Privacy Rules For Recruitment Agencies Using AI

Yes, recruitment agencies in New Zealand can use AI screening and automation tools, but you need to handle candidate information carefully under the Privacy Act 2020.

The more nuanced part is that AI doesn't get a free pass just because it's software. If your tool collects CVs, ranks candidates, analyses interviews, matches people to jobs or stores candidate profiles, your agency is still responsible for how that information is collected, used, disclosed, secured and deleted.

This doesn't have to be complicated. The aim is to be clear with candidates, choose vendors carefully, and keep a human layer over decisions that affect someone's job prospects.

Can Recruitment Agencies Use AI To Screen Candidates?

Yes, you can use AI hiring tools in New Zealand, provided your use of them complies with privacy, employment and anti-discrimination laws.

AI tools are commonly used by recruitment agencies to:

• parse CVs and extract key details
• match candidates to role requirements
• rank applications for consultant review
• draft candidate summaries
• schedule interviews and automate communications
• run skills assessments or psychometric-style testing

The legal issue isn't usually the fact that you're using AI. The issue is whether you're using it fairly, transparently and for a proper business purpose.

For example, say Aroha runs a recruitment agency in Wellington. She starts using an offshore AI platform that reads CVs and gives each candidate a suitability score. If Aroha tells candidates their CV will be assessed using automated tools, checks that the platform is secure, limits the data uploaded, and keeps a consultant involved in final decisions, she is in a much stronger position.

If she uploads old candidate data without telling people, lets the vendor use CVs to train its own model, and rejects candidates purely because the system gives them a low score, the privacy and fairness risks are much higher.

What Does The Privacy Act 2020 Require?

The Privacy Act 2020 requires you to collect, use, store and share candidate information in a way that's lawful, fair and transparent.

The Act is built around Information Privacy Principles, often called IPPs. For recruitment agencies using AI, the most relevant principles are usually:

• Purpose and necessity: only collect personal information that's needed for your recruitment services.
• Direct collection: collect information from the candidate directly where it's reasonable to do so.
• Notice: tell candidates what you collect, why you collect it, who you may share it with, and what happens if they don't provide it.
• Security: protect candidate information from unauthorised access, loss or misuse.
• Access and correction: let candidates request access to their information and ask for corrections.
• Use and disclosure limits: use and share information only for the purposes you told candidates about, unless another legal exception applies.
• Retention: don't keep candidate information for longer than you have a lawful purpose to keep it.
• Overseas disclosure: take care when sending candidate data to overseas vendors or cloud platforms.

AI often touches several of these at once. A CV scoring tool might involve collecting extra information, sending it to an overseas platform, creating a new profile about the candidate, and using that profile to decide whether to put them forward for a role.

That means your privacy setup shouldn't be limited to a generic privacy policy on your website. You need to look at the real candidate journey, from application through to placement, talent pooling and deletion.

Do You Need Candidate Consent To Use AI Hiring Tools?

It depends, because the Privacy Act 2020 doesn't require consent for every use of personal information, but consent can be important where your AI use is unexpected, sensitive or optional.

For standard recruitment processing, you may be able to rely on clear privacy notices rather than a separate tick-box consent. For example, if a candidate applies through your portal and you clearly tell them that automated matching tools will help assess their application, that may be enough for ordinary CV parsing and role matching.

Consent becomes more important where you're doing something candidates wouldn't reasonably expect, such as:

• analysing recorded video interviews for behavioural or facial cues
• using personality, psychometric or cognitive testing tools
• scraping public social media profiles and adding them to candidate records
• sharing candidate data with a vendor that may use it to improve or train its own AI models
• keeping candidate data in a talent pool long after a specific role has closed
• collecting health, disability, criminal history or other sensitive information

Consent should be specific, easy to understand and recorded in a short privacy consent form where appropriate. A broad clause saying the candidate agrees to all future technology use is unlikely to give your business much practical protection.

What Should Good Consent Look Like?

Good consent is usually:

• informed: the candidate knows what they're agreeing to
• specific: it relates to a clear use, tool or process
• voluntary: the candidate isn't pressured into saying yes to something unnecessary
• recorded: you can show when and how consent was given
• reviewable: you have a process if the candidate changes their mind

You also need to be careful not to treat consent as a cure-all. If the data isn't reasonably necessary for your recruitment service, asking for consent may not fix the problem.

What Should Your Recruitment Agency Privacy Policy Say?

Your recruitment agency privacy policy should clearly explain how you collect, use, share, store and retain candidate data, including where AI or automated tools are part of your process.

A useful privacy policy for a recruitment agency in New Zealand will usually cover:

• what personal information you collect from candidates
• whether you collect information from referees, employers, public sources or third-party platforms
• why you collect candidate information
• how AI tools or automated screening may be used
• whether candidates may be profiled, scored, ranked or matched to roles
• who you share information with, such as clients, background check providers, payroll providers or software vendors
• whether candidate data may be stored or accessed overseas
• how long you keep candidate data
• how candidates can request access or correction
• how candidates can contact you about privacy concerns

Your policy should match what you actually do. If your agency uses an AI tool to shortlist candidates, don't hide that under vague wording about improving services. Plain language builds trust and reduces the chance of a privacy complaint.

Templates can be a helpful starting point, but recruitment privacy policies often need tailoring because agencies handle more data than many other businesses. You may be collecting employment history, referee details, salary expectations, work rights information, identity documents, test results and interview notes. A generic policy may miss how these pieces fit together.

Do You Need A Separate Candidate Notice?

Often, yes. A short candidate collection notice can work alongside your full privacy policy.

This notice can appear when candidates apply, create an account, complete a skills test or join your talent pool. It should tell them, in a direct way:

• what information you're collecting at that step
• why you need it
• whether an AI tool will help process it
• who it may be shared with
• where they can read the full privacy policy

This is especially useful where candidates are moving quickly through an online application process and may not stop to read a long website policy.

What Should You Check In Your AI Vendor Contracts?

You should check that your AI vendor contract gives your agency enough control over candidate data and enough protection if something goes wrong.

If you use a third-party AI platform, you're still responsible for your privacy obligations to candidates. The vendor may be hosting, analysing or storing the data, but the candidate relationship is usually with your agency.

Before you upload candidate data, check whether the contract deals with:

• Purpose limits: the vendor can only use candidate data to provide the agreed services.
• AI training: the vendor can't use candidate data to train or improve its wider models unless you have clearly agreed and disclosed this.
• Security: the vendor must use appropriate technical and organisational security measures and follow an information security policy.
• Subcontractors: you know if other providers can access the data.
• Overseas storage: you know where data is hosted and accessed from.
• Privacy breach notice: the vendor must tell you promptly if there's a suspected or actual data breach.
• Access and correction support: the vendor can help you respond to candidate requests.
• Deletion or return: candidate data can be deleted or returned when the contract ends.
• Audit or reporting: you can get enough information to check the vendor is meeting its obligations.
• Confidentiality: candidate information and client information are protected.

Be cautious with free or low-cost AI tools where the terms say uploaded content may be used to train the provider's systems. A consultant pasting CVs, referee comments or interview notes into a public AI tool can create serious confidentiality and privacy issues.

The Fair Trading Act 1986 can also matter if you repeat vendor claims to clients or candidates. If a tool is marketed as bias-free, fully accurate or compliant, don't assume that's true. Ask what the tool actually does and avoid making claims you can't back up.

How Should You Handle Candidate Access, Correction And Retention?

You should have a simple internal process for candidate access requests, correction requests and a data retention policy, because these rights still apply when AI tools are involved.

Under the Privacy Act 2020, candidates can ask to access personal information you hold about them. They can also ask you to correct it. If your AI tool creates scores, summaries, tags or profile notes about a candidate, those outputs may be personal information too.

This doesn't mean you must hand over every internal business record in every case. There can be grounds to withhold some information, depending on the circumstances. But you shouldn't assume AI-generated material sits outside the Privacy Act.

Practical Steps For Access And Correction

Your agency should decide who will handle privacy requests before one arrives. A practical process might include:

• confirming the candidate's identity before releasing information
• checking all systems where candidate data may sit
• reviewing AI-generated notes, scores and summaries
• deciding whether any withholding ground applies
• correcting inaccurate information where appropriate
• recording what was provided, corrected or declined

For retention, avoid keeping candidate data forever just because storage is cheap. If a candidate applied for one role five years ago and hasn't agreed to remain in your database, you should consider whether there's still a proper reason to keep their information.

You may want different retention periods for different records. For example, an active candidate profile may be kept while the person is looking for work, while identity checks, interview notes or assessment outputs may need shorter retention. The right period depends on your services, client requirements and risk profile.

What Are The Main Risks With AI Recruitment Privacy In New Zealand?

The main risks are lack of transparency, excessive data collection, overseas disclosure problems, security gaps and unfair automated decision-making.

These risks can lead to complaints to the Office of the Privacy Commissioner, loss of candidate trust, client concerns and messy internal clean-up. If there's a privacy breach that's likely to cause serious harm, you may need to notify the Privacy Commissioner and affected individuals as soon as practicable.

There are also broader hiring risks. If an AI tool screens out candidates in a way that disadvantages people because of protected characteristics such as age, disability, ethnicity, sex, pregnancy or family status, you could face discrimination concerns under laws such as the Human Rights Act 1993.

That's why a human review step is sensible. AI can help you process information, but your agency should be able to explain why a candidate was shortlisted, rejected or put forward.

Common Mistakes To Avoid

• using AI tools before checking where candidate data goes
• copying CVs or interview notes into public AI platforms
• using vague privacy wording that never mentions automation
• letting AI make final hiring or shortlisting decisions without review
• keeping unsuccessful candidate data indefinitely
• collecting sensitive information earlier than needed
• assuming an offshore vendor's privacy terms are enough for New Zealand law
• forgetting to train consultants on what they can and can't upload

An AI governance policy can become a big topic quickly, but your first layer doesn't need to be technical. Start with the candidate information you collect, the tools you use, the vendors that receive data, and the decisions affected by automation.

Key Takeaways

• Recruitment agencies in New Zealand can use AI hiring tools, but the Privacy Act 2020 still applies to candidate data.
• You should tell candidates when AI or automated tools are used to screen, rank, match or profile them.
• Consent isn't always required, but it's often needed for unexpected, sensitive or optional uses of candidate information.
• Your privacy policy and candidate notices should match your real recruitment process, not just use generic wording.
• AI vendor contracts should deal clearly with data use, security, overseas storage, AI training, breach notice and deletion.
• Keep human oversight over screening decisions, especially where an AI tool could affect someone's job opportunities.

If you'd like help with your recruitment privacy policy, candidate consent wording, AI vendor contracts and internal hiring procedures, you can reach us at 0800 002 184 or team@sprintlaw.co.nz for a free, no-obligations chat.