Candidate Data Retention Under GDPR: How Long Is Too Long?
Short answer: GDPR sets no fixed retention period for candidate data. Keep applications only as long as you need them to make the hiring decision and defend against discrimination claims. In the UK and Germany that usually means about six months after rejection. Keeping CVs for future roles needs consent. US employers must keep application records for at least one year.
Every rejected application leaves something behind: a CV in an inbox, interview notes in an applicant tracking system, a scoring sheet in a shared drive. Under GDPR, all of that has an expiry date. The regulation just doesn’t tell you what it is.
That vagueness is deliberate. GDPR says personal data should be kept no longer than necessary for its purpose (Article 5(1)(e)). For candidate data, the useful question is therefore: why would you still need it?
The legal basis for processing applications
Before retention comes the question of why you may process applications at all. Under Article 6(1)(b) GDPR, processing is lawful when it is necessary to take steps at the request of the data subject before entering into a contract. An application is exactly such a request.
Once the role is filled, that basis falls away. What remains is a legitimate interest under Article 6(1)(f): being able to defend yourself against a discrimination claim. That interest has a natural end date, which is when the claim window closes.
| Criterion | Legal basis | Consent needed |
|---|---|---|
| Screening and selection | Art. 6(1)(b) GDPR | |
| Keeping data after rejection to defend claims | Art. 6(1)(f) GDPR | |
| Talent pool for future roles | Art. 6(1)(a) GDPR | |
| Health data, disability adjustments | Art. 9(2)(b) GDPR plus national law | no, but narrowly limited |
| Sharing with other group companies | usually Art. 6(1)(a) |
Germany has a twist. Its national rule for employee data, section 26 of the Federal Data Protection Act, is considered largely unusable since a 2023 ruling of the Court of Justice of the EU (C-34/21) on an identically worded state law. German employers therefore rely directly on the GDPR bases above.
Necessary means necessary. For a finance role you need qualifications, experience and skills. You don’t need marital status, religion, a photo or place of birth. If candidates volunteer such details, that’s their choice. Don’t ask for them in your form.
Why six months is the common answer
The retention period follows the deadlines for discrimination claims, plus a margin.
| Criterion | Claim deadline | Common retention |
|---|---|---|
| Germany | 2 months to claim in writing, then 3 months to sue | about 6 months |
| United Kingdom | 3 months less 1 day, extendable by ACAS early conciliation | about 6 months |
| United States (federal) | EEOC charge within 180 or 300 days | at least 1 year by regulation |
In Germany, a rejected applicant has two months from receiving the rejection to assert a claim in writing under the General Equal Treatment Act, then three months to file suit. Add a month for post and service, and you reach six months. German data protection authorities, including Berlin’s, consider up to six months acceptable.
In the UK, employment tribunal claims normally have to be filed within three months less one day of the act complained of. ACAS early conciliation pauses that clock, so the real window can be longer. Six months is a widely used period.
US employers are in a different position. Federal regulations require employers covered by Title VII to keep application records for one year from the date the record was made or the personnel action taken, whichever is later (29 CFR 1602.14). If a charge is filed, everything relevant stays until the matter is resolved. GDPR may not apply to a purely US operation, but multinational employers need a retention setting per country.
One practical consequence: the clock starts with the rejection. Candidates who are never told no have no clear start date, which stretches your risk and your retention. Our guide to writing a candidate rejection email covers how to close the loop properly.
Notes, scorecards and copies count too
Retention rules apply to every copy, not just the CV. Interview scorecards, notes in a shared document, emails between hiring managers discussing a candidate and calendar invites with names in the title all hold personal data. Deleting the application in your recruiting system while a spreadsheet of ratings lives on elsewhere doesn’t meet the rule. When you set a retention period, list where candidate data actually ends up, and make the deletion cover all of those places.
Talent pools need consent
Every recruiter wants to keep strong runners-up for later. Under GDPR that works only with consent. It must be freely given, specific, informed and provable (Article 7). A pre-ticked box doesn’t count. It must be possible to withdraw it at any time.
How long can a talent pool hold data? Again, no fixed number. One to two years is common and easy to justify. What matters is that the period appears in the consent request and that your system deletes or asks again when it expires.
What candidates can demand
Candidates have the same rights as any other data subject. Two come up regularly.
The right of access under Article 15 covers everything you hold, including interview notes and internal ratings, and you usually have one month to respond. Some rejected candidates use it to gather material for a claim. That’s legitimate, which is why notes should be factual and tied to the role’s requirements.
The right to erasure under Article 17 is limited while you need the data to defend legal claims (Article 17(3)(e)). If a candidate asks for immediate deletion, you can usually comply once the claim window has realistically passed.
References, background checks and online research
Asking a former employer for a reference without the candidate’s agreement is hard to justify. Ask first and record the answer.
Background checks have their own rules. In the UK, criminal record checks through the Disclosure and Barring Service are limited to eligible roles and levels. In the US, the Fair Credit Reporting Act requires a standalone written disclosure and the candidate’s written authorisation before you obtain a background report from a screening company.
For online research, the line is professional versus private. A public profile on a professional network exists to be seen by potential employers. A private social media account doesn’t. Whatever you research should appear in your candidate privacy notice.
Minimum setup for a compliant process
- Candidate privacy notice under Article 13, linked at the application form
- Form asks only for what the role requires
- Data processing agreement with your recruiting software vendor
- Access limited to people involved in the hiring decision
- Automatic deletion after your set period, per country
- Consent flow for the talent pool, with a record
- Entry in your record of processing activities
- No CVs in personal inboxes or on USB sticks
The last point sounds obvious. It isn’t. Applications forwarded to managers and forgotten in their inboxes are among the most common data protection gaps in small firms. An applicant tracking system solves this because everyone works in one place and deletion happens centrally. See our guide to choosing an applicant tracking system for small business.
If you use AI to screen applicants, Article 22 GDPR and a data protection impact assessment come into play, covered in AI in recruitment. If you process candidate data in your own systems and want security and deletion designed in from the start, OnlineBuilders offers technical advice.
Your next step: open your recruiting inbox or system and count every rejected application older than six months, or older than one year for US roles. Delete them, then make sure it happens automatically from now on.
Questions people ask
Can I keep CVs on file for future vacancies?
Only with the candidate's consent. Under GDPR, consent must be freely given, specific, informed and provable, and it can be withdrawn at any time. State the retention period in the consent request, for example 12 or 24 months.
What if a candidate asks me to delete their data straight away?
You can usually comply once the window for claims has realistically passed. Article 17(3)(e) GDPR lets you keep data needed to establish, exercise or defend legal claims, so you may hold it until that risk has gone.
Do I need a privacy notice for applicants?
Yes. Article 13 GDPR requires you to inform candidates when you collect their data. Link the notice next to your application form, or include it in the acknowledgement email for applications sent by email.
Does GDPR apply to a US company hiring in Europe?
It can. GDPR covers processing linked to an EU establishment, and in some cases controllers outside the EU that target people in the EU. If you have a subsidiary or office in the EU that hires, assume GDPR applies to those candidates.
