Recruitment

A recruitment CRM for an Irish agency: the licence, candidates' data, and what to automate around it

An employment agency in Ireland needs a licence before it trades, and the regulations made under the 1971 Act say which records it keeps. Candidates' CVs are personal data, kept for a period you have to be able to justify. A recruitment CRM, and the automation around it, can carry both.

By Oscar CobbeCurrent as at 30 October 20267 minute read11 sources

The licence comes before the software

Under section 2 of the Employment Agency Act 1971, nobody may carry on the business of an employment agency except under a licence. Section 1 defines that business as seeking, for reward or otherwise, on behalf of others, people who will give or accept employment, and it includes supplying people for reward. The Workplace Relations Commission's licensing section, in Carlow, takes applications and renewals. What it asked for in October 2026:

1A notice of your intention to apply, published in a national daily newspaper, as section 3 of the Act requires.
2The application form, with Garda vetting of the applicant and two independent references to good character.
3A self-certified statement that the premises meet the standards of accommodation set by the regulations and by the Safety, Health and Welfare at Work Act 2005.
4Proof that the business name is registered with the Companies Registration Office, and the certificate of incorporation for a company.
5A statement of fees saying you will never charge a candidate a fee. Section 7(2) of the Act bars charging a fee solely for agreeing to look for work for someone.
6The fee, which the WRC gives as €500.

A licence lasts a year

The WRC says a licence is valid for one year from the date it is issued, is renewed each year for €500, and that a renewal should be submitted four weeks before the licence expires. An agency may not trade while its application is being considered. Trading without a licence is an offence: the WRC puts the penalty on summary conviction at a Class C fine of up to €2,500, and up to €1,000 a day for a continuing offence.

The records the regulations require

Regulation 9 of the Employment Agency Regulations 1972 (S.I. No. 255 of 1972) requires a licence holder to keep records showing:

1the number of people who apply for employment, and the type of employment they seek;
2the number placed in employment, and the type of employment;
3the number placed in employment outside the State, the countries and the occupations;
4the fees charged for each person placed;
5any charges for expenses.

Returns, display and inspection

The same regulation requires a return of the business to the Minister at least twice a year, and regulation 10 requires the licence to be displayed and the approved scale of fees given on request to anyone proposing to use the agency. Under section 9 of the Act, authorised officers may enter the premises and inspect the records the Act requires. A recruitment CRM that records each application, placement and fee can produce these counts as a report.

What the Data Protection Commission says about candidates' data

We found no Data Protection Commission guidance written for recruitment agencies. Two of its publications deal with job applicants' data directly.

In a 2025 case study, a person who had been turned down for a job asked the organisation to erase their application. The organisation kept records of unsuccessful applications for 12 months, for the defence of legal claims, and pointed to complaints under the Employment Equality Acts, which can be made to the WRC within six months of the alleged discrimination, extendable by six months in certain circumstances. The DPC said the GDPR does not prescribe retention periods, but a controller must set them and be able to justify them, and an organisation refusing erasure must say which exemption in Article 17(3) it relies on.

Its guidance on Garda vetting says that, for unsuccessful applications, the vetting disclosure and all other personal data collected in recruitment should not be kept beyond the statutory period in which a claim arising from the recruitment can be brought, and that the retention periods, or the criteria for them, belong in your data protection notice.

We found no DPC guidance on CVs sent speculatively either. The GDPR applies to them as to any other personal data: Article 5(1)(e) allows data to be kept no longer than its purpose needs, and Article 13 requires telling the person, when you collect their data, how long it will be kept or how that will be decided. A CV that reaches you from someone other than the candidate, through a referral or a profile found online, falls under Article 14: the candidate must be told within a reasonable period and at the latest within one month, or earlier, at your first contact with them or when you first send the CV to a client, if either comes sooner.

Candidates have the same rights as anyone else, among them access, correction and erasure. A request must be answered within one month of receipt, extendable by two further months for complex or numerous requests (Article 12(3)); subject access requests covers the clock. Where you rely on consent, withdrawing it must be as easy as giving it (Article 7(3)).

What to automate around a recruitment CRM

These follow from the licence, the GDPR or the work itself, and each is a rule a CRM can apply to every record without anybody remembering to. Booking tools for interviews are compared in Calendly or Microsoft Bookings.

1Job board feeds. Recruitment systems publish jobs to boards through a feed: Zoho Recruit sends each board an XML feed, says whether a job appears is up to the board, and unpublishes a job after 30 days without notice, so a repost belongs in the workflow.
2The privacy notice at the right moment. A CV that arrives by email, or is added from another source, triggers the notice Article 13 or Article 14 requires, and the date it went out is stored on the candidate's record.
3Source and basis on each record. Where the CV came from, the lawful basis relied on, and any consent with its date, held as fields, so a candidate's question can be answered from the record.
4Retention dates. A review date set when an application closes, matching the period in your notice, with deletion queued when it passes and a note of any record kept back under Article 17(3).
5Candidates' requests. An access or erasure request logged with the date it arrived and the date it is due.
6Interview scheduling. A booking link sent with each shortlist, so the candidate picks a slot and the calendar and the CRM both update.
7The licence itself. A reminder four weeks before the renewal falls due, and the counts regulation 9 asks for, drawn from the CRM twice a year.

Recruitment software, from the vendors' own pages

A general CRM, like those compared in CRM for a small business, is organised around contacts and deals. Recruitment systems are organised around candidates, jobs and client companies. Two, as their own pages described them in October 2026:

Bullhorn's Pro and Max plans add AI search, matching and screening of candidates. If software scores, filters or rejects candidates with no person really deciding, Article 22 of the GDPR applies: GDPR Article 22 and AI in hiring.

1Bullhorn: its pricing page for the United Kingdom and Europe showed, among its plans for small agencies, Starter at £80 a user a month, in sterling, with applicant tracking, CV parsing, client management and job posting with a careers portal, and Core at £120, adding custom fields and workflows, LinkedIn integrations and a marketplace of over 300 partner apps. The recruitment CRM sales pipeline starts on Pro, and interview scheduling on Max; both are priced on request. Bullhorn describes itself as a data processor for its customers, and its group companies transfer data outside the EEA under the EU's standard contractual clauses.
2Zoho Recruit: its help pages describe GDPR features switched on by default for accounts that sign up on its EU servers: a candidate login for access and correction, erasure from the record and then from the recycle bin, an action to restrict processing, and export of a candidate's data as CSV. Free job boards are enabled by default, fed through the XML feed described above.

Where the CVs arrive

CVs arrive by email, which makes an agency's mail domain part of how it handles candidates' data. In our study of 4,101 Irish business domains in October 2026, recruitment agencies led five sectors: 62 of the 268 agency domains that receive email (23.1%) publish a DMARC policy asking receiving servers to junk or refuse mail forged in their name, ahead of solicitors at 20.2%. Email security in five Irish sectors has the full figures.

Build joins a recruitment CRM to the inbox, calendar and accounts around it, and sets up the reminders and reviews listed above.

Sources

Free, and no account needed

When is a candidate's access request due?

Enter the day the request arrived and see the last day to answer under Article 12(3) of the GDPR, counted the way EU law counts a month, with the extended date as well.

Run the free check

Candidates, jobs and deadlines kept in step

Build joins your recruitment CRM to the systems around it and automates the notices, reviews and reminders your licence and your privacy notice call for, and every automation retries and alerts a person when it fails. €1,500 for one connection, €3,000 for up to five workflows.

See Build

Who wrote this

Oscar Cobbe · Founder, FourWinds Digital

Writes and maintains the legal explainers on this site, and does the compliance work behind them. Every date and article number here is checked against the legislation itself before it is published, and each article shows the date it was last checked.

More about how we work →