Yes, but the two steps need different permissions. Searching your database for a second client's role is a use of the candidate's data. Sending the CV to that client is a disclosure, which usually needs the candidate's agreement. In Singapore, a licensed employment agency needs written consent before passing details to any client. Indonesia's Personal Data Protection Law treats a new client as a new purpose, needing explicit consent, written or recorded. Australia's APP 6 and New Zealand's IPP 10 and 11 allow a related purpose the candidate would expect, or their agreement. HyreTech finds past candidates across every client's roles but does not record consent, so ask before every submission.
This guide is for recruitment agencies, and for in-house teams that run searches for several business units, in Singapore, Indonesia, Australia and New Zealand. It covers one question: when a candidate gave you their details for Client A's role, what do you need before you consider them for Client B's role, and before you send their profile to Client B?
It does not cover how long you can keep candidate data, which is in our guide to candidate data retention in Singapore, Indonesia, Australia and New Zealand. Nor does it cover sending a profile to a client in another country, which brings in each market's cross-border transfer rules. For Australia and New Zealand, see sending candidate data overseas.
Checked against the primary sources on 18 October 2026. This is general information, not legal advice. Where an official source leaves a question open, we say so, and where a table shows our suggested practice rather than a rule, we label it.
Searching Your Database and Sending a Profile are Two Different Acts
Most agencies treat "we already have this candidate" as one step. The law reads it as two.
The first act is use. Your recruiter searches the database, reads the profile and decides to put the person on a new shortlist. The OAIC's guidance on key concepts gives searching records for personal information, and making a decision based on it, as examples of use. New Zealand separates the two acts, with IPP 10 limiting use and IPP 11 limiting disclosure.
Indonesia's Personal Data Protection Law (UU 27/2022) calls both "processing" and ties each purpose to its own lawful basis. Singapore's PDPA runs both through its consent, purpose and notification obligations, and the employment agency licence adds a stricter rule on top.
The second act is disclosure. The profile goes to Client B, and from that moment Client B can act on it. The OAIC's APP 6 guidelines describe disclosure as making information accessible to others outside the entity and releasing its subsequent handling from your effective control.
This is where a candidate's expectations matter most. A candidate who applied for one named role at one named client may be comfortable with you searching internally. They may not expect their CV to land with a second employer, particularly if they are still employed.
Keeping the two acts apart gives you a simple operating rule: internal search needs a notice that covers it, and submission needs the candidate's say-so. In Singapore and Indonesia, that say-so should be in writing or recorded.
What Each Market Expects, Side by Side
| Singapore | Indonesia | Australia | New Zealand | |
|---|---|---|---|---|
| Where the rule sits | PDPA, plus MOM's employment agency licence conditions | Personal Data Protection Law (UU 27/2022) | Privacy Act: APP 6 on use and disclosure, APP 5 on notice | Privacy Act 2020: IPP 10 on use, IPP 11 on disclosure, IPP 3A on notice |
| Considering them for a new client | Consent, or a PDPA exception. Applying covers assessing that one application | A new purpose, which needs its own basis, in practice explicit consent, and notice before the change | Allowed if related to the original purpose and the candidate would reasonably expect it, or with consent | Allowed if directly related to the original purpose, or authorised by the candidate |
| Sending the profile to a client | The candidate's written consent (licence condition 5(a)) | Consent that covers the disclosure. The client becomes a second controller | Consent, or a related disclosure the candidate would reasonably expect | One of the purposes you collected for, or authorised by the candidate |
| Form of permission | Written | Written or recorded, separate from other terms, in plain Bahasa Indonesia | Informed, voluntary, current and specific | Authorisation, or your belief on reasonable grounds that an exception applies |
| Public profiles | An exception covers collection, use and disclosure | No exception for public data | No public-data exception in APP 6. Notice and fair-collection rules still apply | Exceptions where using or disclosing it would not be unfair or unreasonable |
The sections below give the source for each column.
Singapore: the Licence is Stricter Than the PDPA
The PDPC's Advisory Guidelines on the PDPA for Selected Topics say recruitment companies, employment agencies and head-hunters are subject to the PDPA's data protection provisions. Unless an exception applies, they have to tell job applicants the purposes and get consent before collecting, using or disclosing their data (paragraph 6.11). Someone who applies for a job is deemed to consent to their data being used to assess that application (paragraph 6.2). Considering them for a different client's role is a further purpose.
The exception most relevant to hiring is the evaluative purpose. The PDPA's First Schedule lets organisations collect, use and disclose personal data without consent where that is necessary to decide a person's suitability for employment.
Our guide to AI hiring rules in Singapore, Australia and New Zealand covers how it applies to screening. Whether it lets an agency send a CV to a client the candidate never applied to is untested. We found no PDPC example that applies it to agencies.
For licensed agencies, the question is settled by the licence anyway. MOM's employment agency licence conditions (condition 5(a), in both the Comprehensive and Select licences) bar a licensee from revealing "any information whatsoever regarding any applicant" without that applicant's written consent. An applicant here is someone who engages the agency to help them find work. Deemed or implied consent will not do for a submission: get the yes in writing and keep it.
Public data is treated generously. The PDPC's Key Concepts guidelines (revised 29 April 2026) say that if personal data was publicly available when you collected it, you may use and disclose it without consent, even if it later stops being public.
A person who put their details on a job portal to be contacted about openings may be deemed to have consented to their collection, use and disclosure for that purpose (Selected Topics, paragraph 6.4). A message sent only to promote a job opening is outside the Do Not Call rules (paragraph 6.13). Once the person engages you, though, condition 5(a) governs what you send.
One more distinction from the same guidelines: an agency processing data on a client's behalf under a written contract, as a data intermediary, has fewer obligations (paragraph 6.12). Reusing those candidates for a different client is not processing on the first client's behalf, so that lighter regime does not cover it.
Indonesia: a New Client is a New Purpose
The Personal Data Protection Law has applied in full since October 2024. Its main lawful basis is explicit, valid consent for one or more specific purposes the controller has told the person about (Article 20(2)(a)). Consent given for Client A's role does not stretch to Client B's. Before the purpose changes, you have to tell the candidate (Article 21(2)).
The form rules are strict. Consent must be written or recorded, and electronic consent counts (Article 22). If the consent request also covers other purposes, it must be clearly separable from them, easy to understand and in plain language. The Law's official elucidation says that language means Bahasa Indonesia. Consent that misses these rules is void by law (Article 22(5)), and you must be able to prove the consent you rely on (Article 24).
Three other points matter for agencies:
- No exception for public profiles. The Law excludes only processing for personal or household purposes, and its other exceptions are for state interests such as defence and law enforcement. A LinkedIn profile still needs a lawful basis.
- Withdrawal is fast. When a candidate withdraws consent, you have 3 × 24 hours to stop processing their data (Article 40), and the data must then be deleted.
- Legitimate interest is a weak fallback. It exists (Article 20(2)(f)), but it means weighing your interest against the candidate's rights. A CV that reaches a new employer without warning, possibly revealing a job search, is hard to defend that way. That is our reading; no regulator has ruled on it.
Administrative fines can reach 2% of annual revenue (Article 57). The Ministry of Manpower's current regulation for private placement agencies, Permenaker 18/2024, contains no data consent rule that we could find, so the PDP Law sets the standard. The Law's implementing regulation had not appeared in the national legal databases when we checked; we will update this section when it does.
Australia: Related Purposes, and a Trap for Small Agencies
Under APP 6.2(a), you may use or disclose information for a secondary purpose if the candidate would reasonably expect it and it is related to the purpose of collection.
The OAIC says the "reasonably expects" test is objective: what a properly informed, reasonable person would expect (APP 6 guidelines, paragraph 6.20). It also says to use or disclose only the minimum amount of information sufficient for the secondary purpose (paragraph 6.21). A shortlist submission rarely needs a home address on page one.
Public profiles work differently from what most agencies assume. APP 6 has no exception for publicly available information. But if you collected a profile in order to recruit that person, considering them for roles can be your primary purpose, which the OAIC reads narrowly.
What still applies is collection: APP 3 expects you to collect information from the person themselves unless that is unreasonable or impracticable, and says public availability does not let you use it in whatever way you choose. APP 5 expects you to tell the person, as soon as practicable, that you hold their information and how you got it.
Small agencies should not assume they are exempt. Most businesses with an annual turnover of A$3 million or less are outside the Privacy Act, but not one that discloses personal information to anyone else "for a benefit, service or advantage" without the person's consent (section 6D(4)(c) and (7)).
On that wording, a small agency that sends CVs to clients for a placement fee without the candidate's consent risks being covered. The OAIC has published no guidance specific to recruitment, so treat consent before submission as the safe course either way.
New Zealand: Directly Related Purposes and The New Notice Rule
IPP 10 and IPP 11 let you use or disclose information for another purpose if you believe, on reasonable grounds, that it is directly related to the original purpose, or that the candidate has authorised it.
IPP 11 also allows a disclosure that was one of the purposes you collected the information for. If your notice said you would put candidates forward to clients, a submission can fit that purpose. Both principles also have exceptions for information from a publicly available publication, where using or disclosing it would not be unfair or unreasonable.
Since 1 May 2026, IPP 3A also applies. When you collect information about someone from a source other than that person, as you do when sourcing, you must take reasonable steps to tell them, as soon as reasonably practicable, that you have it, why, and who will receive it.
There is an exception for publicly available information, which the Privacy Commissioner's IPP 3A guidance says may apply to a public website or social media page. Because the tests turn on your belief on reasonable grounds, you need to be able to show why you believed an exception applied.
Four Reuse Scenarios and What to Do in Each
This table is our suggested practice, built on the rules above. It is not a legal standard.
| Scenario | Searching your database | Sending the profile to Client B | Suggested practice |
|---|---|---|---|
| Candidate applied for Client A's role and was told only about that role | The original purpose was one role, so a new use needs notice or consent. In Indonesia, consent | Do not send without asking | Email the candidate about the new role and send only on a written yes |
| Candidate registered for "future roles" under a clear notice | Fine within what the notice covered | The notice rarely names Client B, so confirm | Confirm each submission and name the client, or at least the type of client |
| Candidate found on a public profile | Singapore and New Zealand allow more. Australia expects notice. Indonesia has no exception | Ask before sending | Message them first and say how you found them |
| Candidate from an old search, no contact for a long time | Check whether you may still keep the record | Reconfirm availability and permission | Treat it as a fresh contact |
For the last row, our candidate data retention guide covers how long each market lets you keep a record.
Three Consent Models for Agencies
The OAIC says consent has four elements: the person is adequately informed, gives it voluntarily, the consent is current and specific, and the person has capacity. The third element is the one agencies tend to strain.
A very broad permission can fail the "specific" test even if the candidate ticked a box, and Indonesia's Law asks for consent to specific purposes in the same way.
| Model | What the candidate agrees to | Strength | Weakness |
|---|---|---|---|
| Role by role | Each submission, one at a time | Clearest and easiest to prove | Slower, and candidates can tire of the requests |
| Standing permission plus a check before each submission | Being considered for other roles in named areas, and a confirmation before the profile goes out | Fits "current and specific" and keeps speed | Needs a record of what each candidate agreed to |
| Blanket permission | Being sent to any client at any time | Fastest | Weakest on "specific", hardest to defend if a candidate complains, and short of Singapore's written consent for each disclosure |
Most agencies end up in the middle row. The practical question is whether you can show, for any submission, what the candidate agreed to and when. In Singapore and Indonesia, the confirmation before each submission is where the written or recorded consent belongs.
Write The Notice Before You Build The Database
The notice at the point of collection decides how much room you have later. A good one covers five things:
- Who you are. Say you are an agency acting for employers.
- That you may consider the candidate for other roles. Name the area, such as technology roles in Singapore, Indonesia, Australia and New Zealand.
- That you will ask before sending their profile to a client. This is the step that protects you at the disclosure stage, and in Singapore the answer must be in writing.
- How long you keep the data. Give a review period.
- How to withdraw. Give an email address and say what happens next.
An illustrative sentence, which you should adapt with your adviser: "We are [agency]. We will use your details to consider you for this role and for other technology roles we recruit for in Singapore, Indonesia, Australia and New Zealand. Before we send your profile to an employer, we will tell you who it is and ask for your written agreement. You can ask us to delete your details at any time, and we review inactive profiles after [period]."
For candidates in Indonesia, give the request in Bahasa Indonesia and keep it separate from your other terms.
What Software Can and Cannot Do Here
Software can make reuse fast. It cannot decide whether reuse is allowed.
In HyreTech, semantic search covers everyone HyreTech has scored for any role in your workspace, whichever client the role was for. A plain-English query for Client B's role will surface people who first came in for Client A. Each search costs one AI credit, and so does each further page of results.
Scoring is per role: each client role has its own rubric and per-criterion reasoning (see HyreTech for recruiting firms). A search hit therefore has no scorecard for Client B's role until their CV is on that role.
What a candidate was told depends on how they came in. People who applied through a HyreTech job page saw a notice that the hiring company receives their application and decides how it is used. Nothing in it mentions your other clients.
People who joined your talent pool through your company page saw a different notice: if your workspace is set up as a recruitment agency, it tells them you may forward their CV to your client companies for relevant roles, and they ticked a box to accept it.
HyreTech keeps a record of which version of that notice they accepted, and matches pool sign-ups against your open roles for every client. Treat that as the standing permission in the middle row above, not as consent to every submission.
HyreTech also emails people who applied, at most once a week, about up to five other open roles you have listed publicly that match their CV. HyreTech sends these on its own account, the candidate decides whether to apply, and nothing goes to a client.
The submission itself happens outside HyreTech. Your clients do not log in to it, and it has no field for recording consent. Record the candidate's yes where you send the CV, next to the submission.
HyreTech's privacy policy makes you the controller of candidate data in your workspace, with HyreTech processing it on your instructions. The exceptions are talent-pool sign-ups, where HyreTech and you are joint controllers, and HyreTech's own role emails. Our terms leave obtaining candidate consent, where it is required, to you. The consent model is yours to set and to prove.
When a candidate withdraws, there is no delete button. Email privacy@hyretech.ai and HyreTech deletes the candidate within 30 days (how deletion works). HyreTech does not delete inactive profiles automatically, so your review period is yours to run. In Indonesia, stop using the profile the day the withdrawal arrives, since the Law gives you 3 × 24 hours.
Decide The Rule Before The Next Search Opens
The agencies that get into trouble usually did not decide anything. The recruiter on the second client's search found a strong match in the database and sent the CV, because nothing said they should not. Write the rule once: search is allowed within the notice, submission needs a written confirmation, and the confirmation is kept with the submission.
To try the search side on a live role: Start free. The free plan includes one active role and a one-time grant of 20 AI credits.
If you run searches for several clients across Singapore, Indonesia, Australia and New Zealand and want to map the process: Book a demo and we will walk through it with you.
FAQ
Can a recruitment agency send a candidate's CV to a second client?
Only with the right permission, and in Singapore and Indonesia that permission should be written or recorded. Searching your own database for the new role is a use of the candidate's data. Sending the CV is a separate disclosure. Singapore's agency licence requires the candidate's written consent, Indonesia treats the new client as a new purpose, and Australia and New Zealand allow it only for a related purpose the candidate would expect, or with their agreement. HyreTech finds the candidate but does not record consent, so confirm before each submission.
Is searching our own candidate database for a new client role different from sending a profile to that client?
Yes. Searching is a use of the data inside your agency. Sending a profile to a client is a disclosure to another party. Australia's OAIC and New Zealand's privacy principles treat them as separate acts, Indonesia's Law ties each purpose to its own basis, and the second act is where candidates most expect to be asked.
Does a Singapore recruitment agency need written consent before submitting a CV?
If it holds an MOM employment agency licence, yes. Condition 5(a) of the licence conditions bars a licensee from revealing any information about an applicant without the applicant's written consent. The PDPA alone has exceptions, such as the evaluative purpose, but the licence rule is stricter. Keep the candidate's written reply with the submission.
Do we need consent to contact someone we found on a public profile?
It depends on the country. Singapore lets you collect, use and disclose data that was public when you collected it without consent, and a job-opening message is outside the Do Not Call rules. New Zealand allows it where it would not be unfair or unreasonable. Australia has no public-data exception, and you should tell the person how you got their details. Indonesia has no exception at all. In all four, sending the profile to a client is a separate step, so message the candidate first.
Can a candidate's consent to "future roles" cover every client we have?
Rarely, if it is worded broadly. The OAIC says consent must be informed, voluntary, current and specific, and Indonesia's Law asks for consent to specific purposes. A permission that names the area of roles and the markets is stronger than "any client, any time". Confirming each submission with the candidate closes the gap, and in Singapore it is the written consent the licence asks for.
Does a small Australian recruitment agency have to follow the Privacy Act?
Often yes. Businesses with an annual turnover of A$3 million or less are usually exempt, but not if they disclose personal information to others for a benefit, service or advantage without consent. A small agency that sends CVs to clients for a fee without asking the candidate risks falling inside the Act. Getting consent before each submission keeps you on the safe side either way.
Is an email or WhatsApp yes enough consent in Indonesia?
It can be. The PDP Law accepts consent that is written or recorded, including electronically, and you must be able to prove it. Your message should say which client or type of role it is for and why, and if it also asks about other things, the consent request must be clearly separate and in plain Bahasa Indonesia. Keep the reply with the submission record.
If we get the consent wording right, are we fully covered?
No. Consent wording is one part. Your client agreements, your licence and each country's other laws also apply, and a regulator can still look at whether your practice matched your notice. No software, ours included, can certify compliance for you, so ask your legal adviser to review your notice and your submission process.