How to collect candidate and employee documents securely

Collect candidate and employee documents in stages. Ask for the smallest set needed at the current stage, send each person to one approved intake point, limit review to the HR staff handling that step and remove the temporary copy after the result enters the official HR system.

Do not ask every applicant for the same documents a new starter must provide. A CV needed for shortlisting, evidence checked for a conditional offer and payroll records kept during employment have different purposes, audiences and retention rules.

Separate the four stages

The safest practical improvement is to stop treating "recruitment documents" as one folder. Define a short request for each stage.

Stage	Typical purpose	Ask now	Access	End of temporary intake
Application	Assess experience and suitability	Application form, CV or portfolio items genuinely needed for the role	Assigned recruiters and hiring reviewers	Delete according to the unsuccessful-candidate rule, or transfer the selected record to the next stage
Conditional offer	Complete approved checks	Only the evidence required for the specific check	Named HR staff or authorised check provider	Record the outcome in the approved system and remove unnecessary working copies
New starter	Create employment and payroll records	Signed forms and administrative evidence required at this point	HR and payroll staff with a defined task	Move records that must be retained into the official HR or payroll system, then delete intake copies
Employment or departure	Handle a defined change or offboarding task	Documents needed for that event only	The team responsible for the event	Close the task, preserve required records in the official system and delete temporary submissions

This is a workflow template, not a universal document list. Employment, tax, immigration, equality and recordkeeping requirements differ by country and role. Have the process owner confirm the legal requirement before adding a document to the request.

The AEPD guide to data protection in employment relationships covers recruitment, employment records and workplace processing in Spain. The UK's ICO recruitment and selection guidance is useful for process design, although the page identifies the detailed text as draft guidance. Use the authority and rules that apply to your organisation.

Build a request around one decision

Start each request with the decision it supports. "Confirm the candidate can perform the role" is still too broad. "Confirm the candidate holds the licence required to operate this equipment" is specific enough to test what evidence is necessary.

For every requested item, write down:

The purpose and legal basis used by the employer
Why a less intrusive item would not be sufficient
The recruitment or employment stage when it is needed
Who reviews it and what they record
Whether the original must enter an official record
When the intake copy is deleted

If the team cannot complete these fields, pause the request. Asking "just in case" creates information that somebody must protect, explain and eventually remove.

The GDPR's data minimisation and storage limitation principles require personal data to be adequate, relevant and limited to what is necessary, and kept in identifiable form no longer than needed for the purpose. Other laws may require certain employment records for longer. That is why the intake copy and the official record need separate end points.

Give the person a clear notice and route

The request should come from a recognisable company contact and explain:

Which document or pages are requested
What the employer will use them for
Who can review them
The upload deadline and accepted formats
The expected deletion timing for the intake copy
Where to find the employer's privacy information
How to correct or withdraw a submission where applicable

Use a stable upload address rather than a recruiter's personal inbox. A dedicated email address can be a fallback, but tell the sender that copies may remain in their Sent folder or email provider. Keep notification subjects plain and do not repeat a diagnosis, background-check result, filename or other sensitive detail in email.

The wider sensitive-document intake workflow includes a request template that can be adapted for recruitment.

Keep review access close to the decision

A hiring manager may need the application and interview notes without needing an identity document, bank detail or right-to-work evidence. Payroll may need approved starter data without needing the full recruitment file. IT may need the person's name and start date without seeing either set of documents.

Create named accounts and grant access to the smallest group that can complete the task. Avoid a general "HR shared" login. If an external recruiter or screening provider is involved, document which organisation is responsible for each step, what it receives and how the handoff ends.

Use the least-privilege client document checklist to separate viewing, original download, retention changes, deletion and user administration. The same method works for candidate documents even though the relationship is employment rather than client work.

Treat sensitive checks as a separate process

Health information, disability information, trade-union membership, biometric identifiers and some diversity information may be special-category data under the GDPR. Criminal-conviction information has its own rules. Checks involving these categories need more than a secure upload page: the employer must establish a valid legal basis, any additional condition, appropriate notice, access controls and retention rule.

Do not put those files into a general intake workflow because the same team handles other recruitment documents. Use a service and agreement approved for the category.

Sunset Docs does not authorise special-category data, criminal-conviction data, biometric data used for unique identification or children's data unless separately agreed in writing. This matters for roles involving medical evidence, background checks or applicants under 18. The default service is not the right route for those documents.

The same restriction covers full payment-card data, passwords, authentication secrets and private keys. Bank account evidence may also reveal more than payroll needs. Ask for the precise fields or approved payroll form instead of an unredacted statement when the process allows it.

Do not call document intake identity verification

Receiving a passport image does not prove who submitted it, whether it is genuine or whether it belongs to the person using the link. File validation and malware scanning answer different questions.

If the employer must verify identity, qualifications or work authorisation, define that check separately. It may require an authorised person, an official verification service, an in-person comparison or another method set by applicable law. Record the result required by the process rather than keeping extra copies without a reason.

Sunset Docs receives and prepares allowed files for review, but it does not verify the sender's identity or the accuracy of a document.

Close intake without losing required records

Temporary intake should end with an explicit handoff:

The assigned reviewer checks the submission.
They record the outcome in the recruitment, HR or payroll system.
If an original must be retained, an authorised person moves it into that approved system.
They remove unnecessary working notes and downloads from local devices.
They delete the temporary intake copy or allow its documented deletion date to arrive.
They retain only a minimal audit record that does not reproduce document contents.

Do not use a short intake deletion date to override a legal duty to preserve an employment record. Equally, do not turn the intake workspace into the permanent record because another system has a longer retention schedule.

Sunset Docs assigns a deletion date when a submission arrives and supports earlier deletion. Its protected backup residuals follow the published backup cycle, so active deletion should not be described as instant removal from every backup. The Privacy Policy explains those periods.

A request template

Please upload the following document using the company link below:

{upload_link}

We need it to {specific recruitment or employment purpose}. Please provide {exact document, page or field} by {date}. {Named role or team} will review it.

The temporary intake copy is scheduled for deletion on {date or after period}. If a record must be kept for the employment process, we will place the required record in our approved HR system under the retention rule described in {privacy notice link}.

Do not use this link for health information, criminal-record information, children's data, payment-card data or account credentials. Contact {company contact} if the requested document contains one of those categories or if you need another way to provide it.

Adapt the restricted-category line to the approved service and the actual process. Do not promise a deletion date that conflicts with the employer's recordkeeping duties.

Frequently asked questions

Should all candidates upload identity documents with their application?

Usually the better starting point is to ask whether identity evidence is needed at that stage. If only a finalist or new starter needs a defined check, collecting copies from every applicant increases exposure without helping shortlisting.

Can hiring managers see onboarding documents?

Only when they have a defined task that requires the information. Manager status alone is not a reason to see payroll, identity or other administrative evidence.

How long should unsuccessful-candidate documents be kept?

There is no single period for every country or process. Consider the purpose, applicable limitation periods, regulator guidance, any consented talent-pool use and the person's rights. Document the rule and keep temporary intake separate from the recruitment record.

Can we keep a candidate's CV for future roles?

That is a separate purpose from filling the current vacancy. Assess the lawful basis, provide the required information, define a retention period and make withdrawal practical. Do not silently convert every application into a permanent talent database.

Is a document portal enough for right-to-work checks?

No. A portal can receive allowed evidence, but it does not complete a statutory check or verify identity. Follow the official method for the relevant country and record the required result in the approved system.

Can Sunset Docs store employee files permanently?

No. Sunset Docs is temporary intake, not an HR archive, personnel-record system or identity-verification service. Transfer records that must be preserved into the employer's approved system before the intake copy expires.