What Happens to Applicant Data When the Candidate Becomes an Employee?

The candidate signs the contract. Recruitment is finished. It may be tempting to move the entire application folder into the employee’s personnel file and leave it there.

Under the GDPR, hiring someone does not automatically make every piece of recruitment data necessary for the rest of their employment.

Recruitment and employment are different purposes

During recruitment, you process information to assess whether someone should be hired.

Once they become an employee, your purposes change.

You now need information for matters such as:

• Payroll
• Personnel administration
• Benefits
• Work planning
• Performance management
• Training
• Legal and regulatory obligations
• Workplace security

Some recruitment information remains relevant. Other information does not. Treating the two as separate processing activities in your register makes the distinction easier to maintain.

What can move to the personnel file?

Depending on the role and applicable law, this might include:

• Identification and contact information
• Qualifications relevant to the job
• Employment history where still necessary
• Information used to prepare the contract
• Evidence of required professional credentials
• Relevant recruitment correspondence

The fact that information was collected lawfully during recruitment does not automatically justify permanent retention.

What should be reviewed?

Consider whether you still need:

• Interviewers’ informal notes
• Old candidate rankings
• Rejected draft assessments
• Information about other vacancies
• Unnecessary copies of the CV
• Information collected from online searches
• Test data that has served its purpose

Some material may still need to be retained for a defined period, for example in connection with possible claims. That does not mean it belongs in the permanent employee file, and your retention policy should say where it lives and for how long.

Update the privacy information

Candidates should have received information about recruitment processing.

Employees need information about the processing that takes place during employment.

This may cover payroll, absence administration, IT systems, access control, performance management, training, benefits and other staff processes, which is what a staff privacy policy is for.

Do not assume the candidate privacy notice covers everything that happens after hiring.

Update access rights

Recruitment files may be accessible to interviewers or external recruiters who no longer need access once the process ends.

Review permissions when the candidate is hired.

The principle remains the same: personal data should be accessible only to people who need it for their role.

Keep the transition controlled

A useful onboarding step is:

1. Identify which recruitment data is still required.
2. Transfer or retain it for the appropriate purpose.
3. Apply the correct retention period.
4. Delete unnecessary copies.
5. Update system permissions.
6. Provide the employee privacy information.

GDPRWise helps organisations distinguish between recruitment and staff processing activities, making it easier to manage personal data throughout the employee lifecycle.