Candidate data in defense tech: where recruitment ends and security begins

Data protection does not start with legal documents. It starts with the decisions recruiters and HR make every day. This is the main point of the latest article in the Arming with Talents special project, by Anna Korol, founder and CEO of CORE Team, and Kateryna Oliinyk, partner at the law firm Arzinger.

How can recruiters prevent candidates’ personal data from leaking? What could Draft Law No. 8153 change in the rules for handling that data? And what should you do if a candidate says more than they should?

In defense tech, a candidate’s CV is more than a document with a name and work history. It can also hint at a product, and that interests the enemy as well as employers.

In ordinary recruitment, a data leak is an unpleasant episode that ends in fines and reputational damage. In the defense industry, it is also a matter of security for the individual, their family and the team they are about to join.

Together with Kateryna Oliinyk, partner at Arzinger, we looked at three situations in which candidate data is most often put at risk. For each one, we give the recruiter’s view and the lawyer’s view: what happens in practice and what the consequences are.

1. “Just send your CV on Telegram”: where candidate data really ends up

The reality is that recruitment runs on messaging apps. CVs are forwarded to work chats, screenshots of profiles are shared with colleagues “for internal feedback”, and candidate lists sit in spreadsheets that anyone with the link can open. A relatively new channel is public AI tools, where CVs are pasted to produce a quick summary.

Each of these steps seems minor. Together, they build a picture of which engineers work where, on what, and where they plan to move next. For hostile intelligence services, that is valuable information.

The candidate feels the consequences first. Potential problems include targeted phishing, recruitment attempts and pressure on their family. There is also a loss of trust. Everyone in our industry knows each other fairly well, and a specialist whose data has been “doing the rounds” will think twice before responding to the next vacancy.

From a recruitment perspective, the rule is simple. Before forwarding anything, ask yourself whether it is necessary at all, who else will have access, and whether the candidate knows. Use access in a secure system instead of a file in a chat. Grant access to named individuals instead of sharing an open link. Use a tool that does not store data or use it to train models instead of a public chatbot.

Legal perspective from Kateryna Oliinyk:

If a candidate’s personal data is leaked, the employer is usually responsible as the data controller. The employer determines the purpose and procedure for processing the data and must ensure it is properly protected. If recruitment is carried out by an external agency or an independent recruiter, how responsibility is shared depends on their status and the terms of the engagement.

When using AI tools to analyse CVs, it is important to check the terms of service: who processes the data, whether it is used to train models and what confidentiality guarantees are provided. For working with CVs, AI tools in a secure corporate environment are preferable, where the technical settings and contractual terms ensure an adequate level of data protection. Uploading CVs to a public service may require additional legal assessment.

By sending a CV to a recruiter, a candidate effectively allows their personal data to be processed for the purpose of finding a job and assessing their application. However, this does not amount to consent to unlimited sharing of that data. A recruiter may not forward CVs to third parties without restriction, beyond the purposes the candidate was informed of. Any further disclosure of personal data must be consistent with the stated purpose of collection, and the candidate must be properly informed of the transfer. In some cases, this may require the candidate’s consent or another legal basis provided for by law.

A candidate whose data has been processed unlawfully can demand that the violation stop or that its consequences be remedied. They can also apply to the Ukrainian Parliament Commissioner for Human Rights or to the courts, including to protect their rights and seek compensation for damage.

2. Sensitive questions: military registration, deferral and security checks

Defense recruitment involves data that almost never comes up in other industries: military registration status, eligibility for deferral from mobilisation, and polygraph and psychological assessment results. Defense tech companies do need this data. The question is when, how much of it, and who sees it.

Sometimes questions about military registration and deferral are asked on the very first call, and the answers are recorded in notes shared with the whole team. And a screening report that was meant to be a decision-making tool becomes a file that is forwarded to everyone involved in the process.

The consequences are long-lasting. Psychological assessment results or details of someone’s military status can follow a person around the market for years, creating bias where there should be none. For the company, this means a risk of accusations of discrimination and unlawful data processing.

Our approach is to ask about sensitive matters only when they genuinely affect the decision, and to explain to the candidate why we are asking. The client receives a conclusion and a recommendation, not raw test data. Only the people making the decision have access.

Legal perspective from Kateryna Oliinyk:

Polygraph and psychological assessment results do not automatically fall into special categories of personal data. That depends on what the conclusions contain. If they include, for example, information about health, political or religious beliefs, or criminal convictions, their processing is subject to additional restrictions. The conclusions may also contain confidential information about a person’s private life, so collecting and using them must be properly justified.

The legal basis for processing military registration data depends on the stage of interaction with the candidate. After hiring, the employer processes this data in particular to fulfil its statutory obligation to keep military registration records for conscripts, persons liable for military service and reservists. At the recruitment stage, the basis may be the candidate’s consent or the need to take steps related to the possible conclusion of an employment contract.

Personal data may be kept only for as long as is necessary to achieve the purpose of processing. Data of candidates who were not hired should be deleted or anonymised once that purpose has been achieved, unless there is another legal basis for keeping it.

What could change under Draft Law No. 8153 “On Personal Data Protection”?

Draft Law No. 8153 was adopted at first reading on 20 November 2024 and has been in preparation for second reading ever since. It is intended to bring Ukrainian legislation closer to GDPR standards and tighten requirements for processing personal data. In particular, it would require data to be destroyed no later than 30 days after it is no longer needed, require leaks to be reported and clarify the requirements for consent to processing.

Current legislation provides an exception for processing data for the military registration of conscripts, persons liable for military service and reservists. Draft Law No. 8153 contains no such exception, although one may be added as the bill is developed further. The document was drafted before the full-scale invasion. Its current version does not take into account all the specifics of data processing under martial law and may still change.

3. NDAs work both ways: when a candidate says too much

NDAs are usually seen as protecting the company: the candidate signs one before learning the details of a project. But there is another side to this that gets less attention.

Imagine an interview with an engineer who currently works at another defense company. They want to make a good impression, and the interviewer wants to understand how deep their expertise goes. Ten minutes in, the conversation has already moved on to the specifications of someone else’s product, its suppliers or test results. The same can happen with test assignments that are too close to real tasks.

This creates risks for both sides. The candidate breaches their obligations to their current employer, and the hiring company receives information it should not have. One more simple observation: if a person talks so readily about someone else’s secrets, that is worth factoring into the assessment.

Recruiters and hiring managers can prevent this. Ask about approaches and solutions, not product specifics. Say directly at the start of the conversation: “Please don’t disclose any information covered by an NDA.” And base test assignments on hypothetical scenarios.

Legal perspective from Kateryna Oliinyk:

Disclosing confidential information or trade secrets creates risks for both the candidate and the new employer. At the same time, an NDA should not restrict a person’s right to use the knowledge, skills and experience they have gained. It is important to distinguish between professional competence and a former employer’s information that is protected by law.

A candidate may talk about their experience and approach to work, but must not disclose protected information such as technical documentation, source code, algorithms or non-public data on clients and pricing. An interview should assess competence, not provide access to trade secrets.

How effective an NDA is depends on how clear its terms are and whether a breach can be proven. Typical problems include a vague definition of confidential information, no stated duration for the obligations and difficulty proving a breach. In its ruling of 22 October 2024 in case No. 910/6224/19, the Supreme Court restated the principle of contra proferentem: ambiguous contract terms are interpreted against the party that drafted them. An NDA should therefore clearly define what information it protects and what restrictions it imposes.

Final thoughts

Protecting candidate data is not bureaucracy or a box to tick on a consent form. In defence tech, it is part of the security of the whole industry, and it starts with the simple daily habits of recruiters and HR.

In defence tech, protecting the data of both employer and candidate is the foundation for all of a company’s further work and internal processes. To avoid unnecessary conflicts and keep data secure, ticking off legal requirements is not enough. It helps to stop for a moment and ask yourself honestly: do we have a legal basis for processing this data, what is our purpose, and how are we trying to achieve it?

The good news is that most risks are covered not by expensive systems but by agreements: where we store data, who sees it and what we don’t ask about.

These three situations are just the tip of the iceberg. Data protection does not start with legal documents. It starts with the decisions recruiters and HR make every day.

Anna Korol

CEO and founder of CORE Team

• LinkedIn