As a recruitment company, if I use an external company to format CVs that have been shared, do I need to inform the candidates? What are the potential pitfalls of an external company being given confidential CVs that include private information?
Yes, candidates must receive transparent information about this.
Your exact obligations depend on whether your company is acting as a data controller, or as a data processor on behalf of another data controller.
Data controller is whoever determines the purposes and means of processing. If you're working on behalf of candidates, you're likely a controller. If you're working on behalf of companies, you may be a controller or processor depending on further context.
A controller is responsible for the compliance of all processing activities for which they determine the purposes, even if the activities are outsourced to another company.
As the controller, you are responsible for fulfilling data subject rights, in particular the right to transparent information under Art 13 UK GDPR. Per Art 13(1)(e), this information must include “the recipients or categories of recipients of the personal data, if any”. Data processors working on your behalf are recipients. Information is typically provided via a privacy notice.
As a data controller, you are also responsible for ensuring the security and compliance of your processing activities, by determining and implementing appropriate technical and organizational measures (TOMs). See Art 24 and 32. Such measures might include encryption, backup strategies, access controls, training and screening for staff, confidentiality agreements, and anything else. What is appropriate depends on the specific risks you face, the costs of implementing these measures, and on the state of the art. See also the ICO guidance on security.
Per Art 28(1) UK GDPR, if you engage an external company to process personal data on behalf of you, you will ensure that this external company provides “sufficient guarantees to implement appropriate technical and organisational measures”. Per Art 28(3), these sufficient guarantees must be based on an enforceable contract with the data processor (commonly called a Data Processing Agreement, DPA).
A processor is primarily responsible for following the instructions of their controller, as laid down in the DPA pursuant to Art 28(3). Processors are not directly responsible for handling data subject rights, so they need not (and must not) provide their own privacy notice to data subjects. However, they must assist their controller as appropriate, for example by providing necessary information so that the controller can satisfy their responsibilities.
When a processor wants to engage a sub-processor to further delegate processing activities, this must be done in accordance with Art 28. Specifically, the sub-processor must be bound by the same data protection obligations as you are, see Art 28(4). So you'd need to enter a processor-to-processor DPA. Also, you need to obtain prior authorization from your controller to engage that additional processor per Art 28(2).