The verdict in three sentences
A recruitment agency receiving CVs online processes personal data at volume every day, which makes it a natural target for Data Protection Commission (DPC) scrutiny and candidate access requests. The compliance budget in 2026 sits between 1,500 and 4,000 EUR for the audit, 0 to 30 EUR per month for cookie management and 300 to 1,000 EUR per month for an outsourced DPO. The most cost-effective workstream remains the automatic purge of CVs older than 2 years, which cuts both risk and storage cost.
The obligations on a recruitment agency website
The application form, speculative CV upload and candidate portal create several distinct processing activities, each with its own legal basis. European regulators, including the DPC and France's CNIL, consider that a CV should not be kept more than 2 years after the last contact without the candidate's renewed agreement. Sensitive data (health, disability, ethnicity) should not be requested, and free-text fields must be monitored.
| GDPR obligation | Application on the website | Risk if missing | Compliance effort |
|---|---|---|---|
| Transparency (Art. 13) | Notice under each form + privacy policy | Candidate complaint, DPC inquiry | 1 to 2 days |
| Legal basis and purposes | Separate targeted application, talent pool, job alerts | Unlawful processing | 1 day |
| Retention period | Purge or re-consent at 24 months | Fine for excessive retention | 2 to 5 development days |
| Cookie consent | Banner where rejecting is as easy as accepting | ePrivacy enforcement | 0.5 to 2 days |
| Access and erasure rights | Dedicated form + procedure within 1 month | Complaint, order to comply | 1 to 3 days |
| Security | Encrypted CVs, named access, logging | Data breach, notification within 72 h | 3 to 8 days |
| Record of processing | Document kept up to date | Breach found during inspection | 1 to 2 days |
The detailed budget in 2026
The prices below are 2026 ballparks observed for an agency of 10 to 40 consultants. They are not a Kolonell price list unless stated otherwise.
| Item | Price (2026 ballpark) | Frequency | Comment |
|---|---|---|---|
| GDPR audit of the site and candidate flows | 1,500 to 4,000 EUR | One-off | Data mapping, gaps, action plan |
| Compliant cookie banner (CMP) | 0 to 30 EUR / month | Monthly | Free under a traffic threshold, paid above |
| Outsourced DPO | 300 to 1,000 EUR / month | Monthly | Depends on candidate volume and number of sites |
| Purge and talent pool consent development | 1,200 to 3,500 EUR | One-off | Automated re-consent at 23 months |
| CV encryption and access control | 800 to 2,500 EUR | One-off | Encrypted storage, expiring links |
| Privacy policy and notices drafting | 500 to 1,500 EUR | One-off | Often included in the audit |
| Maintenance and compliance monitoring | 75,000 FCFA (110 EUR) / month with Kolonell, Standard plan | Monthly | Updates, backups, fixes |
For a typical agency, the first-year budget lands around 6,000 to 14,000 EUR all in, DPO included. That figure should be weighed against the exposure: European regulators have repeatedly fined recruitment players for excessive retention and weak security.
Prioritise without rebuilding everything
There is no need to rebuild the whole site. Three actions cover most of the risk in 4 to 6 weeks: an automated purge that contacts the candidate at 23 months to offer staying in the talent pool, CV file encryption with download links expiring after 24 hours, and a cookie banner allowing one-click rejection. The record of processing and the rights procedure can follow in a second phase.
Mini case study
Aoife, managing director of a 25-consultant recruitment agency in Dublin (illustrative persona), stores 48,000 CVs, 60 % of them older than 2 years. She funds a 2,800 EUR audit, a 2,200 EUR automated purge and an outsourced DPO at 550 EUR per month. First-year budget: 2,800 + 2,200 + 6,600 = 11,600 EUR. The purge removes 28,800 outdated CVs, and every candidate contacted at 23 months who agrees to stay becomes a usable profile again. If 8 % of the 28,800 contacted candidates accept, she keeps 2,304 requalified profiles with up-to-date consent.
Need a professional website?
Kolonell builds websites that attract clients, optimized for the Sénégalese market. Free quote in 2 minutes.
FAQ
How much does a GDPR audit cost for a recruitment agency in Dublin?
Expect 1,500 to 4,000 EUR as a 2026 ballpark, depending on the number of sites, tools (ATS, CRM) and candidate flows. The audit delivers a data map and a prioritised action plan.
How long can a CV be kept?
The common regulatory benchmark is 2 years maximum after the last contact with the candidate. Beyond that, you need explicit agreement to extend retention.
Is a DPO mandatory for a recruitment agency?
It is when large-scale monitoring of individuals is the core activity, which is often the case for an agency managing tens of thousands of profiles. An outsourced DPO costs 300 to 1,000 EUR per month.
Is a free cookie banner enough?
Yes, if rejecting is as easy as accepting and trackers are truly blocked before consent. Paid tools, at 10 to 30 EUR per month, mainly add proof of consent and reporting.
What is at stake in a DPC inspection?
Fines can reach 4 % of global turnover or 20 million EUR, and decisions can be published. In practice, the regulator often starts with an order to comply and a 3 to 6 month deadline.
Let's scope your project. Tell us about your forms, your ATS and the number of stored CVs: we price the purge, encryption and cookie banner, with an indicative budget and a 4 to 6 week timeline. Detailed quote within 48 h. WhatsApp +221 77 596 93 33.
Mohamed Bah
Fondateur, Kolonell
Passionate about digital and entrepreneurship in Africa, Mohamed has been helping Sénégalese businesses with their digital transformation since 2020. Founder of Kolonell, he believes every SME deserves a professional and accessible online présence.
