourced candidates it is harder, because the collection happened before any contact, and the practical moment is the first message you send.

The product supports attaching notice text to outreach templates, recording which version was shown against the record, and giving a route into a candidate-facing view of what is held. What it does not do is write your notice. The categories have to match what your firm actually collects, and a generic paragraph copied from another company describes their practice rather than yours.

Where candidates come from a job board, a client or a list vendor, the origin belongs in the notice. Vagueness about provenance is the part candidates notice, and it is the part a regulator asks about first.

Recruitment software should not be selling candidate personal information, and Surhires does not. Candidate data in your tenant is not sold, rented, licensed or made available to other customers, and there is no shared talent pool behind the tenant boundary. Sharing for cross-context behavioural advertising does not happen either, because candidate records are not fed into advertising systems.

The reason to state that plainly is that the definitions are broader than most people expect. Sale covers disclosure for valuable consideration, not just for cash, and sharing has a specific advertising meaning. Arrangements that feel like partnerships or data enrichment can fall inside the definitions, which is why the answer here is a flat no rather than a qualified one.

Your own practices are a separate matter. If your firm sends candidate data to a partner agency, a list broker or an advertising platform, that is your disclosure to assess and your opt-out to honour. The product gives you an opt-out flag on the record and suppression that survives re-import; the assessment of whether your arrangement is a sale is yours.

An access request is answered by the same export that serves subject access elsewhere: the structured profile, parsed resume text, custom fields, notes, message history, call and interview records, stage and disposition history and consent events, as CSV for a person and JSON for a system. It runs from the record without a support ticket in the path.

Deletion removes the profile, custom fields, notes, messages, the original uploaded file, the extracted text and the search representation together, and keeps a fulfilment record, which is the fact of the request rather than the data it concerned. Where a completed placement created financial records that statute requires you to keep, the workflow separates what can go from what must stay and produces a summary of the exception.

Correction is editing the record with an audit trail, and the candidate portal lets people fix their own details. Verification of the requester sits with you and is a real obligation: releasing a candidate's file to whoever emails is its own breach, and the product logs who ran the export and when so your verification step has something to attach to.

Recruitment collects categories California treats as sensitive more often than most industries realise: government identifiers on right-to-work documents, immigration and visa status, health information volunteered during an accommodation conversation, and demographic answers collected for equal-opportunity reporting. Each has a narrower permitted-use expectation than a job title.

The product keeps demographic data in a separate table with its own access control, invisible to recruiters and excluded from every model payload. Documents carrying identifiers are stored as documents with restricted access rather than being parsed into searchable fields. Those are structural controls, and they are more reliable than a policy asking recruiters to be careful.

Retention disclosure is the other commonly missed item. You have to be able to say how long each category is kept, which requires having decided. The product's retention windows, measured from last meaningful contact and configurable per record type, are what turn that disclosure into something true rather than aspirational.

Most firms discover their request process during the first request, which is the expensive way to find out. The parts worth deciding in advance are who receives requests, how identity is verified, who runs the export, who reviews it for third-party content, who signs off a deletion, and where the record of all that is kept.

The product supplies the mechanical half: identity search across duplicates, one-action export, deletion that reaches the file and the index, an audit record of who did what, and suppression that survives the next import. The judgement half stays with you, particularly redaction, because notes naming a referee, a client contact or another candidate are flagged for review rather than released blindly.

Written down once, this is a half-page procedure. Discovered under a statutory deadline, it is a week of somebody's life. That is the whole argument for doing it during onboarding rather than later.