Data Privacy and Compliance

ashby provides tools to help you maintain compliance with local and federal data privacy regulations when storing candidate data you can configure these tools in admin > data management > data privacy & compliance https //app ashbyhq com/admin/organizational settings/data compliance permissions & access only organization admins can configure data compliance rules in ashby see the table below for a full breakdown of access roles access role can configure rules? limited access ❌ agency users ❌ elevated access external recruiter (not linked to an agency) ❌ elevated access analyst ❌ elevated access hiring team member ❌ elevated access hiring manager ❌ elevated access admin ❌ elevated access admin (private) ❌ organization admin ✅ on the data privacy and compliance page, you have access to three tabs inactivity rules https //app ashbyhq com/admin/organizational settings/data compliance/inactivity consent rules https //app ashbyhq com/admin/organizational settings/data compliance/consent privacy & legal https //app ashbyhq com/admin/organizational settings/data compliance/settings the data privacy and compliance rule configuration page in ashby the inactivity rules tab is selected data compliance inactivity and consent rules you can use a combination of inactivity and consent based rules to put a flexible policy in place that helps you track which candidate data should be removed from your system inactivity rules inactivity rules are set based on when the candidate became inactive there are two types of rules inactive lead rule a rule that governs how long you should keep the data of lead candidates this is a retention rule for candidates that are seen as inactive because they have no applications or only have applications that are in lead stages the menu to edit an inactive lead rule inactive applicant rule a rule that governs how long you should keep the data of inactive candidates this is a retention rule for candidates who are seen as inactive because they only have applications in the archived stage the menu to edit an inactive applicant rule amending the default inactivity based rule after clicking on one of your default inactivity based rules, you can further configure it by updating basic information, such as adding an internal description for reference amending the retention period, which defines the time period after which the inactive lead or inactive applicant is marked as needing to be anonymized or deleted configuring a rule filter using the add field to match option to add fields and establish criteria candidates who meet the set criteria have the rule applied to them once you have reconfigured the rule, you have the option to re evaluate your inactivity or consent based rule for candidates matching your rule filters in the danger zone section click re evaluate x candidates to take this action re evaluating the rule for candidates does not delete or anonymize candidates automatically it only flags those in violation of your configured rule creating an additional inactivity based rule you can create additional inactive lead and inactive application rules these allow you to set different location criteria and retention periods, giving you greater flexibility and compliance control over candidate data see below for examples of rule configurations to create a new inactivity based rule ensure you are on the inactivity rules tab of the data privacy & compliance page click + new and select either + inactive lead rule or + inactive applicant rule the data privacy and compliance page with the new button highlighted for additional inactivity rules, complete the following information title click the current title of the rule to rename it description (optional) add an internal description for your rule retention period if the inactive lead or applicant matches your rule, the retention period determines how long after the candidate was created (for an inactive lead rule), or how long after the candidate's final application was archived (for an inactive applicant rule), before they are considered in violation of your configured rules location determine your location criteria global covers all locations configured in ashby you can only configure one rule per type with the global location setting (to avoid conflicts) specific locations specify the locations this rule applies to for more on configuring locations, see set up departments & locations docid\ acybgybzas3ymyvbo5um8 advanced switch on the advanced option and click + add field to match to set your criteria using a range of location fields and values you can also set further criteria in the additional criteria section if you do not enable the advanced toggle and specify location fields, the locations you select for data rules within the locations section refer to the locations assigned within your job's settings section the locations section of configuring a new data retention rule once you are ready to enable your rule, switch on is enabled in the basic info section and select save changes at the bottom of the page the basic info section of a data retention rule with is enabled highlighted in the danger zone section, you also have the option to re evaluate candidates who meet your rule criteria and apply the rule to them if they qualify click re evaluate x candidates to take this action re evaluating the rule for candidates does not delete or anonymize candidates automatically it only flags those in violation of your configured rule consent rules consent based rules are set based on the date consent was given by a candidate amending the default consent based rule after clicking into the default consent based rule, you can further configure it by adding a description for internal reference choosing the consent request period, which defines how long a period of consent ashby requests from the candidate when requesting consent via your jobs page or via automation settings creating a rule filter, which restricts which candidates this rule applies to setting up consent collection on job posting pages in the jobs page settings section the consent collection option appears underneath the application form on the job posting setting up automation settings to automatically send an email with a link to a consent form based on a set of rules you can use this to collect consent from non applicants, such as sourced candidates (for example, those added via the chrome extension) or candidates that were manually added to ashby setting up consent extension automation settings to automatically request a consent extension prior to the consent retention date the edit menu for the default consent based rule creating an additional consent rule you can create additional consent rules to set different location criteria and retention periods for examples of multiple rule configurations, see the examples below to create a new consent rule ensure you are on the consent rules tab of the data privacy & compliance page click + new and select + consent rule the consent rules tab with the new button highlighted for additional consent rules, complete the following information title click the current title of the rule to rename it description (optional) add an internal description for your rule consent request period the request period defines how long a period of consent ashby requests from the candidate when requesting consent via your jobs page or via automation settings custom consent form text optional custom consent form text specifically for this rule if left blank, the consent form text set within the direct consent request settings is used instead the basic info section of a consent rule location determine your location criteria global covers all locations configured in ashby specific locations specify the locations you have configured in ashby that this rule applies to for more on configuring locations, see set up departments & locations docid\ acybgybzas3ymyvbo5um8 advanced switch on the advanced option and click + add field to match to set your criteria using a range of location fields and values you can also set further criteria in the additional criteria section if you do not enable the advanced toggle and specify location fields, the locations you select for data rules within the locations section refer to the locations assigned within your job's settings section the location section of the consent rule menu with the advanced toggle on, displaying the additional criteria section consent rules jobs page settings on the jobs page settings tab of your consent rule, you can enable the collect consent on jobs pages option once enabled, you can configure criteria so only the job pages that meet the filters you set request consent the jobs page settings section of a consent rule consent rules automation settings within the automation settings tab, you see two options initial consent and consent extension global consent rule page with the automation settings tab highlighted, showing options to configure automated consent form delivery to candidates initial consent automation settings initial consent automation settings allow you to determine the conditions under which the first consent request is sent click get started to create a draft global consent rule automation settings page with no automation configured and an arrow pointing to the get started button in the condition section, you can add filters by clicking add field to match you can then specify any criteria candidates must meet to be sent the initial consent request email use the email template field to determine the template sent to the candidate, and the delay dropdown to specify when the email is sent the email template must use the data consent request link token to be selectable in the dropdown menu if you need to add an additional automation rule to create a separate set of criteria, click create new automation rule the menu to create a new automation rule once you are ready to use your rule or rules, click save & publish when a candidate meets the conditions you have set in your automation, they receive the email you specified in the email template field global consent rule automation settings page in editing mode with an arrow pointing to the save & publish button consent extension automation settings consent extension automation rules allow you to determine when a consent extension request email is sent to the candidate click get started to start setting up your automation rule global consent rule automation settings page with the consent extension tab selected and an arrow pointing to the get started button for configuring consent extension automation use the advance notice period field to determine how far in advance the request is sent in the pictured example, the consent extension request email is sent 21 days prior to the date listed in the consent retention date field on the candidate's profile you can then determine the email template and the sender email address using the email template and from email address fields the email template must use the data consent request link token to be selectable in the dropdown menu to add a filter to your rule, click add field to match in the filter section to set your criteria if this section is left blank, all candidates the consent rule applies to are sent an extension request prior to their consent expiring to create an additional consent extension automation rule, click create new automation rule once you are ready to use your rule, click save & publish once you activate your consent extension configuration rule, it is applied to all candidates meeting your criteria open for examples of rule configurations the examples below are purely illustrative consult your legal team and organization's policies when configuring your own data compliance rules within your ashby account example based on candidate location in our first example, our test company has different retention periods for inactive candidates who are located in germany an additional inactive applicant rule can be created with the appropriate retention period and the advanced option switched on in the locations section the advanced option allows them to use the candidate's location field, meaning this is the field evaluated when applying the rule illustrative example of an inactive applicant rule configured based on candidate location example based on job posting location in this second example, the test company wants to set a different consent request period and different consent form text for job postings with their locations in the united states when configuring an additional consent rule based on job posting location, the advanced toggle should be switched on and the candidate's job consideration's job posting's location field can be used to determine the value fields the consent period can then be set in the consent period request section, and the alternative consent form text can be added to the custom consent form text field example of a consent rule configured based on job posting location privacy & legal settings on the privacy & legal tab of the data privacy & compliance page, you can set the following recruiting privacy policy legal entity name automated processing legal notice the privacy and legal tab of the data privacy and compliance page in ashby recruiting privacy policy add a link to a privacy policy here that contains details of how you manage candidate data this link appears on any consent forms that candidates complete you can set a recruiting privacy policy in the data privacy & compliance https //app ashbyhq com/admin/organizational settings/data compliance section of admin, under the privacy & legal tab when you do so, a link to the policy appears on any consent forms that candidates fill out legal entity name the legal entity name is used for data consent requests, equal employment opportunity commission (eeoc), and other legal contexts you can leave this blank to use your organization name automated processing legal notice here you can configure a legal notice to inform candidates that their data may be processed using ai for more on ashby's ai tools, see ashby ai features docid\ isi4asubjjxihytbeekfa viewing data compliance status on candidate profiles you can view a candidate's data retention dates (as determined by the rules above) on the candidate profile under the summary tab to find data retention details for a candidate, navigate to the summary section on the candidate profile you see a data retention section that displays the date after which the candidate is considered in violation of your rules a candidate profile, open to the summary section if you have consent extension automation settings in place, you see the date that the consent extension request is sent you can click override to get the following options override & ignore choose to ignore data retention rules for the candidate completely override date choose a date for data retention that takes precedence over any other rules if you opt to choose a new date for data retention via the override date option, the consent extension request date adjusts to fit the new date taking action on candidates who are in violation when ashby flags candidates as in violation of your data compliance rules, it does not anonymize or delete them automatically to review candidates who are in violation, use candidate search https //app ashbyhq com/candidate searches/new and filter candidate's is in violation of data compliance? to yes for instructions on anonymizing or deleting candidates individually or in bulk, see anonymizing and deleting candidates docid\ dmwv1t1xms0rsjf7bb9vc run this search periodically to catch candidates who newly reach your retention threshold for more on reporting on data retention rules and violations, see reporting on data retention rules, violations of rules and consent choice docid\ d 2p7dadxko j2hule31 what happens if multiple compliance rules apply to a candidate or lead? multiple compliance rules may apply to a candidate or lead if they apply to a job posting with multiple locations, and one or more locations have different inactivity or consent rules configured for them a candidate otherwise meets the criteria set for more than one inactivity and/or consent rule if multiple rules apply to a candidate, the rule with the longest retention period applies for example, if rule a says delete or anonymize data after one year and rule b says delete or anonymize data after three years, the candidate's retention date is set by rule b (three years) how does location hierarchy work with compliance rules? location hierarchy across jobs and job postings is supported in compliance rules for example if the rule is scoped to the united states region and the job location is set to california, the rule will match because the united states location is the region the california location is linked to if the rule is scoped to the california location and the job location is set to the united states region, the rule will not match because california is a descendant of the united states region, and the specification is respected faqs should i anonymize or delete candidates? when candidates are marked as in violation, any action taken (deleting or anonymizing) must be done manually anonymizing candidates removes any personally identifiable information (pii) but retains enough information to provide useful data for your analytics and reporting workflows anonymization cannot be undone can i override a data retention date when importing candidates via a csv file? yes once you have uploaded your comma separated values (csv) file, you can map the date listed in your file to the data compliance override date field in ashby if you would also like to include an override reason, you can map these fields to the data compliance override reason field in ashby when importing these fields, the override is included on the candidate profile and takes precedence over any other data retention dates screenshot showing the csv import field mapping for the data compliance override date and override reason fields for more on importing candidates via csv, see bulk import options docid\ sorncj66lghrflracxetj how does anonymizing a candidate work with the email events on the candidate's feed? once a candidate has been anonymized, a record of email events still shows on the candidate's feed (including the date and time the email was sent) however, the subject, body, and the candidate's email address are anonymized what happens if a candidate receives an initial consent email but doesn't click the link and follow the steps to provide consent? in this case, the consent retention rate field on the candidate profile still shows no consent collected, as the candidate has yet to provide consent i'm seeing multiple consent form completion events within the forms section of a candidate's job consideration why is this? if a candidate has applied for a role multiple times, they may have also completed the consent form multiple times as part of the application as duplicate applications are merged, only one job consideration shows on the candidate profile, but each application and consent form completed is listed within the singular job consideration for your reference for more on this, see how do i merge duplicate candidate profiles? docid\ rvfnqwgmp1m3vbjwr1sbb how are inactivity based rules and consent based rules applied to hired candidates? candidates in the hired stage are treated as active candidates this is because hired candidates have an active employment relationship with your organization, which provides a legitimate business interest for retaining their data the employment of the hired candidate also creates a legal basis for data retention that supersedes the need for consent based or inactivity based retention rules to be applied as such, they are not considered or marked as in violation of the rules you configure in ashby what happens when a rule is disabled? you can disable a data compliance rule by switching off the is enabled? toggle when viewing the rule details when a rule is disabled, all candidates who had that rule as their applied rule are re evaluated if another applicable rule exists, it becomes the new applied rule if no other rule applies, the candidate's retention date for that category is cleared what happens when a rule is archived? you can archive a rule by opening the rule details and clicking the archive button a rule must be disabled before it can be archived once archived, it cannot be re enabled (it is effectively retired) the same re evaluation that happens on disable applies here as well archived rules are hidden from the active rules list but remain in the system for audit purposes what happens to automated consent emails when a consent rule is archived or disabled? any scheduled automated consent extension emails tied to that rule are canceled this prevents outdated or irrelevant emails from being sent to candidates if multiple consent rules apply to the same job posting, which consent form is shown to applicants? the consent form from the rule with the longest retention period is displayed this ensures candidates are asked for consent under the most protective rule