Premiere of the 3rd edition of the "GDPR Small Code of Conduct for Employment Agencies". Experts from the Polish HR Forum set data protection standards in the HR industry and clarify the rules of cooperation between entities, including in temporary work, candidate selection, and digital recruitment.

🔗DOWNLOAD: GDPR Small Code of Conduct for Employment Agencies 2026

The third edition of the industry handbook "GDPR – Small Code of Conduct for Employment Agencies" has been published, edited by legal counsel Liliana Strupp, Vice President of the Board of the Polish HR Forum, CIPP/E. The publication, prepared by an interdisciplinary expert team from the Polish HR Forum, addresses the latest legal changes, including the new Act on the Labor Market, the provisions of the EU Artificial Intelligence Act, and the dynamically evolving realities of personal data processing in employment agencies. The new edition specifically organizes the principles of lawful personal data processing, candidate verification procedures, and the boundaries of using new technologies.

A key theme of the latest publication is the HR industry's shift away from the widespread, often overused practice of collecting candidate consents in favor of more appropriate legal grounds, such as pre-contractual steps or the legitimate interests of the controller.

- Consent to data processing should only play an auxiliary role in recruitment. By submitting application documents or creating an account on the agency's portal, the candidate seeks to enter into an agreement, which constitutes an appropriate legal basis for assessing their professional profile without the need to obtain separate consent clauses. Using the agency's legitimate interest, in turn, enables objective recruitment analytics or candidate skills verification. On the other hand, candidate consent remains an appropriate basis in situations that require in-depth verification or involve a greater degree of interference with their privacy, such as obtaining opinions and references from previous employers – points out Liliana Strupp.

A distinct place in the Code is dedicated to the growing role of modern competence verification methods, including various types of knowledge, skills, and personality predisposition tests. Experts indicate that these tools are crucial for ensuring the reliability of recruitment processes; however, they require precisely matching the legal basis to the scope of the information obtained. While standard verification of professional qualifications is based on the right to check data declared in a CV, using more advanced tools (e.g., psychological tests) requires particular caution and full voluntariness on the candidate's part, so as not to infringe upon their personal rights or unjustifiably process special category data.

The changes also concern the use of artificial intelligence, which is addressed in a completely new chapter of the publication. Under the EU Artificial Intelligence Act, algorithms used in HR for purposes such as automated CV analysis, application filtering, or candidate profiling have been classified as high-risk systems. This imposes strict obligations on providers and agencies regarding auditability, risk management, and ensuring continuous human oversight.

New technology law specialists who contributed to the Code indicate that technology in HR is meant to support, not replace, the human element. Situations where an IT system autonomously makes a final decision to reject a candidate without the possibility of verification and intervention by a recruiter are unacceptable.

The Code provides a detailed analysis of the specific model of temporary work and definitively resolves doubts regarding the roles that temporary work agencies and user employers play in terms of data protection. The tripartite nature of temporary employment results in a natural and statutory division of employer functions. The agency acts as the formal employer, entering into the contract, calculating remuneration, maintaining employee records, and fulfilling public-law obligations. The user employer, on the other hand, organizes on-site work, exercises direct supervision, specifies the time and place of tasks, and ensures occupational health and safety (OHS). This specific nature means that both entities independently determine their own purposes and means of processing temporary workers' data. This means that the agency and the user employer act as separate data controllers.

The third edition of the Code is a comprehensive guide aimed at helping companies in the HR sector operate in a safe, transparent manner that fully complies with the highest standards of privacy protection.