Candidate data retention
Also called:CV retention period, Recruitment data retention
What the rule actually says
The GDPR’s storage-limitation principle, Article 5(1)(e), sets no number. It says personal data may be kept no longer than the purpose requires, and for a job application the purpose ends when the role is filled. From there, the number is yours to set: a period you choose before hiring starts, can justify afterwards, and state in the privacy notice candidates actually see.
Member states fill in the details differently. German practice keys the window to the deadlines for discrimination claims under the AGG, a few months after rejection — Lower Saxony’s data protection authority explains the derivation (German-language source). The French regulator, in its published retention guidance, caps an unconsented file at two years. Neither reading permits the default many small teams run on, which is keeping everything until someone asks.
What the period has to cover
Everything the process produced about the person. The CV is the visible part; the record also holds email threads, interview scorecards, internal comments, and whatever the job board forwarded. It includes the copies, too — the CV a hiring manager downloaded before an interview is candidate data in a second location, and deleting the original does not reach it.
That is where retention fails in practice. The failure is rarely the policy; it is scatter. A period enforced in one system while applications also live in three inboxes is a period enforced nowhere, which is the operational argument for keeping the record in one place before it is a legal one.
What a retention period does not do
It does not create a right to keep data during that window against a candidate’s wishes: an erasure request still wins. It does not extend to new purposes, so moving a rejected candidate into a talent pool needs its own basis, usually consent, rather than a longer number. And it does not audit itself. The working test is blunt: pick a rejection older than your stated period and search for it everywhere applications travel. Finding it means the policy describes an intention, not a practice.
Where Join fits
Join enforces the configured retention period account-wide: once a record ages past it, the deletion covers attachments, scorecards and internal notes in one pass.
