Applicant Tracking System

What an applicant tracking system is

An applicant tracking system (نظام تتبّع المتقدمين), abbreviated ATS, is a system that gathers job applications in one place and tracks each candidate through the stages of recruitment, from the application to the decision.

The problem an applicant tracking system solves

The problem an applicant tracking system addresses is a procedural one, not a technical one.

Without such a system, applications arrive in an email inbox. Notes on candidates are written in separate files. A candidate is asked the same question twice, because the person who interviewed them first did not write anything down. In the end, nobody knows how far the candidate’s file has got.

An applicant tracking system makes the status of every candidate visible to whoever needs to see it.

What an applicant tracking system includes

An applicant tracking system includes the following elements:

• A single application form and a searchable store of CVs. Every applicant applies through the same form, and the CVs received are kept in a store that can be searched.
• Defined stages. The recruitment pipeline runs through stages defined for it, and the system records the status of each candidate at each of them.
• Interview notes in the candidate’s file. Each interviewer writes notes in the file of the candidate concerned, not in a separate place.
• Message templates. They are used to reply both to the candidates who have been accepted and to those who have not.
• Indicators. They include measures such as time to fill a vacancy and the number of candidates at each stage.

What an applicant tracking system does not do

An applicant tracking system does not decide who is hired. Nor does it create evaluation criteria that the organisation has not set.

If the selection criteria are vague, the system documents vague decisions, only in better order.

The value of an applicant tracking system comes from pairing it with the structured interview, that is, with declared criteria against which every candidate is measured.

The privacy side of an applicant tracking system

Candidate files are personal data about people who are not employees of the organisation. The way they are handled falls under the provisions of the Personal Data Protection Law (نظام حماية البيانات الشخصية) in the Kingdom, the same law that governs employee data privacy. The Personal Data Protection Law was issued by Royal Decree M/19 of 9/2/1443H and amended by Royal Decree M/148 of 5/9/1444H.

That the candidates are not employees does not take their files outside the law. Article 2(1) of the Personal Data Protection Law applies the law to any processing, by any means, of personal data relating to individuals that takes place in the Kingdom, including processing carried out from outside the Kingdom on the personal data of individuals who reside in it, and that scope does not turn on employment. The only exception in Article 2 of the Personal Data Protection Law is an individual processing personal data for purposes that do not go beyond personal or family use, and an organisation keeping the files of its candidates is not within it. Article 1 of the Personal Data Protection Law defines personal data as any data, whatever its source or form, that identifies an individual specifically or makes it possible to identify them directly or indirectly, and among its examples it names the name, the personal identification number, addresses and contact numbers. Candidate files fall within that definition.

The same Article 1 of the Personal Data Protection Law defines the controller as the party that determines the purpose of processing personal data and the manner of that processing. An organisation receiving applications for its vacancies is in that position. Article 1 of the Personal Data Protection Law also defines processing, and the operations it lists include collecting, recording, storing, indexing, arranging, retrieving, using, disclosing and destroying. Receiving applications, storing CVs, recording interview notes and searching the store of CVs are therefore processing within the meaning of the Personal Data Protection Law.

Among the provisions of that law are the following two duties of the controller.

• Specifying the purpose of collection. Four articles set it out. Article 10 of the Personal Data Protection Law permits the controller to collect personal data only from the person it concerns directly, and to process that data only to achieve the purpose for which it was collected, subject to the seven exceptions that article lists. Article 11(1) of the Personal Data Protection Law requires the purpose of collecting personal data to relate directly to the purposes of the controller and not to conflict with any provision established in law. Article 12 of the Personal Data Protection Law requires the controller to adopt a privacy policy, available before collection, that specifies the purpose of collection among its other elements. Article 13(2) of the Personal Data Protection Law requires that, where personal data is collected directly from the person it concerns, that person be told the purpose of collecting it and which of the data requested is mandatory and which is optional.
• Limiting the data to the minimum that serves that purpose. It is set by Article 11(3) of the Personal Data Protection Law, which requires the content of personal data to be appropriate and confined to the minimum necessary to achieve the purpose of collecting it, while avoiding content that would lead to the person being identified specifically once that purpose has been achieved, and which leaves the controls needed for that to the Implementing Regulations of the Law.

Alongside those duties, sound practice has two parts. Access to candidate files is limited to defined people, and a written policy sets how long the files of candidates who were not accepted are kept. Both are practices in how an applicant tracking system is set up. Neither is one of the statutory duties named above.

Automated screening in an applicant tracking system and its limits

Applicant tracking systems allow CVs to be screened automatically according to keywords or conditions.

Automated screening is useful for excluding applications that do not meet an explicit condition, such as a professional licence that the role requires.

But narrowing the conditions can exclude qualified candidates because their CVs are worded differently, not because their qualifications differ.

The principle, then, is to use automated screening to rank applications, not to reject them outright.

This is an explanation of the concept and of the statutory provisions cited, not legal advice.