You interview a strong candidate, but someone else is a better fit for the current vacancy. Six months later, another position opens. Can you simply retrieve the old CV and contact them?
Yes, if you set it up properly. Keeping unsuccessful candidates for future recruitment is a separate purpose, and the work is in deciding that deliberately rather than discovering it later.
The original application has a purpose
When a candidate applies for a particular job, the immediate purpose is clear: assess whether they are suitable for that vacancy.
Once the recruitment procedure is complete, that purpose largely ends.
Keeping the candidate’s information because another suitable vacancy might arise later is a new or additional purpose.
That does not automatically make it unlawful. It means you need to manage it properly, in the same way you would manage how long you keep a candidate’s CV after the procedure closes.
Be transparent
Candidates should know if their information may be retained for future recruitment.
Explain:
- Why you want to retain it
- What information you will keep
- How long you will keep it
- Who can access it
- How candidates can exercise their GDPR rights
Avoid vague statements that allow you to retain applications forever.
Do you always need consent?
No. Two legal bases work here.
Consent is usually the simplest for a smaller employer: ask the candidate at the point of rejection whether you may keep their details for future vacancies. Legitimate interests works too, provided you carry out and record a balancing assessment, tell candidates clearly and let them object.
What matters is that you pick one before you keep the file. Do you need consent to keep a candidate’s CV? sets out both routes and when each one fits.
Set an expiry date
A useful talent pool has a lifecycle.
A CV that was highly relevant three years ago may now contain an old job title, outdated skills and obsolete contact details.
Set a retention period. At the end of it, either delete the information or, where appropriate, ask whether the candidate wants to remain in the talent pool. Your data retention policy is the natural place to record that period.
Keep only useful information
You may not need the entire original recruitment file.
Interviewers’ internal comments, old assessments and other material collected for the first vacancy may not be necessary merely to contact the candidate about a new opportunity.
Apply data minimisation to the talent pool itself.
Make leaving easy
Candidates should have a simple way to tell you that they no longer want to be considered for future vacancies.
When someone objects or withdraws consent where consent is your basis, ensure the request reaches all relevant systems.
A talent pool is a database, not a folder
If your “talent pool” is simply an inbox containing years of old applications, it is time to organise it.
Define the purpose, legal basis, retention period, access rights and deletion process, and treat it as a real processing activity in its own right.
GDPRWise helps employers document recruitment and talent-pool processing separately, so that each activity has a clear purpose, legal basis and retention rule.
GDPRWise records recruitment and talent-pool processing as distinct activities, each with its own legal basis and retention rule.