Understanding the difference between Data compliance and GDPR settings

Included at the bottom of the application.

Customizable for storage purposes only. 

Lawful basis: Candidate/Explicit Consent 

With the 2023 Fall update, ‘Candidate Consent’ will be called ‘Explicit Consent.’ This aligns with the legal terminology that is commonly used and is more reflective of what is being asked of the candidate.

Candidates do not have the opportunity to consent to storage. The only way to revoke storage consent is be sent an email through the Lever system (consent link), and update their preferences in the data-requests tab (submit a request for removal).

If Explicit Consent is enabled for storage, the associated checkbox will be required to submit the application.

This is because the basis behind using Explicit Consent is that in order to legally store and process the candidate’s data, you must obtain their clear, explicit consent first.

The consent checkbox is required.

Candidates are prompted to provide or revoke consent for marketing and storage collectively. Both their marketing and storage consents are updated and kept in sync.

The two types of consent are differentiated in the text that prompts the candidate to provide consent, but the consent types cannot be updated separately.

The consent checkbox is optional.

Candidates can provide consent for marketing.

The consent checkbox is optional.

Included at the bottom of the application.

Customizable for storage AND for future job opportunity (marketing) purposes. 

Via a candidate's profile or pipeline bulk action by any user with access to the corresponding profile(s). The pipeline can be filtered for opportunities in need of anonymization based on consent status and the amount of time until anonymization is required.

See our help article on candidate anonymization for more detail.

Via a candidate's profile by any user with access to the corresponding profile(s). The pipeline can be filtered for opportunities in need of anonymization based on consent status and the amount of time until anonymization is required.

By Super Admins and Admins via the 'Candidate Data' tab on the Data compliance setting page.

Automatically, by configuring auto-anonymization under the appropriate policy on the Data compliance settings page.

See our help article on candidate anonymization for more detail.

Via a candidate's profile by any user with access to the corresponding profile(s). The pipeline cannot be filtered for opportunities in need of anonymization based on consent status and the amount of time until anonymization is required.

By Super Admins and Admins via the 'Candidate Data' tab on the Data compliance setting page.

See our help article on candidate anonymization for more detail.

All personally identifiable candidate data fields will be anonymized on the frontend of the system

Only those fields selected for anonymization as per the country-specific configuration will be anonymized on the backend of the system.

One for Legitimate interest, two for Candidate Consent.

Retention period for Candidate Consent / Explicit Consent

Starts when the candidate enters the system. This means it is possible for a candidate's consent to expire before their opportunity is archived. If a candidate still has an active opportunity and their consent expires, they need to be anonymized until they are archived.

The Candidate Consent setting also enables you to set an additional retention period. This retention period is added on to the candidate’s original consent period if they have provided consent and it has not expired yet. Otherwise, the additional retention period functions the same as the Legitimate Interest retention period and begins upon archival.

Starts once the opportunity is archived meaning the opportunity will need to be anonymized X time period from when they were archived.

Starts once the opportunity is archived meaning the opportunity will need to be anonymized X time period from when they were archived.

If the store retention period is modified after candidates have already entered the Lever system, those candidates ARE affected.

i.e., if the storage time was set to 2 years and later gets extended to 3 years, candidates will be stored according to the updated policy of 3 years.

If the consent retention period is modified after candidates have already consented, those candidates ARE NOT affected. Historical candidates added before the Fall 2023 update ARE affected.

i.e., if a candidate consented to be contacted for 2 years and the company later changes their policy to 3 years, the candidate's consent will still expire after 2 years.

If a candidate applied under a Legitimate Interest policy, their retention period will match the current retention period for that policy. Those candidates ARE affected.

If the consent retention period is modified after candidates have already consented, those candidates ARE affected. This affects both marketing and store consent because the two are treated as the same under the compliance policy system.

i.e., if a candidate consented for 2 years and the company later changes their retention policy to 3 years, the candidate’s consent will be updated to expire according to the new 3 year policy. 

It is possible for a candidate’s data to be retained for longer than they had consented to, and for the candidate to be contacted past the period that they consented to.

If the marketing consent retention period is modified after candidates have already consented, those candidates are NOT affected.

i.e., if a candidate consented to be contacted for 2 years and the company later changes their policy to 3 years, the candidate's consent will still expire after 2 years.