Receiving applications online.
WHAT IT INVOLVES
Posting positions Receiving applications, usually with file uploads Notifying whoever reviews them Storing candidate data
THE UPLOAD RISK
An application form accepting CV uploads is a file upload handler, with all the risks that carries.
Validate file types strictly, accept only document formats, rename uploaded files, and block execution in the upload directory.
An unvalidated CV upload is a straightforward route to a compromised site.
DATA PROTECTION
Candidate applications contain substantial personal data. Under the NDPR you have obligations: protect it, keep it only as long as needed, and be able to respond if someone asks what you hold.
Delete unsuccessful applications after a reasonable period rather than accumulating them indefinitely.
STORAGE
CVs accumulate. Set a retention policy and act on it.
NOTIFICATIONS
Ensure the notification email actually arrives. An application system where nobody is told of new applications is a common and embarrassing failure.
Test it, and test it again periodically.
