To share candidate profiles with employers anonymously, send only what the employer needs to decide on an interview, remove the name, contact details and other identifying details, and use a secure link rather than an attachment. Tell applicants beforehand that employers may see their details, keep a record of each profile you send, and confirm your approach with your data protection officer.
Providers shortlist so employers see suitable applicants first
In the apprenticeship service, an employer can give a training provider the “Recruit apprentices” permission. The provider can then advertise apprenticeships and review applications for that employer. The apprentice needs a contract of employment with the employer, so the employer makes the final choice.
A shortlist lets the employer compare a few suitable applicants in the same format, without reading every application. The Information Commissioner’s Office (ICO) asks employers and recruiters to shortlist fairly and consistently, for example against set criteria. It also says candidates should know those criteria before they apply, for example from the advert or application form.
Much of the ICO guidance in this guide comes from its draft guidance on recruitment and selection. The ICO says that guidance is under review after the Data (Use and Access) Act 2025, so check it for updates.
A profile should hold only what the employer needs now
The UK General Data Protection Regulation (UK GDPR) requires personal data to be adequate, relevant and limited to what is necessary. The ICO’s draft guidance applies this to recruiters directly. It says they must limit what they disclose to an employer to what is relevant to the decision at that stage.
| Detail | At shortlisting | Why |
|---|---|---|
| Qualifications the job asks for, including English and maths | Include | Shows whether the applicant meets the entry requirements |
| Work experience and a short supporting statement | Include | Shows interest and readiness |
| Availability and earliest start date | Include | Lets the employer plan |
| How the applicant would travel to the workplace | Include, without the home address | Shows the job is practical to reach |
| Your notes against the job criteria | Include | Explains why you shortlisted the applicant |
| Name, email address, phone number and home address | Leave out until the employer asks to interview | Not needed to choose who to interview |
| Date of birth and photograph | Leave out | Can identify the applicant and rarely helps at this stage |
| Equality monitoring answers | Leave out | The ICO gives removing them before shortlisting as an example |
| Health or disability details | Leave out; share only any interview adjustment needed | Special category data needs extra protection |
| Unique Learner Number and Learning Records Service results | Leave out | Learner records carry their own sharing rules |
One rule is specific to apprenticeships. The Learning Records Service (LRS) user guide says never to send a Unique Learner Number (ULN) in an unencrypted email with any of five details: given name, family name, date of birth, gender or postcode.
Anonymous profiles reduce bias, but they remain personal data
Anonymous profiles hide details that could sway a decision without bearing on the job. The ICO’s draft guidance says pseudonymisation can be an effective way to avoid bias and keep irrelevant information from decision-makers. Its example gives each candidate a reference number, and staff remove names, contact details and equality information before shortlisting.
The ICO adds that if a candidate has not been told who the employer is, a recruiter should send that employer only anonymised information.
An anonymous profile is usually pseudonymised, not anonymous in the legal sense. The ICO says pseudonymised data is still personal data for anyone who holds the extra information that identifies the person, and that includes you. It may be anonymous in the employer’s hands, but only if the employer cannot identify the applicant. A school, a former employer or a home town can still point to one person.
So treat anonymous profiles with the same care as named ones. Give each a reference number, so that feedback reaches the right applicant.
Data protection rules apply from the first profile you send
This section summarises ICO guidance. It is not legal advice, so confirm your approach with your data protection officer.
Agree who is controller for each use
The ICO says organisations that recruit together must be clear who is responsible for data protection. Each should assess and document whether it is a controller, a joint controller or a processor. It adds that recruiters are likely to be controllers in most circumstances. An employer is typically a controller, because it decides what candidate information it needs and how it uses it.
A recruiter that uses candidate information for its own purposes is a controller for that use, and for a provider that can include enrolment. Joint controllers need a transparent arrangement setting out their roles. A processor needs a binding written contract.
Choose and record a lawful basis
UK GDPR offers seven lawful bases. You must choose one before you start and document it. The ICO’s draft guidance says legitimate interests is likely to be relevant in many recruitment contexts, including shortlisting. A public authority, however, cannot rely on legitimate interests for its official tasks. Special category data, such as health details, needs an extra condition as well.
Tell applicants before you share
Applicants have the right to be informed. Your privacy information must cover your purposes, how long you keep their details and who you share them with. Give it when you collect the details, for example on the application form.
A recruiter acting for an employer must also tell candidates which employer will see their details. The ICO’s draft guidance says this must happen as soon as reasonably practicable, and at the latest when the employer first receives the details.
Send profiles by secure link, not attachment
The ICO expects appropriate security for candidate information, with access limited to staff who need it. Its encryption guidance describes a council fined £120,000, under the previous data protection law, after several misdirected emails. In one, an unencrypted file of special category data went to the wrong address, so everyone who received it could read it.
A secure link keeps the profile on your system. When the page is served over HTTPS, its content is encrypted between your server and the employer’s browser. Depending on your system, you may also see when it was opened and withdraw access later. An attachment is a copy that stays in the recipient’s inbox.
Set retention periods for you and the employer
UK GDPR says you must not keep personal data longer than you need it. The ICO expects a policy with standard retention periods wherever possible. Its draft recruitment guidance notes that the law sets no fixed period for recruitment records, and suggests weighing how long candidates have to bring a claim.
Ask employers to delete profiles of applicants they do not take forward. The ICO’s draft guidance says an employer that receives a candidate’s details, but does not wish to consider them, must delete them as soon as possible.
Employer feedback and interview requests should come back through you
- Ask employers for feedback against the criteria you used to shortlist.
- Give them one place to reply, such as a form on the profile page, rather than separate emails.
- When an employer asks to interview, tell the applicant which employer it is before you share their name and contact details.
- Book the interview, and confirm the time, place and any adjustments with both sides.
- Tell each applicant the outcome, with any useful feedback.
Feedback about an applicant is personal data about them. The ICO notes that candidates can make a subject access request for information recorded at interview, such as interview notes. Ask employers to keep feedback factual and related to the job.
A record of each profile shows what you shared
The ICO’s data sharing code says organisations should document any data sharing and review it regularly, even if they are not large enough to need formal records of processing. A record also helps you answer a subject access request or a complaint. For each profile, record the applicant, the employer contact, the date, the details shown and whether it was anonymous. Add the feedback, the outcome and when the employer was asked to delete it.
Check these points before you send a profile
| Check | Why it matters |
|---|---|
| Applicants were told that employers may see their details | Right to be informed |
| Your lawful basis is chosen and recorded | Required before you start |
| Your role and the employer’s are agreed and documented | Controller, joint controller or processor |
| The profile holds only details relevant to this decision | Data minimisation |
| Identifying details are hidden if the applicant does not yet know the employer | ICO draft guidance on anonymised information |
| No Unique Learner Number appears alongside personal details | LRS rules on emailing learner data |
| The profile goes by secure link to the right contact | Security |
| The employer knows how long it may keep the profile | Storage limitation |
| The profile and any feedback are recorded | Accountability |
enrola lets you choose what each profile shows
In enrola, you choose which fields an applicant profile shows to employers. Profiles can be shared one at a time with any email address, or sent in bulk to a Contact at the Opportunity’s Employer, and shared profiles and their emails do not name the vacancy or its employer.
You can also hide the applicant’s name, personal details or contact details when you share a profile, and shared links stop working after 30 days.
Employers open the profile from a link sent by email, without an enrola login, and send feedback, including an interview request. Sending a profile moves the Application to Profile sent, and employer feedback notifies the Supervisor.
Questions
Is an anonymous applicant profile still personal data?
Yes, for you. The ICO says pseudonymised data is personal data for anyone who holds the extra information that identifies the person. It may be anonymous in the employer’s hands only if the employer cannot identify the applicant.
Do we need an applicant’s consent to share their profile?
Not necessarily. Consent is one of seven lawful bases, and the ICO’s draft guidance says legitimate interests is likely to be relevant in many recruitment contexts. Your data protection officer should confirm and record the basis you use.
Should we email applicant profiles as attachments?
A secure link is safer. An attachment sent to the wrong address can be read by whoever receives it, and it stays in their inbox.
When must applicants learn which employer will see their details?
As soon as reasonably practicable, and at the latest when the employer first receives their details, according to the ICO’s draft guidance. Until then, send only anonymised information.
Sources
- ICO: Employment practices and data protection, recruitment and selection, draft under review.
- ICO draft: Data protection and recruitment.
- ICO draft: Responsibility during the recruitment process.
- ICO draft: Shortlisting, testing and interviewing candidates.
- ICO draft: Keeping recruitment records.
- ICO: A guide to lawful basis.
- ICO: Right to be informed.
- ICO: Data minimisation.
- ICO: Storage limitation.
- ICO: Pseudonymisation.
- ICO: Encryption scenarios.
- ICO: Encryption and data transfer.
- ICO: Data sharing code of practice, accountability.
- Apprenticeship service help centre: Set training provider permissions.
- Department for Education: Apprenticeship funding rules 2026 to 2027, version 3, paragraph P69.
- GOV.UK: Using the Learning Records Service for learning providers, sections 3 to 3.2.