Recruitment outreach and data rules

Recruitment firms run two different kinds of outreach under two different rule sets: business development to potential client companies, and sourcing outreach to candidates. In the UK, cold email to corporate subscribers for client BD is generally permitted under PECR, provided you identify yourself and offer a clear opt-out, with UK GDPR's legitimate interest basis doing the data-protection work. Candidate outreach is the heavier case, because you are processing an individual's personal data for your own commercial purpose — it is workable, but it demands more care. This is a practical summary, not legal advice.

Why do recruiters get this wrong more than other firms?

Because the same consultant, often in the same afternoon, emails a hiring manager to win a role and messages a candidate to fill one, and the two actions feel identical. They are not. The client-side email is B2B marketing to a corporate subscriber; the candidate message is processing of an individual's personal data — employment history, contact details, sometimes inferred sensitive information — where the individual's rights weigh more heavily. Recruitment is also unusually exposed: the sector holds large volumes of candidate data, and the pipeline pattern described in Growth Systems by Industry: the UK B2B service firm map — feast-and-famine BD driven by whoever has spare time — encourages exactly the kind of hasty list-blasting that causes complaints.

What do the rules actually say for client BD?

For emailing companies to win vacancies, the position is comparatively clean, and it is the same one that governs all UK B2B cold email, covered in depth in The Complete UK B2B Outbound Playbook:

• PECR distinguishes corporate subscribers (limited companies, LLPs) from individual subscribers (sole traders, partnerships in most of the UK). Cold email to corporate subscribers is permitted; you must say who you are and provide a working opt-out. Sole traders are treated like consumers, so exclude them.
• UK GDPR still applies to the individual's work email address as personal data. Legitimate interest is the commonly used lawful basis: document the balancing test, keep the targeting relevant, honour objections immediately.
• Practice. Suppress opt-outs permanently, keep volumes sane, and make the relevance obvious — a recruiter emailing engineering leads about engineering hires is an easy legitimate-interest story; a scattergun blast is not.

How is candidate outreach different?

Candidates are individuals, so the data-protection duties bite harder. The commonly accepted approach, hedged appropriately:

• Lawful basis. Most recruiters rely on legitimate interest for initial sourcing contact — a candidate with a public professional profile can reasonably expect relevant approaches. The expectation weakens fast when the role is irrelevant or the data was scraped from somewhere non-professional.
• Transparency. UK GDPR expects you to tell people you hold their data — typically within a month, or at first contact — including where you got it. A sourcing message that says which platform you found them on is both compliant practice and better copy.
• Data quality and retention. Old CVs are a liability. Holding candidate data indefinitely "in case" is difficult to defend; define retention periods and honour deletion requests without friction.
• Channel rules. PECR's marketing rules apply to electronic messages promoting your services; a genuinely individual approach about a specific role is usually treated differently from a bulk "register with us" campaign. The bulkier and more promotional the send, the more it looks like marketing and the more the stricter reading applies.

What does a compliant recruitment outbound system look like?

The mechanism, step by step:

1. Split the pipelines. When client BD and candidate sourcing share one tool and one list, then rule sets blur; run them as separate systems with separate templates and separate suppression lists.
2. Build the client list from corporate subscribers only. When a record is a sole trader or a personal address, then it is excluded at the build stage — the list construction discipline in selling an agency without case studies applies here unchanged: precision is the asset.
3. Document the legitimate interest assessment once per campaign type. When a complaint or an ICO question arrives, then a dated document exists; this is a one-hour job, not a legal project.
4. Encode identification and opt-out into templates. When every send carries firm name, sender identity and an opt-out line by default, then compliance stops depending on individual consultants remembering.
5. Wire the opt-out to permanent suppression. When someone objects, then they never hear from you again — automatically, not via a sticky note.
6. Set retention rules in the CRM. When a candidate record passes its retention date without activity, then it is flagged for deletion rather than hoarded.

Does compliance cost you response rate?

In our experience, no — it correlates with better results, because the same disciplines that satisfy the rules improve the outreach. Tight targeting, honest identification, relevance you can defend and low daily volumes are what make cold outreach land in the first place. Firms whose BD depends entirely on one rainmaker's network — the pattern examined in the consultant's personal brand as pipeline — often assume compliance is the barrier to switching on outbound. It is not. The barrier is the absence of a system, and the rules above are simply part of that system's specification.

---

Next step: the Growth System Audit — £450, seven days, credited against any build — maps where your growth system leaks and what to build first.