Privacy Notice for Applicants
A privacy notice for applicants is a written disclosure you must give candidates—either in your job posting, application form, or at first contact—explaining how you handle their personal data. It covers what data you collect, why, how long you keep it, and their rights under the revised Federal Data Protection Act (revDSG). Swiss employers must provide this before or when collecting applicant information.
When you advertise a job or receive an application, you start collecting personal data: CV, contact details, references, sometimes psychometric test results. The revised Data Protection Act (revDSG), in force since 1 September 2023, requires you to tell applicants transparently what you do with their information.
A privacy notice is not optional—it is a legal obligation whenever you process applicant data. It protects both candidates and your company by establishing clear expectations about data handling and demonstrating good faith compliance.
When You Must Provide a Privacy Notice
Provide the notice at the earliest point of contact. This means on your job posting page, in the application form itself, or in a covering email when you first request information from a candidate.
You must do this before or at the moment of data collection—not after someone has already applied. If you collect CVs via email without a prior notice, add the notice to your response email, but best practice is earlier.
- Include it whenever you post a vacancy (on your website, LinkedIn, or a job board).
- Repeat it in your online application form or downloadable application pack.
- Add it to the first email where you ask for a CV or supporting documents.
- Keep a record showing when and how you provided it.
- Use clear, plain language—jargon deters applicants from reading it.
- Make it accessible (font size, contrast, mobile-friendly if online).
What Your Privacy Notice Must Include
The revDSG requires specific content: who you are (company name and contact); what data you collect and why; how long you keep it; and applicants' rights to access, correct, or delete their information.
You must also name any third parties you share data with—recruitment software vendors, background-check providers, or reference checkers—and confirm compliance with Swiss data protection law.
- Your company name, address, and a contact person (often the hiring manager or office manager).
- The purpose of processing (assessing fit for the role, verifying qualifications, compliance with labour law).
- Categories of data collected (CV, cover letter, test scores, references, interview notes).
- Retention period (typically three months to one year after hiring decision, longer if hired).
- Applicant rights: access to their data, correction, deletion (right to be forgotten), and how to exercise them.
- Names of any external processors (e.g., zenRecruiting.ai, background-check firms, language-test providers).
Common Mistakes and Best Practice
The most common error is silence: many SMEs collect CVs without any privacy notice at all, leaving candidates in the dark. This is non-compliant and erodes trust. A second mistake is burying the notice in an 18-point footnote—unreadable notices do not meet the transparency requirement in spirit or law.
Best practice: write a short, friendly notice (200–300 words) and place it prominently. Review it annually, and update it if your data practices change (e.g., you start using a new testing tool or send data to a recruiter in another canton).
- Do not assume applicants have 'implicitly consented' by applying—explicit notice is the legal requirement.
- Do not collect data you do not need (e.g., asking for a photograph if the role is not appearance-sensitive adds complexity without clear purpose).
- Do not keep CVs indefinitely; document your retention policy (e.g., delete after one year if not hired).
- Do not forget to update the notice if you hire a recruitment agency or use new software.
- Test readability: ask a colleague to skim it in 30 seconds and explain what happens to their data.
- Consult a lawyer if you operate in multiple cantons or collect sensitive data (health, criminal record checks).
Frequently asked questions
- Can I rely on the privacy policy of the job board where I post the vacancy?
- No. The job board's privacy policy covers how *they* handle data, not how *you* do. You must still provide your own notice explaining your process: how long you retain CVs, who on your team sees them, whether you use screening software, and applicants' rights to contact you directly.
- What is the difference between a privacy notice and a privacy policy?
- A privacy notice for applicants is specific to recruitment and covers only the data you collect during hiring. A broader privacy policy applies to all data you handle (website visitors, customers, employees). Many employers have both—the notice is a simplified, job-focused version.
- Do I need consent to keep an applicant's CV on file for future roles?
- You need either explicit consent or a clear statement in your notice that you retain CVs for future vacancies (and for how long). Many Swiss SMEs keep promising candidates' CVs for 6–12 months. Tell them this up front; do not surprise them later. If you do not have documented consent and you contact them six months later, you risk a complaint.
General information for Swiss employers, not legal advice. Have a lawyer confirm anything with legal consequences.