A recruitment agency should switch from spreadsheets to an ATS when more than one person edits the candidate list, when you can no longer say who was sent to which client and when, or when you could not answer a subject access request within a month. There is no magic number of candidates or users; the trigger is when the spreadsheet starts losing information or creating risk.
Many agencies still run on Excel or Google Sheets, and it works well at the start: it is free, flexible and familiar. This guide sets out the practical signs you have outgrown it, the risks of staying, including UK GDPR, and what moving from a CSV actually involves. It was last updated on 15 October 2026.
What are the signs an agency has outgrown spreadsheets?
These are practitioner signs, not thresholds from a study; we found no sourced figure such as "X candidates" or "Y users".
- Several people edit the same list. You get version conflicts, files called "final_v3.xlsx" and overwritten rows.
- The same candidate appears several times, under different emails, with a typo in the name, or added by two consultants.
- You cannot answer "who did we send to this client, and when?" without searching inboxes. That leads to duplicate submissions and ownership disputes with clients.
- CVs live somewhere else: in email attachments, on desktops or in Dropbox, separate from the sheet.
- Warm candidates and client follow-ups get forgotten, because nothing reminds you.
- Reporting means counting by hand: placements, revenue and activity per consultant.
- A departing consultant could take the spreadsheet with them.
That last risk is real. In 2018 the Information Commissioner's Office prosecuted a recruiter who took 272 records from one recruitment business to another; he was fined £355 plus costs.
What are the risks of keeping candidates in a spreadsheet?
Spreadsheets are not illegal under UK GDPR, which is technology-neutral. The problem is proving you are handling data properly. Article 5(2) requires you to demonstrate compliance, and a spreadsheet has no record of who viewed, edited or exported data, no lawful basis or source per record unless you add one, and no trigger for deleting old records.
- Retention. The ICO's draft guidance on keeping recruitment records sets no fixed retention period: you must not keep information longer than you need it. Talent pools are acceptable if candidates are told, there is a lawful basis and unneeded data is deleted. The guidance is still a draft and under review after the Data (Use and Access) Act 2025.
- Privacy notices for sourced candidates. If you find someone on LinkedIn or a CV database and store them, Article 14 requires you to give them privacy information within a month, at first contact, or before you first share their details, whichever is earliest. A spreadsheet will not track this for you.
- Access and erasure requests. You must respond within a month. With copies across sheets, inboxes and downloads, you cannot reliably find or delete everything.
- Security. Sheets get emailed, downloaded and shared by link. In 2016 the ICO fined Islington Council £70,000 after personal data was hidden in a spreadsheet pivot table released in response to an information request.
- Marketing email. Bulk emails to candidates and clients fall under PECR, and from 5 February 2026 PECR fines rose to UK GDPR levels.
Most agencies also need to pay the ICO data protection fee. For micro organisations, with turnover under £632,000 or no more than ten staff, it is £52 a year, or £47 by direct debit, from 17 February 2025. Our guide to GDPR in an ATS explains consent, retention and requests in more depth.
What does an ATS do that a spreadsheet cannot?
An ATS keeps one record per person and per client, with the CV, notes, emails and every job they have been put forward for attached. It flags likely duplicates, shows who owns a relationship, and lets several consultants work at once without overwriting each other. It can hold a lawful basis per candidate, log consent requests, flag records as they age, and produce a subject access export or erase a person on request.
In Crumblelead, for example, CSV imports are checked for likely duplicates by email, phone and name. Each candidate can carry a lawful basis, consent requests are logged, retention rules flag records as they age, and a subject access request produces a single export. Reports cover placements, revenue and consultant activity without counting by hand. See the GDPR tools for the detail.
What does moving from a spreadsheet to an ATS involve?
This is a practical checklist; there are no sourced timings, and messy data is what makes a move slow.
- Export each sheet to CSV in UTF-8. Excel's default CSV encoding can break accented names.
- Separate the record types. Candidates, clients, contacts and jobs are separate imports, and agency spreadsheets often mix them.
- Remove duplicates before importing, using email first, then phone, then name and LinkedIn URL.
- Map columns to fields, including owner, source, last contact date and status, and add a lawful basis and date to support retention later.
- Attach CVs separately. A CSV cannot carry files, so bulk CV upload is a separate step.
- Test with 50 to 100 rows, check the result, then run the full import.
- Leave behind people you no longer have a reason to hold, in line with the retention principle.
- Make the sheet read-only on go-live day, so there is one source of truth.
In Crumblelead you can import candidates and clients from CSV yourself, upload CVs in bulk to be parsed into profiles, or ask us to do it: migration is free on any paid plan and typically takes about a week. See migration help and our 30-day rollout plan.
What are the common misconceptions?
- "Spreadsheets are illegal under GDPR." False. The difficulty is demonstrating accountability, retention, security and request handling.
- "You need consent to hold a CV." Usually not for agencies, which mostly rely on legitimate interests with an Article 14 notice. Consent is one lawful basis, not the default.
- "The ICO says delete candidate data after six months." There is no fixed period in ICO guidance. Six months is a common practice tied to the discrimination claim window, not a rule.
- "Migration takes months." For a small agency with clean data it is usually days to a few weeks.
Where Crumblelead fits
Crumblelead is an ATS and recruitment CRM for perm-focused small agencies, at $30 per user per month or $25 billed annually, with no seat minimum and a 14-day trial with no card. If you are moving off spreadsheets, start with one live job and a handful of clients and see whether it saves you time. Compare options in our best ATS for small agencies guide.
FAQ
Is it legal to keep CVs in a spreadsheet?
Yes. UK GDPR does not ban any particular tool. You still need to show a lawful basis, keep data secure, delete it when no longer needed and answer access requests within a month, which is hard in spreadsheets.
How many candidates is too many for a spreadsheet?
There is no sourced threshold. The practical signs are several people editing the list, duplicate records, and not knowing who was sent to which client.
Does an agency using spreadsheets need to pay the ICO fee?
Most do, whatever tool they use. For micro organisations the fee is £52 a year, or £47 by direct debit, from 17 February 2025.
Sources
ICO, Keeping recruitment records (draft guidance; consultation December 2023 to March 2024).
Data Protection (Charges and Information) (Amendment) Regulations 2025, SI 2025/63.
https://www.legislation.gov.uk/uksi/2025/63/made
Lewis Silkin, fee payable to the ICO to increase in February, 6 February 2025.
ICO prosecution of a recruiter for taking 272 records, 2018.
ICO monetary penalty, Islington Council, 2016.
CMS, Data (Use and Access) Act 2025 commencement, 23 July 2026.
Element, GDPR in recruitment and Article 14 sourcing, 2025.