General Data Protection Regulation (GDPR) requires recruitment agencies to have a privacy policy notice outlining the purpose and legal basis for processing candidate application data, as well as data retention periods, accessible on its website. The ICO can take action against organisations and individuals that collect, use and retain personal information. This includes criminal prosecution, enforcement, audit and the power to impose a monetary penalty on a data-controller of up to £500,000.