Recruitment Platforms & Philippine Compliance — Research Report for the ERPat Recruitment Module

Documentation-only (no runtime consumer). Produced 2026-07-04 by a multi-source, fan-out web research pass with adversarial verification of legal claims. Backs the roadmap in specs/recruitment-module/01-END-TO-END-PLAN.md.

Scope. Feature benchmark of recruitment platforms, multi-tenant applicant-identity architecture, and Philippine legal compliance for ERPat's standalone Recruitment module with a public multi-tenant Job Portal (JobStreet-style: one careers site aggregating openings across tenant companies; today each application creates a per-tenant users row with user_type='applicant'; the 5-step apply wizard already captures RA 10173 consent).

Method & verification notes. Multiple independent sources per claim; laws verified against primary sources (lawphil.net, officialgazette.gov.ph, privacy.gov.ph, Supreme Court e-Library, DOLE). Claims that could only be supported by secondary sources are tagged [secondary]; anything unconfirmable is tagged [UNVERIFIED] rather than asserted. Known gaps: (a) there is no NPC issuance fixing a specific retention period for unsuccessful-applicant data — this absence is itself a finding, not an omission; (b) LinkedIn's "profile snapshot at apply time" behavior is confirmed only from secondary commentary; (c) whether a pure-advertising online job board needs a DOLE PEA license is a legal gray area flagged below, not settled here.

Executive summary

• Table-stakes features are consistent across the market: reusable central candidate profile, structured screening questions with knockout logic, kanban-style pipeline with stage-triggered emails, interview scheduling with self-service slots, offer letters, talent pools, job alerts, and resume parsing appear in essentially every benchmarked platform. ERPat's 5-step wizard covers "apply"; the biggest functional gaps are pipeline management, screening questions, interview scheduling, and offers.
• Every major job board uses one central candidate identity + per-company application records — never a per-company applicant account. SEEK/JobStreet's own privacy architecture treats SEEK as processor and each employer (Advertiser) as the data controller of the application it receives (JobStreet Privacy Policy). ERPat's per-tenant applicant rows should evolve into a central portal identity with snapshot-on-apply into each tenant DB — this fits database-per-tenant well and mirrors how boards isolate employer copies of candidate data.
• PH compliance is mostly about four things: (1) RA 10173 consent, privacy notice, data-subject rights, and NPC registration thresholds; (2) RA 10911 — job ads may not state age preferences and applications may not require age/birthdate declarations, with ₱50k–₱500k fines (RA 10911); (3) no fees may ever be charged to workers for local placement — charge employers only (DO 141-14); (4) Labor Code Art. 13(b) defines "recruitment and placement" broadly enough (it includes "advertising for employment") that the portal's legal positioning needs deliberate design (Labor Code).
• Retention: PH law sets no fixed period for applicant data; the NPC applies the general "only as long as necessary" principle, and NPC Advisory Opinion 2017-24 lists factors (legal requirements, prescription periods, DOLE/BIR rules, industry standards) [secondary]. International benchmarks converge on ~6–24 months for unsuccessful candidates (CNIL: 2 years from last contact). A configurable retention-purge cron with anonymization — the Greenhouse/Workable pattern — is the right implementation.

1. Feature benchmark

1.1 Job boards / portals (candidate-facing marketplaces)

Notable specifics: Indeed only allows pre-made screeners as deal-breakers (custom questions can't auto-reject), and auto-rejected candidates remain reviewable — a good fairness pattern for ERPat to copy. Indeed reports jobs with screeners are ~50% likelier to produce a hire (indeed.com/hire). LinkedIn deliberately does not block unqualified applies; it filters after submission (LinkedIn Help).

1.2 ATS / recruitment software (employer-side)

Table-stakes synthesis (present in all or nearly all platforms — the minimum credible feature set): job posting with own careers page; configurable pipeline stages with kanban and stage-triggered templated emails; structured screening questions with knockout handling; interview scheduling with feedback/scorecards; offer letters from templates; talent pool retention (with consent); resume parsing at least for contact fields; job alerts (board-side); hire-to-employee conversion (ERP-side). ERPNext is the closest architectural analogue to ERPat (ERP-embedded, opening→applicant→interview→offer→employee chain) and a good floor to match; Odoo shows the same floor plus self-scheduling and kanban polish.

2. Multi-tenant applicant identity patterns

Where ERPat is today: applicant identity is fragmented — one users row (user_type='applicant') per tenant DB per application. A candidate applying to 3 tenant companies has 3 disconnected accounts, 3 passwords, no unified application history, and no way to reuse a profile. No major job board works this way.

Pattern A — central identity + per-tenant membership/application records (the industry standard). One global account owns authentication and the master profile; each company relationship is a separate record scoped to that company. Auth0's multi-organization architecture states it directly: "organizations group users, but do not own identities … the same user can belong to multiple organizations simultaneously," with roles assigned within an organization context (Auth0 docs). Microsoft's multitenant guidance likewise treats identity as a solution-level concern stored in a shared identity store, separate from tenant-scoped authorization data (Azure Architecture Center — identity; tenancy models). For ERPat: a portal/central database (the primary DB already used for login) holds portal_applicants (auth + master profile); each tenant DB holds only applications referencing the central applicant by immutable ID.

Pattern B — snapshot-on-apply (profile denormalization into the application). At apply time, copy the relevant profile fields + resume file into the tenant's application record, so the employer evaluates the profile as of application and later profile edits don't mutate a submitted application. Evidence this is the market behavior: LinkedIn sends the employer "a snapshot of your profile information" when you apply [secondary] (greatresumesfast.com); JobStreet's Talent Search serves the default resume current at access time for sourcing, but submitted applications carry the documents attached at submission (SEEK Talent Search). For a database-per-tenant system the snapshot is doubly attractive: it removes any need for cross-DB joins at read time (Azure guidance notes cross-database queries are the structural cost of database-per-tenant sharding — storage/data approaches), and it makes each tenant's data self-contained for backup/restore/export.

Pattern C — consent-per-company (each employer is its own controller). SEEK/JobStreet's privacy policy is explicit: when SEEK collects personal information on behalf of an Advertiser, "SEEK is the data processor, and the Advertiser is the data controller," and what the employer does with its copy "is not within SEEK's control" (JobStreet Privacy Policy; SEEK privacy PDF). Under RA 10173 the same logic makes each tenant company a personal information controller of the applications it receives, with ERPat (portal operator) as controller of the central account and processor/co-controller of tenant application flows. Consequence: consent must be recorded per application/per tenant, not once globally — a consent ledger row (who, which tenant, which purpose, which privacy-notice version, timestamp) alongside every application.

Trade-offs for ERPat's database-per-tenant runtime:

3. PH compliance requirements

3.1 RA 10173 — Data Privacy Act of 2012 (Official Gazette; NPC consolidated text; amended IRR) [primary]

• Processing requires a lawful basis (consent or another §12/§13 criterion). Recruitment data routinely includes sensitive personal information (government IDs, health data), which has stricter §13 rules — the apply wizard's existing consent capture is the right basis, but it must name the specific tenant employer and purpose.
• Data subject rights: to be informed, access, rectification, and erasure/blocking of data that is incomplete, outdated, false, or unlawfully obtained (§16); data portability in a structured, commonly used electronic format (§18); damages for violations.
• NPC registration (NPC Circular 2022-04): a PIC/PIP must register its data processing systems and DPO if it employs ≥250 persons, or processes sensitive personal information of ≥1,000 individuals, or its processing likely poses risk to data subjects (Circular 2022-04 PDF) [primary]. A multi-tenant job portal will cross the 1,000-SPI threshold quickly — ERPat and/or hosting tenants should plan for registration, a designated DPO with dedicated email, and a privacy notice per tenant.
• Breach notification to NPC within 72 hours applies to qualifying breaches [secondary — widely stated in NPC materials; exact circular text not re-fetched this session].

3.2 RA 10911 — Anti-Age Discrimination in Employment Act (2016) + IRR DO 170-17 (lawphil; DO 170-17 PDF) [primary]

• Unlawful for an employer to "print or publish … in any form of media, including the internet, any notice of advertisement relating to employment suggesting preferences, limitations, specifications, and discrimination based on age" — and unlawful to require declaration of age or birth date during the application process.
• The prohibition binds publishers too — i.e., the portal itself, not just the tenant employer. ERPat must both validate tenant job ads and keep age/birthdate out of the default application form (collect date of birth only post-offer/onboarding, or where a §6 exception is certified).
• Exceptions (§6): bona fide occupational qualification, bona fide seniority system, legitimate retirement plan, or DOLE-certified necessity. Penalties (§7): ₱50,000–₱500,000 fine and/or 3 months–2 years imprisonment; corporate officers personally liable.

3.3 RA 6725 (1989) — discrimination against women (lawphil; SC e-Library) [primary] — unlawful to discriminate against any woman employee "with respect to terms and conditions of employment solely on account of her sex," including lesser pay for work of equal value and favoring males in promotion/training. The Labor Code also prohibits requiring non-marriage as a job condition (stipulation-against-marriage provision, Art. 136 as originally numbered — see Labor Code). Practical portal rule: block gender-restricted job ads ("male only", "single females preferred") absent a BFOQ. Related but not re-verified this session: RA 9710 (Magna Carta of Women) and RA 7277 (Magna Carta for Disabled Persons, equal-opportunity provisions) — include in ad-validation wordlists, but verify exact section text before quoting them in product copy [not re-verified this session].

3.4 Labor Code Arts. 13, 25–39 — recruitment & placement; fees (lawphil PD 442) [primary]

• Art. 13(b): "recruitment and placement" is "any act of canvassing, enlisting, contracting, transporting, utilizing, hiring or procuring workers, and includes referrals, contract services, promising or advertising for employment, locally or abroad, whether for profit or not"; any entity that "offers or promises for a fee, employment to two or more persons" is deemed engaged in recruitment and placement.
• Private participation requires DOLE licensing (Art. 25 et seq.; PEA licensing via DOLE regional offices — DOLE-NCR PEA page); illegal recruitment is recruitment by non-licensees (Art. 38). Prohibited practices include furnishing false employment notices (Art. 34).
• DO 141-14 (Revised Rules on Recruitment and Placement for Local Employment, issued under Arts. 5, 13, 25–39): "No fees whatsoever shall be collected nor deducted from the salaries or wages of the workers"; agencies may charge the employer a service fee (SC e-Library full text; DOLE announcement).
• Gray area (flagged, not resolved): whether a portal that only hosts employer-posted ads (never selecting/referring workers, never charging candidates) is itself "engaged in recruitment and placement" is not squarely settled in any issuance found; the Art. 13(b) "advertising" prong and the for-a-fee presumption argue for caution. Mitigations: charge only employers, never candidates; position ERPat tenants as direct employers advertising their own vacancies (not third-party recruiters); emulate PhilJobNet's practice of verifying employer legitimacy before allowing posting (philjobnet.gov.ph). Obtain formal legal advice before monetizing candidate-side features. DO 174-17 is about contracting/subcontracting arrangements, not job advertising — it does not directly govern a job portal [clarification; commonly confirmed but full text not re-fetched this session]. POEA/DMW rules apply only to overseas employment and are out of scope for local hiring.
• DOLE PEA licensing detail (if ERPat or a tenant operates as an agency): Filipino ownership rules apply — sole proprietors must be Filipino; corporations ≥75% Filipino-owned (Labor Code Art. 27; filepino summary [secondary]).

3.5 Employer duties at hiring (attach at employment, not at application) [primary statutes; procedural details secondary] — SSS coverage from first day of employment (RA 11199 / RA 8282 regime; sss.gov.ph employer page); PhilHealth under RA 7875 as amended by RA 10606/RA 11223, new hires reported within 30 days; Pag-IBIG mandatory for SSS-covered employees (RA 9679); BIR Form 1902 for first-time TIN holders (Kittelson & Carpo guide [secondary]). Portal implication: the hired transition should trigger an onboarding checklist that collects TIN/SSS/PhilHealth/Pag-IBIG numbers — and this is exactly the point where applicant data legitimately converts to employee data with a different (longer) retention regime.

3.6 Practical compliance checklist for the ERPat Job Portal

4. Data retention & candidate rights

• No fixed PH statutory retention period exists for unsuccessful-applicant data. The governing rule is the DPA's general principle that personal data be retained "only for as long as necessary" for the declared purpose (RA 10173 §11; IRR). NPC Advisory Opinion 2017-24 (on employment records) lists the factors for setting a period: applicable legal requirements, prescription periods, DOLE rules, BIR regulations, industry standards (DivinaLaw summary [secondary — NPC PDF returned 403 this session]). No NPC opinion fixing a number for rejected applicants was found — any specific default ERPat ships is a policy choice to document, not a legal mandate.
• International benchmarks (useful defaults, persuasive to NPC-style regulators): France's CNIL — 2 years from last contact for unsuccessful candidates unless the candidate consents to longer, with candidates informed and able to object; plus restricted-access intermediate archiving (~5 years) for discrimination-litigation defense (CNIL retention sheet; Claeys & Engels on CNIL HR guidelines [secondary]). UK ICO guidance sets no fixed number; commentary converges on ~6 months–2 years tied to claim windows and talent-pool opt-ins [secondary] (Trilateral on ICO draft guidance). A configurable 6–24-month default (suggest 12) with explicit talent-pool opt-in extension is defensible.
• Hired candidates are different: once hired, records fall under employment-records retention — DOLE's Omnibus Rules require keeping employee records at least 3 years from last entry, matching the Labor Code's 3-year money-claims prescription (Art. 291/306) [secondary — DivinaLaw citing Omnibus Rules Book III, Rule X §12]. The purge cron must therefore exclude hired applicants and instead convert their data into the employee record.
• Candidate rights mechanics (RA 10173): access and portability (structured, commonly used electronic format, §18); rectification; erasure/blocking of incomplete/outdated/false/unlawfully obtained data (§16); complaint to NPC and damages (lawphil RA 10173). Because tenant employers hold snapshots as controllers, an erasure request received centrally must fan out to every tenant DB holding that applicant's snapshot — track holdings in a central applicant_tenant_copies index.
• How ATS products implement purge — patterns to copy:
  • Greenhouse: per-office data-retention rules; candidates are "marked for deletion after they've been hired or rejected from all applications" and the period has passed; admin chooses which fields to strip, producing an anonymized record (name, recordings, etc.); under an "explicit consent" legal basis a consent question is auto-appended to job posts (retention rule config; GDPR overview; legal basis).
  • Workable: account-wide retention clock from profile creation (e.g., 24 months) auto-deleting across active jobs/archives/talent pool; activity-based exclusion (recent comments/emails/evaluations defer deletion); uncontacted sourced profiles auto-delete after 30 days; pre-purge email offering the candidate a self-service delete link (Workable GDPR automation).
  • Zoho Recruit / Lever: consent capture, retention settings, and anonymize/erase workflows exist but with less publicly documented granularity [secondary] (zoho.com/recruit; lever.co).
  • Synthesis for ERPat: anonymize rather than hard-delete where statistics matter (keep the application row for funnel metrics, strip PII fields + files), exclude hired/active candidates, warn candidates before purge, and log every purge action.

5. Recommendations for ERPat (prioritized)

Explicit non-recommendations: do not charge candidates for anything (DO 141-14/Art. 32); do not let tenants see the live central profile (snapshot only — controller separation); do not ship a hard-coded retention number as "legally required" (none exists in PH — ship a documented configurable default).

Sources

Philippine law & regulators (primary): RA 10911, lawphil · DO 170-17 IRR (PDF) · RA 6725, lawphil · Labor Code PD 442, lawphil · DO 141-14, SC e-Library · DO 141-14, DOLE · RA 10173, Official Gazette · RA 10173, NPC · RA 10173 IRR as amended (PDF) · NPC Circular 2022-04 (PDF) · DOLE-NCR PEA licensing · PhilJobNet · SSS employer page

PH secondary legal: DivinaLaw on NPC AO 2017-24 & DOLE 3-year rule · Kittelson & Carpo new-hire reporting · FilePino PEA guide

Retention benchmarks: CNIL retention sheet · Claeys & Engels on CNIL HR guidelines · Trilateral on ICO draft recruitment guidance

Platforms & ATS (first-party): Indeed screener questions · LinkedIn screening questions · LinkedIn screening answers · SEEK Talent Search · SEEK Pass · JobStreet profile · JobStreet Privacy Policy · SEEK/JobStreet privacy PDF · Kalibrr employers · Kalibrr assessments · Greenhouse retention rules · Greenhouse GDPR overview · Greenhouse legal basis · Workable GDPR automation · Zoho Recruit · Zoho candidate management · Lever · OrangeHRM recruitment · Odoo Recruitment docs · Odoo recruitment features · Frappe HR recruitment · Frappe Job Applicant · Frappe Job Offer

Architecture: Azure tenancy models · Azure storage/data approaches · Azure identity considerations · Auth0 multiple-organization architecture · LinkedIn apply snapshot (secondary) · Kalibrr, Wikipedia