There is no single answer to how long you can keep a resume or applicant record. In the US, federal rules require employers to keep personnel and employment records for at least a year, and longer in some cases. In the UK and EU, data protection law says you may keep personal data only as long as you need it for a stated purpose. Set a written schedule, tell candidates, and delete on time.
Key takeaways
- US: federal EEOC rules require employers to keep personnel or employment records for one year, longer if a charge or claim exists, and some payroll records for longer.
- UK and EU: no single fixed period. You must keep data no longer than necessary and be able to justify your period.
- Different records have different periods: applications, notes, scorecards, offers, background checks and talent pool data.
- Tell candidates how long you keep their data, and delete or anonymise on schedule.
- Pause deletion if a claim, complaint or investigation is open, and take advice.
Why retention matters in recruitment
Two opposite risks sit side by side. If you delete too early, you may break record rules or lose evidence that your process was fair. If you keep too long, you may break data protection rules, increase the damage of a data breach and keep information you no longer need. A clear schedule balances the two, and it saves time, because everyone knows what to do.
United States
The EEOC states that its regulations require employers to keep all personnel or employment records for one year, whether or not a charge has been filed, and to keep records longer once a charge exists, until it is resolved. Payroll records must be kept for longer under other rules: for example, the EEOC page notes three years for payroll records under the Age Discrimination in Employment Act. Read the EEOC recordkeeping requirements for the current text. Government contractors may have longer duties, and states may add rules. Ask your adviser what applies to you.
- Treat resumes, applications, scorecards, interview notes and offer records as employment records for the period your rules require.
- Keep records for the same period for every applicant for the same role, so that you do not treat people differently.
- If a charge, complaint or claim is raised, keep all related records until it is resolved.
- Some state privacy laws give applicants rights to know, access and delete data. Check which apply.
United Kingdom
The UK GDPR requires that you keep personal data no longer than is necessary for the purpose. There is no fixed period for unsuccessful applicants. You decide the period, base it on a clear reason, record it and apply it. The ICO guidance on recruitment and selection explains the data protection points. Think about the time you might need the records to respond to a claim, and balance that against the burden of holding data. Many employers set a short period for unsuccessful applicants, and a longer period for the file of a person who is hired, which becomes part of the employment record.
European Union
GDPR includes a storage limitation principle: personal data must be kept in a form that identifies people for no longer than necessary. See the text on EUR-Lex. National laws and regulators may set specific periods or give guidance for recruitment data, and some countries are strict. Check the guidance of the data protection authority in the country where you hire, and the EDPB for cross-border points.
Build a retention schedule
A schedule lists each type of record, the reason you hold it, the period and the action at the end. Use the following as a template, and fill in your own periods after checking local rules with an adviser. The periods are for you to set; do not copy them from another business.
| Record | Reason | Period (set after local advice) | End action |
|---|---|---|---|
| Application and resume of unsuccessful candidate | Fair process records and possible claims | [period] | Delete or anonymise |
| Interview notes and scorecards | Evidence of fair decisions | [period] | Delete |
| Talent pool data (with consent) | Future roles | [period, with periodic renewal] | Delete or ask for renewal |
| Offer letters and hire records | Employment record | As employment records | Move to the employee file |
| Right to work evidence | Legal duty | As the law states | Follow the official guidance |
| Background check results | Specific purpose | Shortest needed | Delete |
| Diversity monitoring data (if any) | Statistics | Anonymise soon after collection | Anonymise |
| Access request logs | Evidence of compliance | [period] | Delete |
For talent pool data, you need clear consent and a reason to keep it. See how to build a talent pool with consent.
Tell candidates
Say in your privacy notice how long you keep data and why. If you hold data for a talent pool, say so and offer a way to opt out. Our applicant privacy notice template and GDPR guide show wording. A rejection message is a good place to repeat the period.
Delete safely and on time
- List all places data sits: tracker, email, drives, chat, spreadsheets, backups and supplier systems.
- Set automated deletion in the tracker where possible, based on the date of the decision.
- Run a monthly check for records past their date. Delete or anonymise them.
- Ask suppliers to delete data from their systems and confirm in writing.
- Handle backups according to a rule: they expire on a cycle, or data is overwritten. Document the rule.
- Keep a simple deletion log: date, record type, method and who did it.
- Check that the deletion is real, not just hiding the record.
When to pause deletion
If someone raises a complaint, a claim, a regulator inquiry or a request that may lead to one, pause the deletion of related records. Tell the data lead and HR. Keep the records safe and restricted. Take advice on how long to keep them and when to resume deletion. This is called a legal hold in some places. Without it, deleting records during a dispute can cause serious problems.
Common mistakes
- No schedule at all, so records are kept forever by default.
- Different periods for different applicants for the same role.
- Deleting from the tracker but not from email or spreadsheets.
- Forgetting data held by suppliers and agencies.
- Keeping resumes for a talent pool without consent.
- Keeping interview notes with personal opinions that should never have been written.
- Deleting records after a complaint arrives.
Checklist
- A written schedule exists and was checked by an adviser.
- The privacy notice states the period.
- Deletion is automated or checked monthly.
- Suppliers are covered by contract.
- A legal hold process exists.
- Staff are trained on notes and records.
- The schedule is reviewed each year.
Worked example (fictional)
A company hires in the US, UK and Germany. The data lead builds a retention table with one row per record type and a separate column for each region, after asking an adviser in each place. For US applicants, the period respects the federal minimum and is applied to all applicants. For UK and German applicants, shorter periods apply, with the reason written next to each. The tracker is set to flag records for deletion on the date set. Each month the recruiter checks the flag list, deletes the records, asks the video interview supplier to delete its copies and writes a line in the deletion log. When a former applicant raises a complaint, the data lead places a hold on the related records and tells the team.
How to choose a period you can defend
Where the law leaves the period to you, ask three questions. What is the purpose of keeping the record? What is the shortest period that serves it? What would you say if a candidate, a regulator or a court asked why you kept it? Write the answers in the schedule. For unsuccessful applicants, the purpose is usually to show that your process was fair if a claim is made, and to deal with questions from candidates. The time you need depends on how long claims can be brought in your country, so ask your adviser, and write the reason down.
For talent pool data, the purpose is future contact, and the period should be short enough that the data stays relevant, such as a year, with a prompt to renew consent. For records of people you hire, the purpose changes to employment administration, and the employment record rules take over. Keep the two sets of rules clear in your schedule.
Minimising what you keep
The best way to cut retention risk is to collect and keep less. Do not ask for data you do not need at the application stage, such as date of birth, photos or a copy of identity documents. Ask for those only from the person you hire, and only when the law requires. Store scores and notes in a structured form, not in free text full of opinions. Keep personal sensitive data, such as health information for adjustments, separate from scoring data and delete it as soon as the adjustment is in place. See reasonable adjustments in interviews for the process.
Anonymise instead of delete, when you need statistics
You may want to keep statistics about your hiring, such as the number of applicants by stage and source, to improve your process. You can do this without keeping personal data by anonymising: removing names and anything that could identify a person, alone or when combined. True anonymisation is hard. Aggregate counts are safer than lists of individual records. If you keep diversity monitoring data, aggregate it soon after collection and delete the individual responses. Check with your adviser that your method is enough.
Records about the process itself
Some records are about your process, not about individuals: the role brief, the ad, the question list, the scorecard template and the policy. These contain no personal data and can be kept as long as they are useful. Keeping them shows how you designed a fair process, which can help if your decisions are questioned. Date each version and store them with the schedule, so you can show what was in use for each hire.
Retention and automated tools
If you use an applicant tracking system or an AI-based tool, check its settings. Many tools keep data by default for as long as the account exists. Set a retention period in the tool, switch on automatic deletion, and check that deleted records are removed from exports and backups on a defined cycle. Ask the supplier whether it uses applicant data to train its own models, and if so, whether you can switch this off. Record the answer. If a tool helps with screening, keep logs only as long as you need them to explain decisions, and apply the same schedule to those logs. See ATS compliance checklist for questions to ask suppliers.
Review the schedule at least once a year, and when you add a new tool, hire in a new country or when the law changes. A short review, with the data lead, HR and the recruiter, keeps the schedule real. Note the date of the review and any changes, and tell the team. A retention policy that is tested, lived and updated protects both candidates and the business much better than a long document that sits unread on a shared drive.
Frequently asked questions
How long should I keep resumes of people I did not hire?
It depends on the law where you hire and your reasons. In the US, federal rules require at least a year for personnel records. In the UK and EU, keep data only as long as necessary and be able to justify it.
Can I keep resumes for future roles?
Only with a clear purpose and, in many places, the candidate consent. Tell them how long you will keep it and let them opt out.
What should I do with data when a claim is possible?
Pause deletion of related records and take advice.
Do backups count?
Yes. Set a rule so that backups expire on a cycle, and document it.
Related guides
This is general information, not legal advice.