Careers / Applicant Data Rights

NDPA-compliant handling of job applicant data — legitimate-interest basis, retention, erasure on request, automated CV-screening disclosure.

Open in StackBlitzOpen in CodeSandbox

Applicant data is one of the highest-risk processing activities Nigerian companies do — you collect CVs, government IDs (NIN), salary history, and sometimes do automated screening (Section 37). NDPC has flagged careers / HR data as a top audit area. The good news: the toolkit handles the pieces you actually need.

Lawful basis

For active applications, the lawful basis is usually contract steps under Section 25(1)(b) (the applicant initiated the process). For unsolicited CVs or talent-pool retention beyond the active role, use legitimate interest under Section 25(1)(f)— but you must complete a Legitimate Interest Assessment (LIA). The toolkit's lawful-basis tracker generates an LIA template:

import { LawfulBasisTracker } from '@tantainnovative/ndpr-toolkit';

<LawfulBasisTracker
  defaultActivities={[
    {
      id: 'careers-active-application',
      name: 'Active job application processing',
      lawfulBasis: 'contract',
      lawfulBasisJustification:
        'Processing CV and contact details to evaluate the applicant for the role they applied to (Section 25(1)(b)).',
      retentionPeriod: '12 months from rejection or 6 years if hired (statutory employment record).',
    },
    {
      id: 'careers-talent-pool',
      name: 'Talent pool — retained for future roles',
      lawfulBasis: 'legitimate_interests',
      lawfulBasisJustification:
        'Maintain a pool of pre-screened candidates for future roles. LIA: balance between recruiter efficiency and applicant expectation. Applicants opted-in to inclusion.',
      retentionPeriod: '24 months from last application activity.',
    },
  ]}
/>

Retention policy

  • Successful candidate: CV + interview notes become employment records, retained for at least 6 years post-employment (Labour Act + Tax obligations).
  • Rejected applicant, no talent-pool opt-in: delete CV + notes within 6 months of the role closing. Section 24(1)(e) — storage limitation.
  • Rejected applicant, talent-pool opt-in: keep up to 24 months, then ask for refresh consent before extending.

Right to erasure (Section 34(1)(d))

When a rejected applicant requests erasure, you must comply unless you have an active legal claim (e.g. an ongoing discrimination complaint). The DSR portal handles this:

'use client';
import { NDPRSubjectRights } from '@tantainnovative/ndpr-toolkit/presets/dsr';

// Public-facing DSR portal for applicants
export default function ApplicantRightsPortal() {
  return (
    <NDPRSubjectRights
      submitTo="/api/applicants/dsr"
      submitOptions={{ credentials: 'same-origin' }}
      onSubmitError={({ error, response }) => {
        console.error('DSR submit failed', error, response?.status);
        alert('Submission failed. Please email dpo@example.com directly.');
      }}
    />
  );
}

Automated CV screening (Section 37)

If you use any ATS (Applicant Tracking System) with automated CV scoring, keyword filtering, or AI-based shortlisting, Section 37 kicks in. You must:

  • Disclose the automated processing exists (in your careers privacy notice)
  • Explain "meaningful information about the logic involved" — what factors it weighs
  • Provide a human-review path before any adverse decision (rejection)
  • Offer the right to contest the decision

A short careers-page disclosure is enough:

<aside className="rounded border border-amber-200 bg-amber-50 p-3 text-sm text-amber-900 mb-6">
  <strong>Automated screening notice (NDPA Section 37).</strong> We use an
  ATS that performs keyword matching on submitted CVs to surface candidates
  whose experience aligns with the role requirements. Final shortlist
  decisions are made by our recruiting team, not by the ATS. If you'd
  prefer manual review without automated pre-screening, mention this in
  your cover letter or email{' '}
  <a href="mailto:talent@example.com" className="underline">talent@example.com</a>.
</aside>

Related