Ethics, Law, Risk and Recruitment Governance

Introduction

Recruitment is not merely an administrative process for filling vacancies. It is a system of consequential decisions involving access to work, income, professional identity, organizational membership, and personal data. Because recruitment decisions distribute opportunity, they raise questions of justice, legality, privacy, accountability, and institutional power.

A recruitment system may fail even when it appears efficient. A low cost per hire can coexist with unlawful discrimination; rapid screening can conceal invalid automated decisions; and a technically compliant process can still undermine dignity through excessive surveillance or misleading communication. Graduate-level HR practice therefore requires an integrated approach: legal compliance establishes minimum standards, ethics informs responsible judgment, risk management anticipates harm, and governance creates durable accountability.

This chapter examines how organizations can design and control recruitment processes involving internal recruiters, hiring managers, agencies, assessment providers, applicant-tracking systems, and artificial-intelligence technologies. Specific laws differ across jurisdictions. Accordingly, legal principles are presented comparatively and must be applied with advice from qualified local counsel and relevant regulators.

Learning Objectives

By the end of this chapter, the reader should be able to:

1. Distinguish legal compliance, ethical recruitment, risk management, and governance.
2. Apply equal-opportunity, anti-discrimination, employment, privacy, and data-protection principles to recruitment.
3. Design valid consent, notice, retention, access, and recordkeeping practices.
4. Evaluate risks created by recruiters, vendors, platforms, and AI-enabled tools.
5. Establish accountability structures, controls, audit trails, and escalation procedures.
6. Analyze a recruitment-governance case and recommend defensible actions.

1. Recruitment as a System of Rights and Decisions

A recruitment process typically includes workforce requisition, job analysis, advertising, sourcing, application, screening, assessment, interviewing, selection, offer, background checking, and onboarding. Each stage creates decisions and records. It also creates opportunities for error or abuse.

Four perspectives should be kept distinct:

• Law asks whether conduct complies with enforceable rules.
• Ethics asks whether conduct is fair, respectful, transparent, and defensible, even where the law is silent.
• Risk management asks what could go wrong, how severe the consequences would be, and how risks can be reduced.
• Governance asks who has authority, who is accountable, what controls operate, and how performance is reviewed.

Compliance is therefore a floor, not a complete definition of responsible practice. For example, an organization might lawfully collect a broad range of applicant data in one jurisdiction, yet collecting it without a clear purpose may be ethically excessive and operationally risky.

The stakeholder model

Recruitment affects multiple stakeholders:

A governance system must balance these interests rather than treat the employer’s convenience as the sole objective.

2. The Legal Architecture of Recruitment

Recruitment law is usually distributed across several legal domains rather than contained in one statute. The applicable framework depends on country, state or province, industry, public or private status, collective agreements, and the size of the employer.

2.1 Equal opportunity and anti-discrimination

Equal-opportunity rules generally prohibit adverse treatment based on protected characteristics. Depending on jurisdiction, these may include race, color, ethnicity, sex, gender identity, sexual orientation, pregnancy, religion, disability, age, national origin, marital or family status, veteran status, or other legally protected grounds.

Two forms of discrimination are especially important:

• Direct discrimination occurs when a person is treated less favorably because of a protected characteristic.
• Indirect or disparate-impact discrimination occurs when a seemingly neutral requirement disproportionately excludes a protected group and cannot be justified as necessary and proportionate to the job.

Recruiters must distinguish a genuine job-related requirement from a preference or proxy. “Native speaker,” “culture fit,” uninterrupted career history, a particular school, or unrestricted availability may function as proxies for protected characteristics or socioeconomic status. Requirements should be linked to documented job demands, not intuition.

Reasonable accommodation may be required for applicants with disabilities or religious obligations. Examples include accessible application formats, additional assessment time, interpreters, alternative interview methods, and modified scheduling. Accommodation should be considered through an interactive process and should not be treated as evidence of lower suitability.

2.2 Job advertising and selection procedures

Advertisements should state material duties, essential qualifications, location or work pattern, compensation information where required, and a non-discrimination commitment. Wording such as “young and energetic,” “recent graduate,” or “no family commitments” can create legal and ethical exposure.

Selection procedures should be job-related, consistently administered, and documented. A structured interview with identical core questions and behaviorally anchored scoring is generally more defensible than an informal conversation based on personal similarity. Background checks should be relevant, proportionate, authorized where required, and conducted only after applicable notices and procedural safeguards.

Some jurisdictions regulate salary-history questions, automated employment decisions, pay transparency, criminal-record inquiries, independent-contractor classification, and political or genetic information. An international organization should never assume that a process designed for one country can be copied unchanged into another.

2.3 Privacy and data protection

Applicant data may include identification details, contact information, employment history, education, interview notes, assessments, references, identity documents, criminal-record information, health information, and inferred data. Data-protection principles commonly require:

1. Lawfulness, fairness, and transparency: the organization must have a valid legal basis and communicate meaningfully with applicants.
2. Purpose limitation: data should be collected for specified recruitment purposes, not indefinite future use.
3. Data minimization: collect what is relevant and necessary.
4. Accuracy: provide mechanisms for correction.
5. Storage limitation: retain information only as long as justified.
6. Integrity and confidentiality: protect data against unauthorized access, loss, alteration, or disclosure.
7. Accountability: be able to demonstrate compliance.

Legal bases for processing vary. Consent is only one possibility and is often weak in employment contexts because applicants may feel unable to refuse. Consent must generally be informed, specific, freely given, and capable of withdrawal. A statement hidden in a long application form is not meaningful consent.

Sensitive information requires stronger controls. Organizations should avoid collecting medical, biometric, political, or other sensitive data unless a clear legal and operational necessity exists. A request for disability information should be carefully separated from selection decisions where the law requires such separation.

Applicants may possess rights to access, correction, deletion, restriction, portability, objection, or review of automated decisions, depending on the jurisdiction. An organization needs a process for verifying identity, locating records, responding within legal deadlines, and preserving information needed for a dispute or legal obligation.

2.4 Cross-border processing and vendors

Global recruitment frequently transfers data across jurisdictions. Before using a foreign assessment platform or centralized applicant-tracking system, the organization should identify the data flows, processing locations, subcontractors, transfer mechanism, security controls, and rights available to applicants. A vendor contract should specify permitted purposes, confidentiality, security, breach notification, assistance with rights requests, deletion or return of data, audit rights, and restrictions on secondary use.

A vendor does not eliminate the employer’s accountability. Outsourcing execution may transfer tasks, but it does not automatically transfer legal responsibility or ethical ownership.

3. Ethical Principles for Recruitment

Ethical recruitment requires more than avoiding unlawful discrimination. It requires respect for applicants as persons rather than data points or sources of labor.

Respect for autonomy

Applicants should know what they are being asked to do, why information is collected, how assessments are scored, whether a human reviews the result, and how to seek correction or reconsideration. Deception, manipulative scarcity claims, and undisclosed recording undermine autonomy.

Fairness and equality

Fairness does not always mean identical treatment. Equality of opportunity may require accommodations or alternative methods. A fair process uses criteria that are relevant to performance, applies them consistently, and examines whether apparently neutral practices create unjustified exclusion.

Beneficence and non-maleficence

Organizations should seek beneficial outcomes while preventing avoidable harm. Requiring unpaid speculative work, collecting irrelevant personal information, or keeping applicants in indefinite uncertainty may impose costs without adequate justification.

Transparency and explainability

Transparency is not achieved merely by publishing a privacy policy. Applicants need understandable information at the point of decision. Explainability should be proportionate to impact: a rejection based on a highly consequential automated screen requires more meaningful explanation than an automated email confirming receipt of an application.

Confidentiality and dignity

Interview notes, reference comments, and identity documents should be accessible only to authorized personnel. Gossip, informal messaging about candidates, and careless use of social-media information can cause reputational harm and destroy trust.

Proportionality

A useful ethical test asks whether the information, method, or control is necessary for a legitimate objective, whether a less intrusive alternative exists, and whether the likely benefit justifies the burden imposed on applicants.

4. Recruitment Risk Management

Risk is not limited to lawsuits. Recruitment risks include operational disruption, cyberattack, discriminatory impact, invalid selection, reputational damage, vendor failure, fraud, privacy breach, and loss of candidate trust.

A basic risk-prioritization model is:

Here, R is a relative risk score, L is the estimated likelihood of an event, and I is its estimated impact. Both variables must be measured on defined ordinal or quantitative scales; the product is a prioritization aid, not a probability of loss. The model assumes that likelihood and impact are assessed consistently and that multiplication is useful for the organization’s decision context. It should not replace expert judgment, scenario analysis, or legal assessment.

A risk register may contain the following fields: risk statement, cause, affected stakeholders, inherent likelihood, inherent impact, existing controls, residual risk, risk owner, action plan, deadline, and evidence of closure.

Three lines of responsibility

A practical model assigns responsibility across three lines:

1. First line—operations: recruiters and hiring managers apply procedures and own day-to-day risks.
2. Second line—oversight: HR policy, privacy, legal, information security, and compliance functions set standards and monitor them.
3. Third line—independent assurance: internal audit or an equivalent independent function tests whether controls work.

The model is effective only when responsibilities are explicit. “Everyone is responsible” often means that no one is accountable.

5. Recruitment Governance Architecture

Governance translates principles into authority, controls, evidence, and consequences.

Policies and standards

A recruitment-governance framework should include, at minimum:

• equal-opportunity and non-discrimination policy;
• applicant privacy notice and data-retention schedule;
• structured selection and interview standard;
• reasonable-accommodation procedure;
• background-check and reference-check standard;
• vendor due-diligence and contracting standard;
• AI and automated-decision policy;
• conflicts-of-interest and anti-bribery rules;
• records-management and legal-hold procedure;
• complaint, appeal, and incident-escalation procedure.

Policies should specify scope, definitions, responsibilities, required evidence, exceptions, approval authority, monitoring, and sanctions for non-compliance. A policy that cannot be translated into observable behavior is unlikely to control risk.

RACI accountability

A RACI matrix can clarify who is Responsible, Accountable, Consulted, and Informed. For example, a recruiter may be responsible for obtaining an applicant notice acknowledgment, the HR director accountable for the process, privacy counsel consulted on lawful basis, and the hiring manager informed. Only one role should normally be accountable for a decision, even though several people contribute.

Preventive, detective, and corrective controls

Preventive controls include approved templates, access restrictions, mandatory training, job-related criteria, and system validation. Detective controls include sampling interview records, adverse-impact analysis, access-log review, and vendor audits. Corrective controls include retraining, deletion, reconsideration of decisions, remediation for affected applicants, disciplinary action, and process redesign.

Auditability

Auditability means that an independent reviewer can reconstruct what happened, who acted, which criteria were used, what information was available, and whether the decision complied with policy. A defensible recruitment record may include:

• approved requisition and job analysis;
• advertisement version and publication dates;
• applicant notice and consent or other legal basis;
• assessment version and validation evidence;
• interview questions and scoring guidance;
• panel membership and conflict declarations;
• reasons for progression or rejection;
• accommodation requests and responses;
• vendor and system logs;
• approvals, exceptions, complaints, and remediation.

Documentation should record reasons, not stereotypes. “Not a good fit” is weak evidence unless translated into specific, job-related criteria.

6. Artificial Intelligence and Automated Recruitment

AI may support sourcing, résumé parsing, ranking, conversational communication, interview transcription, assessment, fraud detection, or workforce forecasting. Its use creates additional governance obligations because automated systems may reproduce historical bias, rely on irrelevant proxies, generate inaccurate inferences, or make accountability difficult.

A lifecycle control model

Governance should operate throughout the system lifecycle:

1. Define purpose: identify the employment decision and why automation is needed.
2. Assess necessity and impact: consider discrimination, privacy, accessibility, security, and contestability.
3. Validate before deployment: test reliability, job relevance, subgroup performance, and accessibility.
4. Control data: document sources, quality, provenance, retention, and permitted use.
5. Maintain human oversight: assign qualified reviewers with authority to override results.
6. Monitor continuously: examine drift, complaints, error patterns, and subgroup outcomes.
7. Retire responsibly: stop systems that cannot be justified, secured, or corrected.

Human involvement is not meaningful merely because a person clicks “approve.” The reviewer must understand the tool’s limitations, have sufficient information, and be able to challenge the output.

Measuring selection outcomes

Where legally appropriate and statistically responsible, organizations can compare selection rates across groups. The selection rate for group g is:

where S_g is the number selected from group g and A_g is the number of applicants from that group. A selection-rate ratio comparing group a with reference group r is:

These measures are descriptive screening indicators, not proof of discrimination or proof of fairness. They require reliable group data, adequate sample sizes, attention to the stage of the process, and legal advice. Aggregated results can conceal intersectional effects and differences in applicant pools. Organizations should examine both outcomes and decision validity.

A system may produce similar selection rates while using invalid criteria; conversely, legitimate job-related criteria may produce unequal rates. Statistical monitoring must therefore be combined with job analysis, validation evidence, qualitative review, and procedural safeguards.

7. Managing Recruitment Intermediaries

Recruitment agencies, platforms, assessment providers, background-check firms, and cloud services extend the organization’s risk boundary. Due diligence should examine:

• legal and regulatory history;
• information-security controls;
• privacy practices and subcontractors;
• accessibility and accommodation capability;
• model documentation and validation evidence;
• data-retention and deletion practices;
• incident response and breach notification;
• insurance and financial stability;
• complaint handling and audit cooperation.

Contracts should prohibit unauthorized data sales, model training, profiling, or onward disclosure. They should define service levels, evidence requirements, audit rights, remedy obligations, and exit assistance. Procurement should not approve a vendor solely because it is inexpensive or technologically impressive.

8. Records, Retention and Complaints

Recordkeeping must reconcile two competing needs: retaining enough evidence to demonstrate lawful decision-making and deleting personal data when retention is no longer justified. Retention periods should be based on applicable limitation periods, regulatory requirements, organizational need, legal holds, and the sensitivity of the information.

A retention schedule should identify the record category, owner, storage location, retention trigger, retention period, access rules, and deletion method. Legal holds must suspend routine deletion when litigation, an investigation, or a credible dispute is anticipated.

Complaints should be accessible, impartial, confidential to the extent possible, and protected against retaliation. An effective process distinguishes:

• a request for information or correction;
• a procedural complaint;
• an allegation of discrimination or harassment;
• a data-protection rights request;
• a security incident;
• an appeal of a selection outcome.

Each category may require different deadlines, investigators, evidence-preservation rules, and escalation routes.

9. Illustrative Case: The Atlas Screening Project

Background

Atlas Health Services, a fictional multinational employer, introduced a vendor platform to rank applicants for customer-service positions. The tool analyzed résumés, online tests, and recorded video responses. It was marketed as reducing recruiter workload and improving consistency.

Problem

After six months, recruiters noticed that applicants with career breaks and applicants using screen readers progressed at lower rates. The vendor could not clearly explain which features drove rankings. Recruiters were told that the system was “validated,” but Atlas had not reviewed the validation study or tested local applicant populations. The privacy notice stated that data could be used to “improve services,” without explaining whether applicant data would train vendor models.

A complaint alleged disability discrimination and inadequate privacy notice. At the same time, a hiring manager asked recruiters to bypass the system for referrals from a preferred professional association.

Analysis

The case contains several connected risks:

1. Validity risk: unexplained features may not measure customer-service capability.
2. Discrimination risk: career gaps or accessibility-related behavior may act as proxies.
3. Privacy risk: secondary use and recorded-video processing may not be transparent or necessary.
4. Governance risk: recruiters lack authority and evidence to challenge the vendor.
5. Consistency risk: informal bypasses may create favoritism and unequal treatment.
6. Recordkeeping risk: Atlas may be unable to reconstruct how decisions were made.

The problem is not solved by asserting that the algorithm is objective. Automation can formalize historical preferences and make them harder to detect.

Approach and solution

Atlas should first pause automated rejection and preserve relevant records, including model versions, applicant outcomes, configuration settings, vendor communications, and complaints. Legal and privacy specialists should determine notification, investigation, and reporting obligations.

Next, Atlas should conduct an impact assessment and require the vendor to disclose purpose, input variables, training-data provenance at an appropriate level, validation methods, subgroup performance, accessibility testing, human-review procedures, retention, and secondary use. The organization should offer an accessible alternative assessment and a meaningful reconsideration route.

The selection process should be redesigned around a documented job analysis. Validated work samples and structured interviews should replace unexplained video-derived features unless Atlas can establish necessity, validity, accessibility, and proportionality. Any referral pathway should use the same minimum criteria and be documented rather than operating as an informal exception.

The governance committee should approve deployment only after testing. Recruiters should receive training on automation bias and override authority. Monitoring should compare progression, completion, false-negative patterns, accommodation requests, and complaints across relevant groups, subject to privacy law and statistical limitations.

Outcome

In this illustrative case, Atlas discontinued automated rejection, re-evaluated affected applicants, and offered an alternative assessment. The organization renegotiated the vendor contract, prohibited secondary use without approval, introduced quarterly audits, and assigned accountability to the HR technology director. The revised system took longer to implement but produced stronger evidence of job relevance and improved applicant trust.

Learning points

The case demonstrates that governance must precede scale. A tool cannot be treated as a neutral intermediary; its design, data, vendor relationship, configuration, and human use all affect outcomes. Fairness also requires consistent pathways: a sophisticated system and an undocumented personal referral are both governance problems, though they appear in different forms.

10. Contemporary Developments and Critical Issues

Recruitment governance is being reshaped by generative AI, biometric analysis, platform work, remote hiring, pay-transparency rules, and growing expectations of algorithmic accountability. Generative systems can create advertisements, summarize interviews, or draft communications, but they may hallucinate facts, reproduce stereotypes, expose confidential information, or obscure authorship. Human review must address accuracy and confidentiality, not merely grammar.

Remote recruitment increases cross-border processing, identity-fraud risk, accessibility concerns, and unequal access to technology. Biometric and emotion-recognition tools are especially controversial because their validity and necessity may be weak while their intrusiveness is high.

A critical governance question is whether organizations should use every legally permissible tool. The answer should depend on necessity, proportionality, evidence of benefit, distribution of risk, and the availability of less intrusive alternatives. Strategic HR leaders must be willing to reject technology that cannot be explained, validated, secured, or governed.

Best-Practice Implementation Roadmap

An organization beginning a recruitment-governance program can proceed in stages:

1. Map the recruitment process, decisions, data, systems, vendors, and jurisdictions.
2. Identify legal obligations and high-impact risks.
3. Standardize job analysis, criteria, interview guides, and accommodation procedures.
4. Publish clear applicant notices and establish rights-request channels.
5. Create a retention schedule, access model, and audit trail.
6. Conduct vendor due diligence and strengthen contracts.
7. Establish AI impact assessment and approval procedures.
8. Train recruiters, managers, interviewers, and technology users.
9. Monitor outcomes, complaints, exceptions, access logs, and control failures.
10. Report findings to accountable executives and improve the system continuously.

Governance should be proportionate to risk, but no recruitment process is too small to require clear criteria, respectful treatment, lawful data handling, and accountable decision-making.

Chapter Summary

Ethical and lawful recruitment is a strategic governance challenge. Employment law establishes duties concerning equal opportunity, accommodation, job-related selection, privacy, transparency, and records. Ethical practice extends these duties through respect for autonomy, dignity, fairness, proportionality, and meaningful explanation.

Risk management identifies possible harms and assigns owners, while governance converts principles into policies, controls, evidence, oversight, and corrective action. Auditability depends on clear criteria, structured procedures, reliable records, and documented reasons. Vendors and AI systems remain within the organization’s accountability boundary. Automated recruitment requires lifecycle impact assessment, validation, human oversight, monitoring, and the ability to suspend or replace systems that cannot be justified.

The central managerial lesson is that recruitment quality cannot be measured only by speed, cost, or hiring volume. A strategically mature organization also asks whether opportunities were allocated fairly, data were handled responsibly, decisions can be explained, and controls can withstand independent scrutiny.

Key Terms

Accountability: The obligation to answer for decisions, actions, and outcomes.

Auditability: The capacity to reconstruct and independently evaluate a process.

Consent: A freely given, informed, specific, and withdrawable agreement to processing or an activity.

Data minimization: Collecting and using no more personal data than is necessary.

Disparate impact: Unequal effects produced by an apparently neutral practice.

Direct discrimination: Less favorable treatment because of a protected characteristic.

Equal opportunity: Fair access to employment without unlawful discrimination.

Human oversight: Competent human review with authority to question or override an automated result.

Indirect discrimination: A neutral rule that unjustifiably disadvantages a protected group.

Legal basis: The recognized justification for processing personal data.

Proportionality: Matching the intrusiveness of a practice to its legitimate purpose and expected benefit.

Protected characteristic: A status or attribute protected by applicable law.

Reasonable accommodation: A modification enabling an otherwise qualified applicant to participate fairly.

Recruitment governance: Structures, policies, roles, controls, and oversight governing recruitment decisions.

Risk register: A documented record of risks, controls, owners, and actions.

Selection rate: The proportion of applicants from a group who progress or are selected.

Structured interview: An interview using consistent questions and predefined scoring criteria.

Transparency: Clear communication about purposes, methods, data use, and decision processes.

Validation: Evidence that a selection method measures relevant capabilities and supports job-related decisions.

Vendor due diligence: Investigation of a provider’s legal, operational, technical, and ethical capability before engagement.

Review Questions

Short Answer Questions

1. Distinguish legal compliance from ethical recruitment.
2. What is the purpose of data minimization in recruitment?
3. Identify two preventive controls and two detective controls.
4. Why is consent not always an appropriate legal basis in recruitment?
5. What information should a recruitment audit trail preserve?

Long Answer Questions

1. Explain how equal-opportunity law, structured selection, and reasonable accommodation interact in recruitment design.
2. Discuss the principal data-protection principles applicable to applicant information.
3. Evaluate the responsibilities of an employer using an external recruitment-technology vendor.
4. Explain why human oversight of AI recruitment tools must be meaningful rather than symbolic.
5. Design a recruitment-governance framework for a multinational organization operating across several jurisdictions.

Analytical / Application Questions

1. An automated résumé-ranking system produces substantially lower progression rates for applicants with career gaps. Develop an investigation and remediation plan, including evidence that should be collected.
2. A hiring manager wants to bypass the approved process for a personal referral. Analyze the legal, ethical, operational, and governance risks and recommend a response.
3. Construct a risk register for a remote recruitment process that uses recorded interviews, background checks, and an external assessment platform. Identify owners and appropriate controls.

Multiple Choice Questions with Answers

Question 1

Which statement best distinguishes law from ethics in recruitment?

A. Law establishes enforceable minimum duties, while ethics also addresses responsible conduct beyond legal minimums.

B. Ethics applies only to public employers, while law applies only to private employers.

C. Law concerns data only, while ethics concerns interviews only.

D. There is no meaningful distinction between law and ethics.

Correct Answer: A. Law establishes enforceable minimum duties, while ethics also addresses responsible conduct beyond legal minimums.

Question 2

Which practice best reflects data minimization?

A. Collecting every available applicant attribute for possible future use

B. Collecting only information relevant and necessary for a specified recruitment purpose

C. Retaining all applicant information indefinitely

D. Sharing applicant records with all organizational employees

Correct Answer: B. Collecting only information relevant and necessary for a specified recruitment purpose

Question 3

What is a defining feature of indirect discrimination?

A. An explicit statement that a protected group is unwelcome

B. A neutral practice that unjustifiably disadvantages a protected group

C. A lawful accommodation for an applicant

D. A documented structured interview

Correct Answer: B. A neutral practice that unjustifiably disadvantages a protected group

Question 4

Which item is most important for an auditable selection decision?

A. The interviewer’s general impression of personality

B. An undocumented verbal recommendation

C. Documented job-related criteria and reasons for the decision

D. The applicant’s social-media popularity

Correct Answer: C. Documented job-related criteria and reasons for the decision

Question 5

Why may consent be weak in an employment context?

A. Applicants may feel unable to refuse because of an imbalance of power

B. Consent can never be withdrawn under any circumstances

C. Consent is relevant only to paper records

D. Consent automatically authorizes every future use of data

Correct Answer: A. Applicants may feel unable to refuse because of an imbalance of power

Question 6

In the three-lines model, who normally performs day-to-day recruitment activities and owns operational risks?

A. The first line

B. The second line

C. The third line

D. An external regulator

Correct Answer: A. The first line

Question 7

What is the most appropriate response when an AI recruitment tool cannot be validated or explained sufficiently for a high-impact decision?

A. Deploy it immediately because automation is presumed objective

B. Use it only for applicants from protected groups

C. Pause or reject deployment until adequate evidence and controls exist

D. Remove all human review to increase consistency

Correct Answer: C. Pause or reject deployment until adequate evidence and controls exist

Question 8

If 20 of 100 applicants in group A are selected, what is group A’s selection rate?

A. 5%

B. 20%

C. 80%

D. 120%

Correct Answer: B. 20%

Question 9

Which contractual provision is especially important when using an external recruitment platform?

A. Permission for unrestricted resale of applicant data

B. A prohibition on all audits by the employer

C. Requirements concerning security, permitted use, breach notification, and deletion

D. A waiver of all vendor accountability

Correct Answer: C. Requirements concerning security, permitted use, breach notification, and deletion

Question 10

What is the primary purpose of a retention schedule?

A. To retain every record permanently

B. To define what is retained, for how long, by whom, and how it is securely deleted

C. To prevent applicants from requesting access to data

D. To replace all privacy notices

Correct Answer: B. To define what is retained, for how long, by whom, and how it is securely deleted