IT Support for Recruitment AgenciesIT support for recruitment agencies whose database is the business.

Who this is for

Agencies and employment businesses placing permanent, contract and temporary workers, on CRM and applicant tracking systems such as Bullhorn, Vincere, Firefish, Mercury or JobAdder, with consultants on the phone all day, a steady flow of joiners and leavers, and nobody whose job is IT.

Candidate data, UK GDPR and how long you keep a CV

Every CV, interview note, reference and right-to-work document is personal data, and some of it, such as health information or criminal record checks, is special category or criminal offence data with stricter rules. The ICO's employment guidance covers recruitment and selection, and it is consistent on the basics: collect what you need, tell candidates what you do with it, keep it secure, and do not keep it longer than you can justify.

Retention is where agencies struggle. The Conduct of Employment Agencies and Employment Businesses Regulations 2003 require certain records to be kept for at least a year, the Home Office guide sets out how long right-to-work copies must be kept, and beyond that the agency has to decide and document its own periods. We help you turn that decision into retention policies in Microsoft 365, or in Google Vault on Google Workspace editions that include it, so CVs sitting in mailboxes and shared folders are deleted on schedule rather than kept for ever, and so a subject access request can be answered from a search rather than a week of digging.

Source: Employment information (ICO), Conduct of Employment Agencies and Employment Businesses Regulations 2003, Right to work checks: an employer's guide (GOV.UK)

Consultants who leave with the database

The common data loss in recruitment is not a hacker. It is a consultant exporting candidate lists, forwarding CVs to a personal address or syncing the shared drive to a home laptop in the weeks before they resign. Microsoft 365 Business Premium has the controls to make that hard: Conditional Access so the agency's data opens only on devices it manages, browser-only access with downloads blocked on personal devices, data loss prevention policies that warn on or block bulk sharing of personal data, and alerts on forwarding rules to outside addresses.

Inside the CRM, export rights are a setting in the CRM itself. We review who has them with you, and where the CRM supports single sign-on with Microsoft 365 or Google Workspace we put it behind the same sign-in and Conditional Access as everything else, so switching off one account closes the lot.

Timesheets, payroll and invoice redirection

Agencies that run contractor and temp payroll move money every week, which makes them a target. The usual routes are a compromised mailbox used to change a contractor's bank details before a pay run, a fake client email asking for remittance details to change, or a spoofed director asking finance to make an urgent payment. The controls are multi-factor authentication for every account, impersonation protection tuned for your directors and key clients, alerts on new mailbox rules, and a written process that bank detail changes are confirmed by phone on a known number. We put the technical half in place and help you write the other half.

Source: Small Business Guide (NCSC)

Phones, churn and client questionnaires

Consultants live on the phone. Teams Phone gives each one a number that works on a desk phone, laptop or mobile app, moves with them between desks and home, and can be recorded where the agency needs it for training or disputes. When someone leaves, the number can be reassigned to their replacement so candidates and clients still get through.

Joiners and leavers are constant in recruitment. New starters get a laptop and accounts that are ready before day one, and leavers are closed down the same day: sign-ins blocked, sessions revoked, devices wiped or recovered, mailbox and CRM records handed to a manager. And when a client's PSL or framework onboarding questionnaire asks for Cyber Essentials, the controls it requires are the ones we put in place as standard, so certification is a short project rather than a reason to lose the tender.

On Google Workspace? Candidate data protected there too

Plenty of agencies run on Gmail and Google Drive, and we support Google Workspace as fully as Microsoft 365. We give honest advice on which fits and do not ask you to move. The aim is the same: candidate data stays with the agency. We enforce 2-Step Verification on every account, with security keys or passkeys for admins, keep admin roles to the people who need them, lock down external sharing on Drive and shared drives so CV folders cannot be shared to a personal address, restrict which third-party apps can connect to your accounts, and alert on suspicious sign-ins and on mail forwarded outside the agency.

On editions that include them, data loss prevention rules flag bulk sharing of personal data, context-aware access limits agency data to devices you manage, and Vault holds your retention schedule and answers subject access searches. Laptops and phones are managed through Google endpoint management or Intune on a standalone licence. Gmail, Drive, Calendar and Contacts are backed up outside Google and kept for seven years in the UK, as a separate per user service, and Cyber Essentials for PSL questionnaires works the same on either platform.

What is included

What is not included, and why

• The CRM, job board and LinkedIn Recruiter licences themselves. You buy those from the vendor; we make sure they are protected and work with Microsoft 365 or Google Workspace.
• Legal advice on your data protection or employment agency obligations. We put in the technical controls and the evidence; your directors and data protection lead own the compliance.
• Teams Phone and connectivity are separate services, covered on the Teams Phone and broadband pages.

What it costs

Managed IT support for recruitment agencies is priced per user per month, with security monitoring and device management included, so it moves with your headcount. Microsoft 365 or Google Workspace backup is a separate service, also priced per user per month. Licences are extra at Microsoft's or Google's price: Microsoft 365 Business Premium is £16.90 per user per month at Microsoft's UK price. Onboarding, any migration work and Cyber Essentials certification are quoted as fixed projects. We quote after a short discovery call, once we know your setup.

Questions people ask before signing

Sources

1. 1.Employment information (ICO)
2. 2.Conduct of Employment Agencies and Employment Businesses Regulations 2003 (legislation.gov.uk)
3. 3.Right to work checks: an employer's guide (GOV.UK)
4. 4.Small Business Guide (NCSC)

Read before you call

• Microsoft 365 Business Premium, set up right
• Microsoft Teams Phone
• Google Workspace management
• Google Workspace backup
• Secure staff onboarding and offboarding
• Personal devices at work: how Intune handles them
• Phishing and invoice fraud: how it works and how to stop it
• IT support for the motor trade
• IT support for hospitality