You interview a strong candidate, but someone else is a better fit for the current vacancy. Six months later, another position opens. Can you simply retrieve the old CV and contact them?
Yes, if you set it up properly. Keeping unsuccessful candidates’ data for future recruitment is a separate purpose, and the work is in deciding that deliberately rather than discovering it later.
The original application has a purpose
When a candidate applies for a particular job, the immediate purpose is clear: assess whether they are suitable for that vacancy.
Once the recruitment procedure is complete, that purpose largely ends.
Keeping the candidate’s information because another suitable vacancy might arise later is a new or additional purpose.
That does not automatically make it unlawful. It means you need to manage it properly, in the same way you would manage how long you keep a candidate’s CV after the procedure closes.
Be transparent
Candidates should know if their information may be retained for future recruitment. Explain this when collecting the data if already planned, or before using it for this new purpose.
Explain:
- Why you want to retain it
- Which legal basis you rely on
- What information you will keep
- How long you will keep it
- Who can access it
- How candidates can exercise their GDPR rights
Avoid vague statements that allow you to retain applications forever.
Do you always need consent?
Not always. Consent and legitimate interests may be available, but only if their conditions are met.
Consent requires a separate, clear choice about future vacancies. For example, ask the candidate when communicating the rejection. Do not use a pre-ticked box or make refusal disadvantage the candidate. Consent must be freely given, specific, informed and unambiguous, and as easy to withdraw as to give.
Legitimate interests is not an automatic alternative. Identify a legitimate interest, establish why retaining these data is necessary and assess the candidate’s reasonable expectations and the impact on their rights. You may rely on this basis only if their interests and rights do not override your interest. Record the reasoning and outcome, inform candidates and provide an easy way to object.
Determine the basis before retaining data for this purpose. See Do you need consent to keep a candidate’s CV?.
Set an expiry date
A useful talent pool has a lifecycle. An old CV may contain outdated skills, job titles and contact details.
Choose and justify a limited retention period, taking account of the purpose and applicable national guidance. Consent does not justify indefinite storage. Record the period in your data retention policy.
Where appropriate, contact the candidate before expiry to ask whether they want to remain. Sending that request does not extend the period, and silence is not renewed consent. Keep data longer only if continued retention is justified and a valid legal basis remains in place; otherwise delete the talent-pool data when the period expires.
Keep only useful information
You may not need the entire original recruitment file.
Interviewers’ internal comments, old assessments and other material collected for the first vacancy may not be necessary merely to contact the candidate about a new opportunity.
Apply data minimisation to the talent pool itself.
Make leaving easy
Give candidates a simple way to stop future recruitment contacts, and ensure requests reach all relevant systems.
If consent is withdrawn, stop the processing based on it and delete the talent-pool data unless another lawful reason requires retention. Do not simply switch legal basis to keep using the pool.
For processing based on legitimate interests, Article 21 provides a right to object on grounds relating to the candidate’s particular situation. You must stop unless you demonstrate compelling legitimate grounds that override their interests and rights, or processing is needed for legal claims. For a talent pool, make opting out straightforward and honour a request for no further recruitment contact.
Limited retention for a legal obligation or legal claims may still be necessary. Keep only the necessary data separately, restrict access and set a justified retention period. Such an archive does not authorise future recruitment contacts.
Manage your talent pool deliberately
The GDPR does not require specific database software. A folder can work if access, expiry dates and deletion are properly managed.
Define the purpose, legal basis, retention period, access rights and deletion process, and treat the pool as a processing activity in its own right.
GDPRWise records recruitment and talent-pool processing as distinct activities, each with its own legal basis and retention rule.