Note: In order to utilize Greenhouse Recruiting's built-in request consent functionality, your organization will need to have selected explicit consent as the legal basis for your GDPR configuration.
If your organization changes to a legal basis of explicit consent for GDPR, you will need to request consent from any candidate and / or prospect who existed in your account prior to the edit.
In this article, we will cover how to request consent from a single candidate to collect, store, and process their data.
To request consent from a candidate, click Candidates on your navigation bar.
From the All Candidates page, expand Profile Details on the left.
Navigate to GDPR Status and select Consent not requested from the dropdown menu.
The list of candidates will be filtered to only individuals who have not yet given consent to have their data collected, stored, and processed.
Select a candidate or prospect from the list.
A banner on the candidate's profile will notify you of the candidate's consent status. Click Request Consent.
An email requesting consent will be sent to all candidates included in the bulk action.
Candidates and/or prospects will have 30 days to either give or deny consent. This window of time is non-editable.
Note: For candidates with an active consent request, it's possible to resend your GDPR consent request email to a candidate. Resending GDPR consent request emails can serve to remind candidates to review your organization's GDPR policy and to consent or decline an active consent request. To learn how to resend active consent requests, read more here.
You can refer to the table below for an overview of how consent will impact an individual candidate's profile:
| Scenario | Action |
| Gives consent | Your organization can retain the candidate's or prospect's data in accordance with your organization's data retention rules. |
| Denies consent | The candidate or prospect will be immediately queued to have their data deleted from your account. |
| Does not respond | The candidate or prospect will have 30 days to respond to the consent request email. If the candidate or prospect does not respond in 30 days, they will be queued to have their data deleted from your account. |