Employers often accumulate CVs. Some belong to current applicants, others to people who applied months or years ago. There is no single GDPR retention period for every CV: keep identifiable information only while it is necessary for a defined, lawful purpose.
Articles 5(1)(b), (c) and (e) GDPR require purpose limitation, data minimisation and storage limitation. Set a justified period for each purpose before collecting data, and delete data when that purpose no longer justifies retention.
During the recruitment procedure
Retain the information necessary to assess the application and manage the procedure, not automatically everything a candidate sends. This may include a CV, cover letter, relevant interview notes, assessments and communications.
Document the applicable lawful basis. Article 6(1)(b) GDPR can cover steps necessary at the candidate’s request before an employment contract; other activities need their own assessment. A vacancy remaining open does not by itself justify retaining every rejected or withdrawn application.
When the procedure ends or a candidate withdraws, review what is still necessary. If you hire someone, transfer only the information needed for employment administration to the personnel file and apply the retention rules for that purpose.
What happens after rejection?
You do not have to delete every unsuccessful candidate’s file the minute the vacancy is filled. Limited retention may be necessary to explain the decision or establish, exercise or defend legal claims.
Identify the actual purpose and applicable lawful basis. If relying on Article 6(1)(f) GDPR, document the legitimate interest, necessity and balance with the candidate’s rights. A general fear of litigation does not justify keeping complete files indefinitely.
Check applicable local law and guidance, including relevant claim periods and when they start. Keep only necessary evidence, restrict access to those handling the matter, and separate it from active recruitment use. For an actual dispute, document any suspension of scheduled deletion, review it and delete the records once the justification ends.
Article 17(3)(e) GDPR provides an exception to erasure where processing is necessary for legal claims. It is not a standalone lawful basis or permission to reuse the archive for future vacancies.
Can you keep the CV for future vacancies?
Possibly, but future recruitment is a separate purpose. Explain it before starting that use and select an appropriate lawful basis.
Valid consent under Articles 6(1)(a) and 7 GDPR must be freely given, specific, informed and unambiguous, and as easy to withdraw as to give. Refusal must not disadvantage the candidate. A privacy notice or silence is not consent.
Legitimate interests under Article 6(1)(f) may be available where the circumstances support it. Assess and document necessity, reasonable expectations, impact and safeguards before relying on it. It is not an automatic alternative when consent is refused or withdrawn. Check applicable local requirements and supervisory guidance.
Explain the purpose, basis and retention period, or criteria where a period cannot be given, in your candidate privacy notice. Articles 13 and 14 GDPR govern that information. Keep only a relevant profile, not automatically the entire interview file; review accuracy and delete outdated records. Consent does not authorise unlimited retention.
Is two years always the correct period?
No. Two years is neither a universal GDPR minimum nor a universal maximum. A period recommended for one purpose or country cannot simply be applied to every recruitment file.
Check local law and supervisory guidance, then justify the period for each purpose and data category. State its starting event, such as the recruitment decision or a meaningful interaction with a talent-pool candidate. Do not restart the clock automatically with a bulk email, an internal access or a routine data update.
What about spontaneous applications?
The same principles apply. Decide whether you are assessing the person for a current role or proposing inclusion in a talent pool.
Receiving an unsolicited CV does not automatically authorise indefinite storage or every future use. Give the relevant privacy information, identify the lawful basis and set a retention period. If there is no justified purpose to retain it, delete it.
What if a candidate asks for deletion?
Do not wait for your scheduled deletion date. Articles 12, 17, 18 and 21 GDPR govern requests and relevant exceptions.
If consent is withdrawn, stop the consent-based talent-pool processing. If relying on legitimate interests, assess an objection under Article 21(1): stop unless you can demonstrate overriding compelling grounds or processing necessary for legal claims. An objection to direct marketing must always end that use. A practical talent-pool policy is to stop future vacancy contacts when requested.
Retain separate records only where a valid, necessary justification remains, such as a legal duty or legal claims, and explain any refusal to erase. Consider restriction where Article 18 applies. Respond without undue delay and normally within one month; any permitted extension must be explained within that first month.
Don’t forget copies
Deleting a candidate from your recruitment platform may not remove all copies.
CVs can also be stored in:
- HR inboxes
- Hiring managers’ email accounts
- Shared drives
- Downloads folders
- Recruitment agency portals
- Interview notes
- Spreadsheets
- AI or assessment tools
Your retention policy should cover the whole recruitment process, in the same way a data retention policy covers the rest of your organisation.
Include paper copies and agree deletion responsibilities with service providers. Providers processing on your behalf must follow documented instructions and assist with rights requests under Article 28 GDPR. Confirm how backups expire and how deleted records are prevented from returning to active use after a restore.
Automate deletion where possible
Retention policies only work if they are implemented.
Applicant tracking systems often allow organisations to set deletion or review dates. Use these functions where appropriate instead of relying on someone to remember to clean up old applications manually.
A review date must lead to a documented decision, not automatic renewal. Test the deletion process and keep a proportionate record of completion without retaining the CV merely to prove it was deleted.
Document your retention rules
For each recruitment purpose, record:
- The data categories and lawful basis.
- The justified retention period and its starting event.
- The reason for any restricted legal-claims archive and its review date.
- How withdrawal, objection, erasure and restriction requests are handled.
- The systems, copies and providers covered, including backup arrangements.
- Who carries out deletion and how completion is checked.
Explain these rules to candidates in clear language. Reflect them in your record of processing activities, where required, including envisaged erasure time limits where possible under Article 30 GDPR.
GDPRWise records a retention period for every recruitment processing activity, so deletion becomes a documented rule instead of a good intention.