Recruitment creates data quickly: CVs, interview notes, emails, assessments and candidate profiles. Without a deletion process, these files can remain scattered across an organisation for years.
The GDPR requires personal data to be kept no longer than necessary. That means recruitment needs an end-of-life process as well as an application process.
Start with the purpose
There is no single moment at which every piece of applicant data must always be deleted.
Ask why you still hold it.
During recruitment, you need information to assess candidates and manage the procedure.
Afterwards, some information may be retained for a limited period for a legitimate reason, including where necessary in relation to possible claims. Our guide on how long you can keep a candidate’s CV works through that window in more detail.
If a candidate joins a properly managed talent pool, relevant information may be kept for that separate purpose.
When no valid purpose remains, the data should be deleted or irreversibly anonymised.
Not every document needs the same retention period
A recruitment file can contain many things:
- CV
- Cover letter
- Interview notes
- Test results
- Reference information
- Email correspondence
- Identity documents
- Internal scoring sheets
Do not assume that because one item needs to be retained, the entire file must remain intact.
Apply data minimisation throughout the retention period.
What about the successful candidate?
When someone is hired, some recruitment data will become relevant to the employment relationship.
That does not mean the complete recruitment file should automatically become part of the permanent personnel file.
Transfer information that is needed and delete information that no longer serves a purpose, subject to any justified retention requirements. There is a separate decision to make at the moment an applicant becomes an employee.
Where is applicant data hiding?
Deletion often fails because organisations think only about the central HR system.
Check:
- Individual email inboxes
- Shared HR mailboxes
- Hiring managers’ folders
- Shared drives
- Applicant tracking systems
- Recruitment agency portals
- Assessment platforms
- Spreadsheets
- Downloaded CVs
- AI tools used during recruitment
If your official system deletes candidates after a year but managers keep copies indefinitely, your retention policy is not working.
Use deletion triggers
Useful triggers include:
- Vacancy closed
- Candidate rejected
- Candidate hired
- Post-recruitment retention period expired
- Talent-pool period expired
- Candidate withdraws consent where applicable
- Candidate successfully exercises a right to erasure where the legal conditions are met
Automation can help, but it should be configured correctly and tested.
Document responsibility
Someone should know who is responsible for implementing the retention schedule.
A practical recruitment retention policy identifies:
- The categories of information
- The relevant purposes
- The retention periods or criteria
- The systems concerned
- The person or team responsible
- The deletion or anonymisation method
GDPRWise helps organisations record retention periods for their processing activities and keep recruitment data management connected to the wider GDPR compliance process.
GDPRWise records a retention period and a responsible owner for every recruitment processing activity, so deletion stops depending on memory.