Can You Contact Former Candidates About a New Vacancy?

A new vacancy opens and you remember someone who applied last year. They were a strong candidate, so sending them a quick email seems harmless.

Whether you can do that depends on why you still hold their data and what the candidate was told when it was collected.

Why do you still have the candidate’s details?

This is the first question.

If the original application should already have been deleted under your retention policy, the fact that you happen to still have a copy is not a good reason to use it.

If the candidate was legitimately retained in a talent pool for future vacancies, the situation is different.

What did you tell the candidate?

Transparency matters.

If you told the candidate that you would keep their details for a defined period and might contact them about suitable future vacancies, a relevant approach is more likely to match their expectations.

If the candidate applied for one specific role years ago and heard nothing further, an unexpected recruitment message may be harder to justify.

Do you need consent?

Not necessarily, and by the time a vacancy opens the question is usually already answered.

If the candidate agreed to be kept for future vacancies, that consent covers the approach, and it holds until they withdraw it. If your pool runs on legitimate interests, the approach is covered as long as it stays inside the balancing assessment you documented and the candidate has not objected.

The decision belongs at the point you decide to keep someone, not at the point you want to email them. Do you need consent to keep a candidate’s CV? sets out both routes.

Keep the contact relevant

If someone applied for a senior accounting position, contacting them about another accounting role may make sense.

Using an old CV to send broad promotional recruitment messages about unrelated jobs is different.

The closer the new contact is to the purpose and expectations under which the data was retained, the easier it is to explain.

Give candidates control

Make it easy for candidates to say they do not want future recruitment contact.

If they object or withdraw consent where applicable, update your systems so that they are not contacted again on the same basis.

Check the communication rules

The GDPR is not the only law that can matter when sending electronic communications.

Depending on the country, the type of message and the channel used, electronic communications and direct marketing rules may also apply.

Do not assume that a GDPR legal basis automatically answers every question about sending emails or messages.

Build future contact into the process

The best time to decide how former candidates will be contacted is not when a new vacancy appears.

Create a talent-pool process in advance, including purpose, legal basis, transparency, retention and opt-out handling. Recording it in your processing register keeps the decision visible to everyone who recruits.

GDPRWise helps employers document recruitment and talent-pool activities so future candidate contact is based on a defined process rather than an old CV found in an inbox.