There is no single legal answer to how long you may keep a rejected applicant’s data. In the UK and EU you must keep it no longer than necessary and be able to justify the period. In the United States you must keep hiring records for at least a minimum period set by law. The practical method is to set a period for each record type, tied to a stated reason, and to delete on a schedule.
Key takeaways
- UK and EU: keep data only as long as you need it, and be ready to explain why. No official figure fits every case.
- US: federal rules set minimum retention for hiring records. Some state laws and federal contractor rules add more. Confirm the current figures on official pages.
- Set a period for each record type: CV, interview notes, test results, talent pool data and monitoring data.
- Keep talent pool data only with consent, and ask again after a fixed time.
- Automate deletion and test it. A policy that is not enforced is only a document.
The two pressures: delete and keep
Employers often feel pulled in two directions. Data protection rules in the UK and EU say you should not keep personal data longer than necessary. Equal employment rules in the US, and the wish to defend a possible claim, say you should keep enough to show how you decided. The way through is to keep what you need for a defined reason, for a defined time, and no more.
| Region | Main rule | Source to read |
|---|---|---|
| EU | Storage limitation: personal data must be kept in a form that permits identification for no longer than necessary for the purposes | Article 5(1)(e) of the GDPR |
| UK | Same principle under the UK GDPR. The regulator expects a justified, documented period | ICO recruitment and selection guidance |
| US (federal) | Employers covered by federal equal employment laws must keep certain hiring records for a minimum period, and longer if a charge or claim is filed | EEOC recordkeeping requirements |
The EEOC page states the minimum period and the circumstances that extend it. Read the current text and keep records at least that long. Federal contractors, public employers and some state laws can add longer periods or other duties. Confirm the position for your organisation with a specialist.
What to keep, by record type
Different records serve different purposes, so they can have different periods. The suggestions below describe the logic. They do not give a number, because the number depends on your country, sector and risk.
| Record | Why you keep it | How to set the period |
|---|---|---|
| Application form and CV | To show who applied and what you saw | Tie it to the period in which a claim could realistically be brought in your country, and the US minimum where it applies |
| Screening notes or evidence sheet | To show the job-related reasons for the decision | Same period as the application |
| Interview notes and scorecards | To show a fair, comparable process | Same period as the application |
| Test or exercise results | To show what you assessed | Same period, or shorter if the test result has no further use |
| Reference responses | Part of the decision record | Same period as the application, if used |
| Equal opportunities monitoring data | To check the fairness of the process | Keep in a separate, protected file, with its own period. Anonymise when you can |
| Talent pool data (with consent) | To contact people about future roles | A fixed period, such as a year or less, then ask again. Choose your own |
| Offer and onboarding records for the person hired | To start employment | Move to the employee file and follow employee record rules |
A seven-step method
- List the record types. Use the table above. Add any you create, such as video interview files.
- Find where each lives. Applicant system, email, shared drives, spreadsheets, calendar notes, paper.
- Write the reason for keeping each type. If you cannot write a reason, you probably should not keep it.
- Check the legal minimum. For US hiring, read the EEOC page. For other countries, look for local rules and ask an adviser.
- Choose the period. Take the longer of the legal minimum and the shortest period you can justify. Record the date you decided and who approved it.
- Put it in the notice. Tell applicants the period in your applicant privacy notice.
- Automate and test. Use retention rules in your system, run a monthly report for exceptions, and test that deleted data is gone from lists, exports and backups.
Talent pools and “keep your CV for future roles”
Keeping a CV for a later role is a different purpose from assessing the current application. In the UK and EU, ask the applicant. Make the request separate from the application, with a clear “yes” or “no”. Say how long you will keep the CV and how to withdraw. Ask again before the period ends. Do not treat silence as consent.
A talent pool is only useful if it is current. Old CVs show past skills and may no longer match a person’s situation. Reviewing the pool once a year, and deleting what you do not use, supports both privacy and quality.
Handling deletion in practice
Delete from every place
- The applicant system. Use the delete or anonymise function, not only an archive status. Ask the vendor what archive means.
- Email. Search for the candidate’s name and delete attachments and messages when the period ends.
- Shared drives and chats. Remove copies of CVs and notes that managers saved.
- Spreadsheets. Keep trackers free of names or delete rows on schedule.
- Backups. Ask IT how long backups last. Document that deleted data will leave the backups on a known date, and make sure restored data is cleaned again.
Anonymise when you want to keep statistics
You can keep counts and rates without keeping identities. For example, keep “120 applications, 40 screened in, 10 interviewed” and delete the underlying records. True anonymisation means that nobody can identify a person from the data, including by combining it with other information. If a person can still be identified, the data is still personal data. Remove names, contact details and free text, and group small categories together.
Pause deletion when a claim or complaint exists
If a candidate has made a complaint or you have been told of a claim or an investigation, do not delete related records until you have advice. Mark the records with a hold. Document who placed the hold and when it ends.
A fictional example
This example is invented. A mid-sized company with offices in Germany and the United States uses one applicant system. The HR lead builds the schedule below with the legal adviser. The periods in brackets are placeholders that the adviser sets from local law.
| Record | Germany | United States | Review owner |
|---|---|---|---|
| Declined application, CV and notes | [period set by adviser under German and EU law] | [at least the federal minimum, or longer if state or contractor rules apply] | HR lead |
| Talent pool with consent | [one fixed period, then ask again] | [one fixed period, then ask again] | Recruiter |
| Monitoring data | [period set by adviser] | [period set by adviser] | HR lead |
The point of the example is the structure. Each row has an owner, each period has a source and each country is treated separately. If a manager asks “Why do we delete in one country and keep in another?”, the table and the adviser’s note answer the question.
Mistakes to avoid
- One period for every country. Rules differ. Use the strictest where you cannot separate data, and document the choice.
- Archive instead of delete. An archived record is still a stored record.
- Forgetting documents outside the system. Email is where many old CVs live.
- Deleting before the legal minimum in the US. Check first.
- No owner. Assign one person to run and report on the schedule every quarter.
FastHire is being built so that decisions rest on the exact CV passage that supports each requirement, with people making every decision. FastHire does not rank, score or reject candidates. It is coming soon. Whatever tool you use, the retention schedule above stays your responsibility.
Replying to a deletion request: a short template
Candidates sometimes write and ask you to delete their data. Reply within the time your law requires, and make the reply clear and kind. Adapt the text below to your case. If you must keep some records, say which ones and why, in plain words.
Hello [Name],
Thank you for your message. We have received your request to delete your application data for [role].
We have deleted [list: your CV, your contact details and our notes] from our recruiting system on [date].
[If something is kept: We must keep [short description] until [date] because [short reason, such as a legal duty to keep hiring records]. After that date we will delete it.]
If you have any questions, please write to [email].
Kind regards,
[Name]
A quarterly retention review
Once a quarter, one person runs the review. It should take under an hour once the system is set up.
| Step | Question | Evidence |
|---|---|---|
| 1 | How many records passed their deletion date in the last quarter? | Report from the system |
| 2 | How many were deleted, and how many remain? | Report from the system, plus a spot check of 10 records |
| 3 | Are there records on hold? Is each hold still needed? | List of holds with owner and date |
| 4 | Have any new tools, countries or record types appeared? | Notes from recruiters and IT |
| 5 | Were there any requests from candidates? Were they answered in time? | Request log |
| 6 | Does the privacy notice still match what we do? | Read the notice side by side with the schedule |
Write the result in two lines and file it with the schedule. If something is late, add an owner and a date. A short regular review is far more useful than a long audit once every few years.
How to explain the schedule to hiring managers
Managers keep their own notes and files, so they need to know the rules. Give them a one-page summary. It should say where to save notes, what not to write, how long records stay in the system, and who to ask when a candidate wants to see or delete data. Add one rule that is easy to remember: if it is about a candidate, it lives in the recruiting system and nowhere else.
Also tell managers what to do when they receive a CV by email from a friend or a referrer. They should forward it to recruiting, and recruiting adds it to the system with the source field set to referral. That way the record falls under the same schedule as every other application and the manager’s inbox does not become a hidden archive of personal data.
Frequently asked questions
Is six months a safe period to keep rejected applications?
There is no universally safe period. It depends on the country, the sector and the claims risk. In the US, check the federal minimum. In the UK and EU, choose and record a period you can justify.
Can I keep rejected applicants’ CVs in an email folder?
You can only keep them for the period you set, and email counts. Include mailboxes in your deletion routine, or store CVs only in the system.
What if a rejected candidate asks me to delete their data?
In the UK and EU, the request must be considered. You may refuse in some cases, for example if you need the data for a legal claim, and you should explain your reason. In the US, state laws may give some rights. Follow your procedure and ask an adviser if unsure.
Do the same periods apply to interns and contractors?
Often similar rules apply, but they depend on the status of the person and the country. Check with an adviser.
Should I keep the data of candidates who withdrew?
Treat withdrawn applications the same as declined ones unless the person agrees to be in a talent pool.
Related guides
- Hiring guides for fair and compliant hiring
- GDPR for job applicants: what employers must do
- Applicant privacy notice: what to include, with a template
- Applicant tracking system compliance checklist: GDPR and US records
- All hiring guides for employers
- How to build a talent pool with consent
- How long can you keep applicant data? US, UK and EU
- How to document hiring decisions so they stand up to review
- How to respond to a discrimination complaint from an applicant
This is general information, not legal advice.