Employers often accumulate CVs. Some belong to current applicants, others to people who applied months or years ago. Under the GDPR, however, CVs cannot simply be stored indefinitely.
There is no single GDPR retention period that applies to every CV. The correct period depends on why you are keeping it.
During the recruitment procedure
While a vacancy is open, retaining applications is straightforward: you need them to assess candidates and manage the recruitment process.
This can include the CV, cover letter, interview notes, assessments and communications.
Once the recruitment process ends, however, the original purpose changes or disappears.
What happens after rejection?
You do not have to delete every unsuccessful candidate’s file the minute the vacancy is filled.
There may be a legitimate reason to retain certain information for a limited period, for example to answer questions about the recruitment process or establish, exercise or defend legal claims. That reasoning rests on one of the six legal bases, so record which one you rely on.
The appropriate period depends partly on applicable national employment and anti-discrimination rules.
This is why organisations should set retention periods with their own legal context in mind rather than copying an arbitrary number from the internet.
Can you keep the CV for future vacancies?
Possibly, but this is a different purpose.
The candidate originally gave you their CV to apply for a particular vacancy. Keeping it because you want to contact them about future opportunities turns the file into part of a talent pool.
Be transparent about that purpose in your candidate privacy notice and determine an appropriate retention period.
Do not convert every unsuccessful application automatically into a permanent talent database.
Is two years always the correct period?
No.
You will often see specific periods suggested online, but the GDPR itself does not say that every employer may keep every unsuccessful candidate’s CV for a fixed number of months or years.
Retention should be justified by purpose and, where relevant, national law.
A multinational organisation may therefore need different practical retention rules in different countries.
What about spontaneous applications?
The same principles apply.
If someone sends you a CV without applying for a particular vacancy, decide what you are going to do with it.
If you want to retain spontaneous applications for future vacancies, tell candidates how the process works and how long their information will be kept.
Don’t forget copies
Deleting a candidate from your recruitment platform may not remove all copies.
CVs can also be stored in:
- HR inboxes
- Hiring managers’ email accounts
- Shared drives
- Downloads folders
- Recruitment agency portals
- Interview notes
- Spreadsheets
- AI or assessment tools
Your retention policy should cover the whole recruitment process, in the same way a data retention policy covers the rest of your organisation.
Automate deletion where possible
Retention policies only work if they are implemented.
Applicant tracking systems often allow organisations to set deletion or review dates. Use these functions where appropriate instead of relying on someone to remember to clean up old applications manually.
Document your retention rules
For recruitment, define at least:
- How long active applications are retained
- How long rejected applicant files are retained after the procedure
- How long talent-pool information is retained
- When retention periods are reviewed
- Who is responsible for deletion
GDPRWise helps organisations document retention periods as part of their processing activities, making it easier to turn “we don’t keep data too long” into an actual rule.
GDPRWise records a retention period for every recruitment processing activity, so deletion becomes a documented rule instead of a good intention.