Playbook, recruitment agency
What an assistant may say about how candidate data is held
The person typing this works in procurement or security at a company about to add the agency to a supplier list. They are not asking about recruitment. They are asking what happens to the identity documents, right to work records and CVs the agency holds on people it will send to them, because that holding becomes their exposure the moment the first worker walks through the gate.
Why this is not the general answer
The handling pattern for security questionnaires holds across every trade. What follows is the part that does not.
- The data in question is not the buyer's own. It belongs to candidates and workers, and the client is asking about a holding they will never see but will be associated with once workers are on site.
- Right to work checks generate copies of identity documents with retention obligations attached to them, and a buyer's questionnaire asks specifically where those sit and for how long.
- Paying temporary workers means bank details and tax references pass through the agency, which puts a recruiter in a data category most professional service suppliers are never asked about.
- These questions usually arrive as part of getting onto a preferred supplier list, so the answer is being compared with other agencies' answers rather than resolving anybody's problem.
How it arrives
- where do you store candidate identity documents
- how long do you keep right to work records
- can you complete our supplier security questionnaire
- do you have a data processing agreement we can sign
- who has access to worker bank details
- what insurance cover do you carry
What has to be indexed for this to work
| A published statement on how candidate and worker data is held | The only material that should be indexed for this. Every sentence is a public commitment, which is the right bar: if you would not sign it, it should not be on the page and therefore cannot be repeated by an assistant. |
|---|---|
| Retention periods, stated per record type | CVs, right to work copies, references, payroll records. They differ, some are set by obligations you do not control, and one blanket figure across all of them is wrong for most. |
| Insurance and accreditation, with renewal dates | What cover you carry and to what limits, plus any sector accreditation. Buyers ask for these in the same breath as the data questions, and the renewal date matters to them as much as the figure does. |
| Where a questionnaire should be sent | A named route for supplier onboarding, kept apart from candidate and client enquiries. These arrive carrying a procurement deadline and they die quietly in a general inbox. |
The reply
I can point you at what we publish rather than answer a questionnaire. Our statement on how candidate and worker data is held covers storage, access and the retention period for each type of record, including the right to work copies [1], and our insurance and accreditation details sit alongside it with their renewal dates [2]. Anything beyond what is written there has to come from a person, and a completed questionnaire or a signed agreement always does. Leave your name, an email and your organisation and I will get it to whoever handles supplier onboarding.
It sets the boundary at the published page in the opening sentence, because a buyer who understands that stops trying to extract more and asks for the document instead. Naming the right to work copies shows the agency knows which part of the holding they were worried about. And it routes to onboarding rather than a general inbox.
Where it stops
The trigger. Any request to complete a questionnaire, sign an agreement, or confirm something not stated on the published page.
I can only repeat what we publish, and a questionnaire or an agreement needs somebody to sign it. Leave your name, an email and your organisation and I will pass it to the team that handles supplier onboarding.
It stops answering before it guesses, says who will pick it up, and asks for the one thing that makes a reply possible. Nothing about it reads as a dead end.
Never say this here
Out of bounds
- Never confirm a certification, an accreditation or an insurance limit that is not on your published material.
- Never describe an internal control, a process or a supplier from memory, because the buyer is writing the answer down and will attach it to a contract.
- Never say how many candidate records the agency holds, or name a client the agency works with.
- Never agree that the agency can meet a requirement, since that is a commercial commitment made by whoever signs and not by an assistant.
Questions
- Do buyers really put these to a chat widget?
- They use whatever answers fastest. A procurement analyst working through a supplier pack will try the widget before sending an email, and whatever comes back is what goes into the pack.
- Should it answer at all, or only take a message?
- Answer from the published page and take a message for everything else. A statement you would sign is safe to repeat, and the difference between a link and a form is a day of somebody's onboarding timeline.
- Can it fill in the questionnaire?
- No. It cannot complete a form, generate a document or sign anything. It quotes what is published, cites it, and hands the rest over with the buyer's details already collected.
Keep reading
- Everything for a recruitment agencyTwo audiences on one website. Process, payroll and compliance questions are answerable, application outcomes never are.
- Handling security questionnaires in generalA buyer-side question arriving in the wrong place. Answer only what you publish, and never let an assistant improvise a claim you then own.
- Cancelling a search is not cancelling a subscriptionWithdrawing a brief, ending a temp booking and the introduction that stays live for months. Terms answers, never a decision on a case.
- Three clocks running on a recruitment websiteA shift starts before the office opens and the cut off falls at the weekend. Which times a recruitment site actually needs to publish.
- Three addresses, and the one that must not be publishedRegistration is at the branch, the interview is at the client and the work is elsewhere again. Which address may be given out, and when.
Try it on your own material
Upload a document or point it at your site, paste one line of HTML, then ask it something only your business could answer.