An applicant tracking system (ATS) holds personal data about people who have not yet joined you, so it needs clear rules on what you collect, who sees it, how long you keep it and how you delete it. Use the checklist below to review your system against GDPR duties in the UK and EU and against record-keeping duties in the United States.
Key takeaways
- Collect only the data you need to assess the application, and tell candidates what you do with it.
- Set a retention period for each type of record, and delete or anonymise when it ends.
- Keep US hiring records for the minimum period set by official rules, and keep them consistent for every applicant.
- Limit who can see what. Hiring managers rarely need everything.
- Test deletion and data export before you need them. Candidates can ask.
Two different rule sets, one system
If you hire in the UK or EU, data protection law (the UK GDPR and the EU GDPR) limits what you may keep and for how long. If you hire in the United States, federal equal employment rules require employers to keep certain hiring records for a minimum time, and some states add their own rules. These can look like opposite pressures: one says delete, the other says keep. They fit together when you set separate retention periods per country and per record type, and write them down.
Read the official texts for your situation. For the EU, see the General Data Protection Regulation and the guidance of the European Data Protection Board. For the UK, see the Information Commissioner’s Office guidance on recruitment and selection. For the United States, see the Equal Employment Opportunity Commission page on recordkeeping requirements. Rules change and differ by country, state and employer type, so ask a specialist for your case.
The checklist
A. Before you collect: purpose and notice
- Write the purpose. For example: “to assess applications for the role and to run the recruitment process fairly”. Do not use applicant data for an unrelated purpose, such as marketing, without a lawful basis.
- Choose a lawful basis (UK and EU). Many employers rely on legitimate interests or on steps needed before a contract. If you rely on consent, make it specific and easy to withdraw.
- Publish a privacy notice for applicants. It should say who you are, what data you collect, why, who receives it, how long you keep it, and how to exercise rights. Show it on the application page, before the form is submitted.
- Mention automated tools. If any feature makes or supports decisions with software, say so in plain language and explain how a person reviews the result.
- Review the application form. Remove fields you do not use. Do not ask for date of birth, photograph or marital status unless the law or the job requires it and you can explain why.
B. While the process runs: access and accuracy
- Set roles and permissions. Recruiters see all applicants for their roles. Hiring managers see only the candidates shared with them, and only the fields they need.
- Hide what is not needed for the first review. Where the system allows it, hide names, photos and personal details until the screening decision. See our guide on reducing bias in resume screening.
- Keep notes factual. Interview notes can be disclosed if a candidate asks for their data or if there is a dispute. Write only what you would be comfortable showing to the candidate. Use job-related evidence, not comments about appearance, age, accent or family plans.
- Log changes. The system should record who viewed, edited or exported a record, and when.
- Keep records of the same type for every applicant. If you keep scorecards for interviewed candidates, keep them for all interviewed candidates, not only for the ones who were hired or declined.
C. After the decision: retention and deletion
- Set a retention period per record type. Examples of types: applications and CVs of declined applicants, interview notes and scorecards, offer documents, candidate talent pool data, and monitoring data.
- Take the shortest period you can justify. Under GDPR, personal data must not be kept longer than necessary. Write the reason next to each period.
- Check US minimums. Federal rules set a minimum time to keep hiring records for most private employers, and longer periods can apply to federal contractors and under state laws. Confirm the current rule on the official page and keep records at least that long in the US.
- Automate deletion. Use the retention rules of the system. If it has none, put a monthly task in your calendar to run a deletion report.
- Delete from every place. Include email attachments, shared drives, spreadsheets, exports and backups. If backups cannot be changed at once, document the schedule on which they expire.
- Handle talent pools separately. Keep people in a talent pool only if they agreed, and ask them again after a fixed period. A guide on building a talent pool with consent is planned for this blog.
D. Candidate rights and requests
- Name who handles requests. Candidates in the UK and EU can ask for a copy of their data, correction or deletion, and can object in some cases. Decide who receives the request and how fast you reply. GDPR sets a general time limit of one month for most requests, with possible extension. Read the official text for the details.
- Test a data export. Pick a dummy candidate, export everything and check what you see. Does it include interview notes and emails?
- Test a deletion. Delete the dummy candidate and check that the record disappears from search, reports and exports.
- Keep a log of requests. Record the date, the request, the action and the date of reply.
- Plan for the automated-decision rules. In the EU and UK, people have specific rights if a decision is based solely on automated processing and has significant effects. A guide on GDPR Article 22 and hiring is planned for this blog.
E. Vendor and security
- Have a data processing agreement with the ATS vendor, listing sub-processors and locations.
- Check international transfers. If data moves outside the UK or EU, make sure there is a valid transfer mechanism. Ask the vendor to show it.
- Use strong sign-in. Require multi-factor authentication for all users and remove accounts when people leave.
- Review exports. Limit who can download all candidate data. Exports to personal laptops and email are a common leak.
- Plan for a breach. Know who to call, and the time limits for reporting a breach to the regulator in your country.
A retention schedule you can adapt
The table below is a template. The periods are placeholders in brackets. Replace them with the figures that your own legal adviser confirms for each country. We do not give fixed periods here because they depend on your country, your state, your industry and whether you are a government contractor.
| Record type | Purpose | UK / EU period | US period | Owner |
|---|---|---|---|---|
| Application and CV (declined) | Handle the application and defend a claim | [set by you, as short as justified] | [at least the official minimum] | Recruiter |
| Interview notes and scorecards | Show a fair, job-related decision | [set by you] | [at least the official minimum] | Recruiter |
| Offer and acceptance documents | Start employment | Move to employee file | Move to employee file | HR |
| Talent pool data (with consent) | Contact for future roles | [set by you, then ask again] | [set by you, then ask again] | Recruiter |
| Monitoring data (equal opportunities) | Check the fairness of the process | [set by you] | [set by you] | HR |
| Request log | Show that you answered rights requests | [set by you] | n/a | Data protection lead |
Common mistakes
- Keeping everything forever “just in case”. This is a risk under GDPR and a cost in any country.
- Deleting US records too early. Deleting inside the minimum period can create its own problems. Check the official rule first.
- Leaving data in email. CVs forwarded to hiring managers often live outside the ATS. Ask managers to use the system link instead of attachments.
- Using free-text notes about protected traits. Do not record that a candidate is pregnant, older, disabled or of a certain religion. If a candidate volunteers it, do not use it in the decision.
- Treating the vendor as responsible for everything. You remain responsible for how you use the system.
FastHire is being built so that hiring teams can check each job requirement against the exact CV passage that supports it, with people making every decision. It does not rank, score or reject candidates. FastHire is coming soon.
A one-hour self-audit
You can test your system in one hour with one person from recruiting and one from IT. Work through the steps below and write down each answer. Anything you cannot answer in two minutes is a gap to fix.
| Minute | Task | What a good result looks like |
|---|---|---|
| 0 to 10 | Open the live application form as a candidate | The privacy notice is visible before submission, and every field has a clear purpose |
| 10 to 20 | Open the user list | Every user is current, and each has the lowest access they need |
| 20 to 30 | Open three old declined records | Each is within its retention period, or it is flagged for deletion |
| 30 to 40 | Export a dummy candidate | All data appears in one file, including notes and messages |
| 40 to 50 | Delete the dummy candidate | The record is gone from search, lists and reports |
| 50 to 60 | Read the vendor agreement summary | A processing agreement, a sub-processor list and an exit clause exist |
Repeat the audit once a year and whenever you change vendor, add a new country or switch on an automated feature. Keep the notes. They show that you reviewed your own process, which is useful if a regulator, a candidate or an auditor asks.
Talking to hiring managers about records
Hiring managers rarely read policies, so give them three rules in a short message. First, use the system link and not email attachments to share CVs. Second, write notes about the job requirements and the evidence, and nothing else. Third, send questions about a candidate’s data to the named contact in recruiting. Repeat the message when a new manager joins, and again when the process changes. A rule that people can remember in ten seconds is a rule they will follow.
What to do if you find a problem
If the audit shows old records, missing notices or too much access, fix the simplest items first. Remove unused user accounts the same day. Update the privacy notice within a week. Set retention rules within a month. For larger gaps, such as data held by a vendor with no processing agreement, write a short plan with an owner and a date, and ask your data protection adviser whether anyone must be told. Record what you found, what you changed and when. Do not delete evidence that you may need to keep under a legal duty; ask for advice before you remove records connected to an open complaint or claim.
Frequently asked questions
Do I need candidate consent to store their CV?
Not always. In the UK and EU, you need a lawful basis, and consent is only one of them. Many employers use legitimate interests or steps before a contract for ordinary recruitment. Consent is usual for talent pools. Check with your data protection adviser.
How long should I keep declined applications?
There is no single answer. Choose the shortest period you can justify, and in the US keep them at least as long as the official minimum. Write the period down and apply it to everyone.
Can candidates see my interview notes?
In the UK and EU, a candidate can ask for a copy of their personal data, and notes about them can be included, with some exceptions. In the US, rules vary by state. Write notes as if they could be read.
Do these rules apply to a small business?
Yes. Data protection law applies to most organisations that process personal data. Some US record-keeping rules depend on employer size, so check the official guidance.
Who should own the ATS compliance checklist?
One named person, usually in HR or operations, with support from IT and a legal adviser. Review it at least once a year and whenever you change the system.
Related guides
- Hiring guides for recruiters and HR teams
- How to choose recruiting software: 25 questions to ask every vendor
- How to build a hiring dashboard in a spreadsheet
- How to reduce bias in resume screening
- All hiring guides for employers
- GDPR for job applicants: what employers must do
- Applicant privacy notice: what to include, with a template
- How long to keep rejected applicant data
- How to build a talent pool with consent
- How to manage hiring across the US, UK and EU
- How long can you keep applicant data? US, UK and EU
This is general information, not legal advice.