What Happens to Applicant Data When the Candidate Becomes an Employee?

The candidate signs the contract. Recruitment is finished. It may be tempting to move the entire application folder into the employee’s personnel file and leave it there.

Under the GDPR, hiring someone does not automatically make every piece of recruitment data necessary for the rest of their employment.

Recruitment and employment are different purposes

During recruitment, you process information to assess whether someone should be hired.

Once they become an employee, your purposes change.

You now need information for matters such as:

• Payroll
• Personnel administration
• Benefits
• Work planning
• Performance management
• Training
• Legal and regulatory obligations
• Workplace security

Some recruitment information remains relevant. Other information does not. Treating the two as separate processing activities in your register makes the distinction easier to maintain.

For each employment processing activity, identify the purpose and an appropriate legal basis under Article 6 GDPR. This may be necessity for the employment contract, a specific legal obligation or a legitimate interest supported by a necessity and balancing assessment. Signing the contract does not authorise every use of recruitment data. Where data are reused for another purpose, assess compatibility where required under Article 6(4).

What can move to the personnel file?

Depending on the role and applicable law, this might include:

• Identification and contact information
• Qualifications relevant to the job
• Employment history where still necessary
• Information used to prepare the contract
• Evidence of required professional credentials
• Relevant recruitment correspondence

The fact that information was collected lawfully during recruitment does not automatically justify permanent retention.

Verify identity where necessary and record only the identification data needed and lawfully permitted for personnel administration or statutory declarations. Check applicable local rules on identification numbers and identity-document copies; do not keep a full copy by default.

Health data and other special-category data require both an Article 6 legal basis and an applicable Article 9 exception. Criminal-record data are subject to Article 10 and applicable law. Do not automatically transfer such material into an ordinary personnel file.

What should be reviewed?

Consider whether you still need:

• Interviewers’ informal notes
• Old candidate rankings
• Rejected draft assessments
• Information about other vacancies
• Unnecessary copies of the CV
• Information collected from online searches
• Test data that has served its purpose

Give reviewed data one of three destinations: the active personnel file if needed for employment, a restricted archive if retention is justified for legal obligations or claims, or deletion if no justified purpose remains.

CNIL’s recruitment guidance distinguishes active use from limited archiving for evidence. A possible dispute does not justify retaining the whole recruitment file indefinitely. Keep only the necessary evidence, restrict access and document the reason and period in your retention policy.

Different data may need different periods. Hiring does not automatically restart a retention period for every recruitment document. Check applicable local requirements and relevant limitation periods.

Update the privacy information

Candidates should have received information about recruitment processing.

Employees need information about the processing that takes place during employment.

This may cover payroll, absence administration, IT systems, access control, performance management, training, benefits and other staff processes, which is what a staff privacy policy is for.

Provide the Staff Privacy Policy when collecting new employee data. Before reusing existing data for a new purpose, provide the information about that purpose and other relevant details, insofar as the employee does not already have them (Articles 13 and 14 GDPR).

Explain purposes, legal bases, recipients, retention periods or criteria, applicable transfers and rights. Do not assume the candidate privacy notice already covers these staff processes.

Update access rights

Recruitment files may be accessible to interviewers or external recruiters who no longer need access once the process ends.

Review permissions as part of onboarding and remove access that is no longer needed. Include recruitment platforms, shared folders and copies in mailboxes. Confirm current contact details with the employee before transferring them.

The principle remains the same: personal data should be accessible only to people who need it for their role.

Keep the transition controlled

A useful onboarding step is:

1. Identify which recruitment data is still required and confirm that it is accurate.
2. Record the purpose and legal basis for each intended use.
3. Transfer necessary data to the active personnel file, archive only justified evidence with restricted access and delete the rest.
4. Apply the appropriate retention period to each category and remove unnecessary copies.
5. Remove obsolete recruitment access and assign staff access according to roles.
6. Provide the Staff Privacy Policy at the required time.