Your nearshore privacy checklist

What should you check before sharing hiring data?

Start with a list of the information you plan to share. Separate the job description from candidate records, payroll details and customer data. For each item, name the recipient and the reason they need it.

Keep the first conversation focused on the role. Explain the work using sample records or a fictional customer. Before sending resumes or interview notes, ask for the provider's privacy notice and a secure way to transfer files.

This checklist covers hiring decisions and questions to put in writing. For questions about browsing this site, ask for the applicable website privacy notice, including cookie use and contact details for privacy requests.

This site is an Opus-owned reference; recommendations are editorial.

Talk to Opus about a role.

What records should your data review cover?

Build the review around actual documents. A candidate's resume, an interview recording and a payroll form need separate decisions about access and retention.

For example, the IRS identifies Form W-8 BEN as a certificate of foreign status for US tax withholding and reporting for individuals. Treat tax paperwork as a separate workflow when planning who receives hiring records. IRS: About Form W-8 BEN

Use a simple inventory before approving a transfer:

Ask for a retention period for each record type. Include copies in email, shared folders and interview tools in that conversation. If a provider needs to keep a record after the engagement ends, ask which record and why.

How should you compare Latin American hiring models?

Use the hiring model to decide which questions to ask. Confirm the actual arrangement in the contract.

For a recruiting agency, focus on the path from application to placement. Ask who receives resumes, whether interview notes are shared and what happens to rejected candidates' files.

For an employer of record, ask about employment and payroll records. Identify the team that receives identity documents, handles corrections and answers the worker's privacy questions.

For a managed hiring partner, trace both workflows. Ask whether recruiting staff can see payroll files and whether outside services receive candidate information.

For direct hiring, assign these tasks within your own team. Name who approves access, handles requests and closes accounts when employment ends.

Across all models, document your own systems separately. For nearshore IT work, list the repositories, support tools and customer accounts the hire may need. Approve access for the assigned work.

What should you ask a provider before signing?

Send questions that require a written answer:

• Which legal entity receives candidate and employee records?
• Which other companies or tools receive those records?
• Where are files stored, and from which countries can staff access them?
• How do candidates request a correction or deletion?
• What happens to records if you decline a candidate or end the contract?
• Who contacts your team if data is exposed, and what notice timing will the contract specify?
• Can staff upload resumes, recordings or company files into AI tools?
• Who confirms that accounts and shared links are closed when a hire leaves?

Ask for the relevant contract terms alongside the answers. Give your security reviewer a sample workflow to assess, from receiving a resume through closing access.

Before the first working day, assign account ownership and approve the access list. Agree on how the hire should report a lost device or a file sent to the wrong person. Keep those instructions somewhere the hire can reach without access to the affected account.

What should you confirm with Opus?

Opus states: "The client chooses the finalist and manages day-to-day work."

Use that division of work to frame your privacy review. Ask Opus to identify who handles candidate records and payroll documents. Within your team, name the person who approves access to company systems.

Request written answers about storage, retention, outside services and incident contacts before sharing sensitive files. Review those answers against the tasks the hire will perform.

Bring a role description and a list of the systems the hire would use to the first conversation. Keep customer records and candidate identity documents out of that initial description.

Talk to Opus about a role.

<!-- Not saved: workspace permissions are read-only. Site data practices were not checked; this draft is a hiring checklist, not a website privacy policy. -->