Candidate Outreach
Candidate outreach (Kandidatenansprache) is when you contact someone directly to recruit them, rather than waiting for applications. It triggers data protection duties under revDSG and must comply with Swiss telecom rules. Your main obligation is transparent consent and the right to opt out.
Candidate outreach means you contact a person directly—by phone, email, LinkedIn, or in person—to invite them to apply or discuss a role. This is distinct from passive recruitment (posting a job ad and waiting). It's standard in Swiss recruiting, especially for specialist roles.
Outreach happens most often when you're filling urgent Pensum gaps, recruiting in tight labour markets (tech, healthcare), or headhunting specific profiles. It also applies if you contact candidates from job boards, industry events, or employee referrals.
When outreach triggers obligations
Every time you initiate contact with a named individual to discuss employment, you're processing personal data. This triggers the Federal Data Protection Act (revDSG). You must have a lawful basis—usually their consent or a legitimate interest—and be transparent about why you're contacting them.
If you use a recruiter or agency, they act as your processor under revDSG. Check their data handling. If you're contacting candidates via unsolicited phone or email in Switzerland, telecom rules (SR 784.10) also apply: avoid harassment, respect Do Not Call lists if they exist, and provide a clear way to opt out.
- You must identify yourself and your company clearly in every outreach message.
- Provide the candidate with a simple way to withdraw consent or ask you to stop contacting them.
- Keep records of who you've contacted and when, in case of disputes.
- If using third-party data (LinkedIn, job boards, alumni networks), verify it's recent and accurate.
- Do not share candidate data with other employers without explicit consent.
- Store contact details securely and delete them if the candidate opts out.
Your main obligations
Under revDSG, you must tell candidates why you're reaching out, what you'll do with their data, and how long you'll keep it. A brief, honest message—'We saw your profile and think you'd suit our senior developer role at our Zurich office'—satisfies transparency. You don't need a formal form, but you do need clarity.
If a candidate says no, stop immediately. Repeated contact after rejection is not only poor practice—it risks violating both data protection and harassment rules. Some cantons (notably Zurich, Geneva, Basel) have stricter telecom rules; check your local regulator if you're doing large-scale outreach.
- Inform candidates of the purpose (recruitment) and data retention period (typically 6–12 months for unsuccessful candidates).
- Get consent before storing their data in your HR system—don't assume permission to contact means permission to file indefinitely.
- If the candidate is employed elsewhere, respect their privacy; avoid contacting them at their current employer without good reason.
- Test your outreach script with a lawyer if you're hiring externally at scale; telecom and privacy rules vary slightly by canton.
- Update your privacy notice (on your website or in your recruiting materials) to mention outreach, not just job applications.
- Keep a log of opt-outs and honour them across all future campaigns.
The most common mistake
The biggest error is treating outreach data casually. Many SMEs collect candidate contact details from LinkedIn, local networks, or job boards, then keep those details in spreadsheets or email lists for months without clear consent or retention rules. This violates revDSG and creates liability.
A second common trap: continuing to contact someone after they've said no. Even one follow-up email after rejection can escalate to a complaint. Document the candidate's opt-out and ensure it's shared with anyone else in your hiring process. If you use an agency or recruiter, make sure they respect your opt-out list.
- Do not assume that finding someone's LinkedIn profile or email gives you permission to contact them repeatedly.
- Do not store candidate data longer than necessary—set a deletion policy (e.g., 12 months after rejection) and stick to it.
- Do not reuse old candidate lists without fresh consent, even if you approached them a year ago.
- Do not contact a candidate via multiple channels simultaneously without clear communication about which method they prefer.
- Do not share candidate data with your recruiting agency without a data-processing agreement (Auftragsverarbeitung).
- Do not ignore a candidate's request to be removed; treat it as binding immediately.
Frequently asked questions
- Do I need written consent every time I contact a candidate?
- No. A clear, transparent message that explains who you are and why you're contacting them usually suffices under revDSG. However, if you plan to add them to a database or contact them repeatedly, you should get explicit consent. Document the method of consent (email, phone, form) so you can prove it if needed.
- What's the difference between outreach and cold-calling?
- Outreach is targeted contact about a specific role or company. Cold-calling implies mass unsolicited calls with no clear purpose. In Switzerland, repeated cold-calling without consent risks violating telecom rules (SR 784.10). Always identify yourself, your company, and the reason for contact. Offer a clear opt-out immediately.
- Can I hire a recruiter to do outreach on my behalf?
- Yes, but you remain responsible for compliance. You must sign a data-processing agreement (Auftragsverarbeitung, per revDSG Art. 28) with the recruiter, defining what data they use, how long they keep it, and how they handle opt-outs. Ensure your agency respects your Do Not Call list and deletes data on schedule.
General information for Swiss employers, not legal advice. Have a lawyer confirm anything with legal consequences.