> An operating model for legal basis, notices, retention, access and data-subject rights, to be validated with legal counsel. Source: https://hice.ai/en/blog/gdpr-compliant-candidate-database # Building a GDPR-Compliant Candidate Database - The operational answer - Why the problem appears in practice - The operating model, step by step - A complete hypothetical example - Decisions, evidence and ownership - Checklist before you start - How to measure whether it works - Mistakes that make the system fragile - A 30, 60 and 90-day implementation plan - Turning the guide into daily work with Hice An operating model for legal basis, notices, retention, access and data-subject rights, to be validated with legal counsel. The useful answer is not another isolated tool or policy. It is a connection between the outcome, the evidence, the owner and the decision. This guide turns the subject into an operating model that a team can test, measure and correct without relying on abstract promises. ## The operational answer For Building a GDPR-Compliant Candidate Database, the central task is to make explicit what currently lives in people's heads or disconnected files. The team must know the intended outcome, the evidence that proves it, who can intervene and which decision follows when the evidence changes. A definition is useful only when it separates the subject from adjacent processes and states what is outside scope. Start from one real case and document its inputs, outputs, owner, cadence and acceptance criteria. ## Why the problem appears in practice The failure rarely comes from having no information. It comes from distance between information, timing and accountability. A number can be correct but arrive after the decision; a workflow can be complete but lack an owner; a dashboard can look polished yet trigger no action. With building a gdpr-compliant candidate database, the central risk is keeping CVs indefinitely because they may become useful. Treat it as an operating risk with an early signal and an agreed response, not a note for the quarterly meeting. ## The operating model, step by step The model below uses five blocks. They are not a rigid sequence: a mature organization may run them in parallel, while a team starting out should handle them in order. Each block must produce verifiable evidence rather than a statement of intent. 1. purpose and legal basis. Describe the current state, the expected outcome and the person who owns the decision. Choose only the mandatory fields and a cadence that matches the speed of the process. For building a gdpr-compliant candidate database, this step must finish with an observable output: an approved rule, a reconciled record, an assigned exception or a logged choice. If the team cannot explain the output in one sentence, the step is probably too broad. 2. notice and provenance. Describe the current state, the expected outcome and the person who owns the decision. Choose only the mandatory fields and a cadence that matches the speed of the process. For building a gdpr-compliant candidate database, this step must finish with an observable output: an approved rule, a reconciled record, an assigned exception or a logged choice. If the team cannot explain the output in one sentence, the step is probably too broad. 3. retention and deletion. Describe the current state, the expected outcome and the person who owns the decision. Choose only the mandatory fields and a cadence that matches the speed of the process. For building a gdpr-compliant candidate database, this step must finish with an observable output: an approved rule, a reconciled record, an assigned exception or a logged choice. If the team cannot explain the output in one sentence, the step is probably too broad. 4. access and security. Describe the current state, the expected outcome and the person who owns the decision. Choose only the mandatory fields and a cadence that matches the speed of the process. For building a gdpr-compliant candidate database, this step must finish with an observable output: an approved rule, a reconciled record, an assigned exception or a logged choice. If the team cannot explain the output in one sentence, the step is probably too broad. 5. rights and audit. Describe the current state, the expected outcome and the person who owns the decision. Choose only the mandatory fields and a cadence that matches the speed of the process. For building a gdpr-compliant candidate database, this step must finish with an observable output: an approved rule, a reconciled record, an assigned exception or a logged choice. If the team cannot explain the output in one sentence, the step is probably too broad. ## A complete hypothetical example Consider a hypothetical 80-person services firm managing clients, opportunities and projects in different tools. Leadership wants to improve building a gdpr-compliant candidate database, but every function begins with a different definition. The team selects one pilot flow, records a four-week baseline and appoints an owner. It translates the five elements — purpose and legal basis, notice and provenance, retention and deletion, access and security, rights and audit — into fields and decisions. After the first cycle, it reviews not only the final result but also missing data, exceptions, processing time and ownerless decisions. The numbers would be hypothetical; the value lies in the before-and-after method. ## Decisions, evidence and ownership | Area | Minimum evidence | Connected decision | | --- | --- | --- | | purpose and legal basis | Baseline and shared definition | Confirm the scope | | notice and provenance | Current record with an owner | Correct the record or process | | retention and deletion | Exceptions and reasons logged | Act on the exception | | access and security | Result compared with the plan | Scale, change or stop | ## Checklist before you start - The outcome of building a gdpr-compliant candidate database is written in verifiable terms. - The five elements — purpose and legal basis, notice and provenance, retention and deletion, access and security, rights and audit — have owners and data sources. - The baseline is measured before the process changes. - Exceptions have a queue, priority and accountable person. - The primary metric is records with documented purpose, source and expiry. - The review ends with decisions, not a reading of numbers. ## How to measure whether it works The guiding metric is records with documented purpose, source and expiry, but one measure is not enough. Add one indicator each for quality, speed and adoption. Track how many exceptions are corrected manually: an apparently better result may hide work moved outside the system. Compare the same population and period, annotate changes in volume or mix, and keep the metric definition beside its value. Every review should answer three questions: what changed, why did it change, and what decision follows now? ## Mistakes that make the system fragile The first mistake is automating or standardizing before clarifying the decision. The second is relying on an average that hides materially different clients, roles or projects. The third is confusing completion with adoption: populated fields do not prove that people use them to decide. Finally, do not promise precision that the data cannot support. The specific risk — keeping CVs indefinitely because they may become useful — needs an attention threshold, an owner and an escalation path. ## A 30, 60 and 90-day implementation plan In the first 30 days, define scope, capture the baseline and test source quality. By day 60, run a pilot with one team or segment and review exceptions weekly. By day 90, compare outcomes, operating load and adoption; only then decide whether to expand. Document what failed and update fields, thresholds and ownership. A fast rollout without this cycle creates distribution, not learning. ## Turning the guide into daily work with Hice Hice is useful when building a gdpr-compliant candidate database depends on data currently split across CRM, recruiting, staffing, projects, timesheets and billing. Connecting those objects lets the team follow the same evidence from initial demand to a decision and its economic result, with less manual reconciliation. A governed spreadsheet may still be enough for a small, stable process; a shared platform becomes stronger as people, clients and exceptions multiply. You can try Hice for free with one real workflow and verify whether it reduces friction and lost context. ## Frequently asked questions about Building a GDPR-Compliant Candidate Database ### Building a GDPR-Compliant Candidate Database: what does it mean in practice? It is how a services firm makes explicit an outcome that currently lives in people's heads or in disconnected files. It becomes operational once four things are written down: the outcome being sought, the evidence that proves it, the person who can intervene, and the decision that follows when that evidence changes. ### Building a GDPR-Compliant Candidate Database: where do you start? With one real flow, not the whole process. Start at purpose and legal basis, record a four-week baseline without changing anything, and name an owner. Without a baseline you will not be able to say whether the change that follows worked, or whether the workload simply moved. ### Which areas does it need to cover? Five: purpose and legal basis, notice and provenance, retention and deletion, access and security, rights and audit. Each has to end in an observable output — an approved rule, a reconciled record, an assigned exception or a logged decision — and each needs an owner and a data source. If an area cannot be explained in one sentence, it is too broad and should be split. ### How do you measure whether it is working? The guiding metric is records with documented purpose, source and expiry, alongside one indicator each for quality, speed and adoption. Count how many exceptions get corrected by hand as well: a result that improves while manual corrections rise is moving work outside the system rather than removing it. ### What is the most common mistake? Keeping CVs indefinitely because they may become useful. That is the failure that makes the whole effort fragile, and it should be handled as an operating risk: an attention threshold, an owner and an agreed escalation path. The other frequent mistake is automating before deciding what the data is supposed to trigger. ### How long before it shows a result? About ninety days, in three phases. The first 30 define scope, capture the baseline and test source quality. By day 60 a pilot runs with a single team, reviewing exceptions weekly. At 90 days you compare outcome, operating load and adoption, and only then decide whether to extend it. ## Put this guide into practice with free software HICE connects candidates, clients, consultants, timesheets and expenses. The free plan includes up to 10 employees and 2,000 CVs for companies, and 500 CVs for freelancers and solo professionals. ### More Articles #### Recruitment Funnel: Stages, Conversion and Dashboard Definitions, formulas and segmentation for reading the recruiting funnel and fixing real bottlenecks. #### Recruiting KPIs: 15 Metrics and Formulas Speed, quality, cost, experience and fairness: recruiting metrics with definitions, sources and connected decisions. #### Time to Hire vs Time to Fill: Difference and Formula Definitions, start and end events, segmentation and action for using the two recruiting speed metrics correctly. #### Cost per Hire: Formula and Calculation Model Internal, external and allocated costs for calculating cost per hire without inconsistent populations or periods. #### Candidate Sourcing: 12 Channels and Measurement Inbound, outbound, database and referral channels compared on cost, conversion, speed and quality by role. #### Employee Selection Process: Guide and Flowchart From job intake to onboarding: stages, criteria, roles and SLAs for a controllable selection process.