Candidate Data Requests: How to Respond and How Long to Keep Data

When a candidate asks to see, correct or delete the data you hold about them, log the request, confirm who they are, find every copy in your applicant tracking system, email and files, reply within the time your local rules set, and record what you did. How long to keep data depends on your country, so check local law.

Read this first: not legal advice

This article is a practical guide for hiring teams, not legal advice. Rules on candidate data differ by country, and in some places by region, state or sector. Some jurisdictions give candidates strong rights to access, correct, restrict or delete their data and set fixed deadlines for replying. Others give fewer rights, but may require you to keep some hiring records for a minimum time in case of a discrimination claim. Both can be true at once: a rule that lets someone ask for deletion, and a rule that requires you to keep certain records. We do not name specific periods as correct for you, because we cannot know where you hire, who you hire, or what your contracts say. What we can do is give you a workflow, a template, a planning table and a checklist of questions for your software vendor, so that when a request arrives you are organised and when you speak to a lawyer or data protection adviser you arrive with the right facts. Where you see a number in this guide, it is an example. For the tools themselves, see our overviews at /applicant-tracking-system and /recruitment-software, and always check the current terms and features of any vendor you use on their own site.

What counts as a candidate data request

A request can arrive in many forms, and it does not have to use a legal phrase. A candidate might email asking for a copy of everything you hold, ask you to fix a wrong phone number, ask you to delete their profile, ask why they were rejected, object to being scored by software, or ask you to stop contacting them. Some of these are formal requests under local law, and some are customer service questions, but it is safest to treat all of them seriously and log them. Requests can arrive at any address, including a hiring manager's inbox, a social message, or a reply to an automated email, so tell your team that any message that mentions personal data, privacy, deletion or access should be forwarded to one named person. Typical request types are access, correction, deletion, restriction, objection to automated processing, and transfer of data in a usable format. Not every right exists in every country, so do not promise a specific outcome in your first reply. Promise instead that you have received the request, that you will check it, and when they can expect an answer.

A response workflow in seven steps

Step one: log the request the day it arrives, with the date, the sender, what they asked for and who owns it. Step two: confirm identity in a proportionate way, for example by replying to the email address on their application, and avoid asking for more personal documents than needed. Step three: work out which rules apply, which may depend on where the candidate lives and where you operate, and take advice if unsure. Step four: search every place the data may sit, which is covered in the next section. Step five: decide the outcome for each part of the request. You may be able to do all of it, part of it, or none, for example if you must keep a record for a legal reason, and if so you should say why in plain words. Step six: reply in writing within the deadline that applies, with the data, a confirmation of deletion, or a clear explanation. Step seven: record what you did and when, and set a reminder to confirm that deleted data is also gone from backups or from any outside service on the schedule you were told. Keep the log itself free of unnecessary personal detail.

Where candidate data hides

The system you use for hiring is rarely the only place. Make a list of locations in advance, so that a request does not become a scavenger hunt. Check your applicant tracking system, including the candidate record, notes, scores, scorecards, messages, attachments and any offer documents. Check the inbox where applications arrive and any shared mailboxes. Check calendars and scheduling tools, video recordings and transcripts, spreadsheets that people keep on the side, documents on shared drives, chat messages, job board accounts, background check providers, reference notes, and exports someone downloaded last year. Check backups, and ask your vendor how and when deleted data leaves them. Check outside services that process data for you, such as email delivery, e-signature and AI services, and ask what they keep. Do a short audit once a year and write down the result as a data map. A simple table of place, what is kept, who owns it and how it is deleted is enough. Having it before a request arrives is what turns a stressful week into an ordinary task.

A template reply you can adapt

Here is a plain wording you can adapt. Check it against your local rules before use.

Subject: Your request about your personal data

Hello [Name],

Thank you for your message of [date]. We have received your request about the personal data we hold in connection with your application for [role]. We have logged it with the reference [number] and [Name of owner] is dealing with it.

To protect your information, we have sent this reply to the email address you used when you applied. If you contacted us from a different address, please reply from the address on your application so we can confirm it is you.

We will review your request and reply by [date]. If we need more information, or if we are not able to do everything you ask, for example because we are required to keep certain records, we will explain why.

Kind regards, [Name], [Company]

Notes for using it: do not promise deletion or a specific outcome in the first reply. Do not include personal data in the acknowledgement beyond what is needed. Insert the deadline from the rules that apply to you, and if you are not sure what that is, take advice. For the final reply, write a short, specific message stating what you did, what you kept and why, and how to contact you with questions.

A planning table for how long to keep data

There is no single correct retention period. The right figure depends on local law, your sector, your contracts and the reason you hold the data. Use the table to structure your own decision with an adviser. All periods shown as examples are placeholders, not recommendations.

Fill in the last column with your adviser, then set a reminder to review and delete on schedule. A retention rule that nobody applies is worse than no rule, because it creates a false sense of control. Also write down the reason for each period, since being able to explain it is part of being organised.

Worked example with example numbers

The numbers here are examples only and do not reflect what any law requires. A 35-person company receives a deletion request from a rejected applicant on 3 March. The recruiter logs it on 3 March and forwards it to the named owner, who replies on 4 March confirming receipt and giving a reference and an expected response date. The owner replies from the application email address, so identity is reasonably confirmed. The owner searches the data map: the applicant tracking system holds a record with a CV, two notes and one scorecard; the hiring manager's mailbox holds three emails; a shared drive holds one interview note document; and a calendar tool holds one meeting. The company takes advice and learns that, in its country, it should keep rejection records for a set period to defend possible claims, so it decides to delete the CV, contact details and notes, but keep a minimal record that an application was received and a decision made, until that period ends. The owner sends a final reply on 20 March explaining what was deleted and what was kept and why. A reminder is set for the end of the period to delete the remainder, and a second reminder to check that backups have cleared within the vendor's stated schedule. The whole request took about two hours of work because the data map existed.

Common mistakes with data requests

The first mistake is ignoring a request because it did not use the right words. The second is treating deletion as a single click in one system when copies live elsewhere. The third is deleting everything instantly without checking whether you must keep a record, which can leave you unable to defend a decision. The fourth is promising an outcome before checking the rules. The fifth is missing the deadline because the request was sitting in an unwatched inbox. The sixth is asking for more identity documents than you need, which creates more sensitive data to protect. The seventh is sending a candidate's data over unsecured channels. The eighth is not keeping a log, so you cannot show what you did. The ninth is not telling the vendor or outside processors when a deletion is required. The tenth is keeping rejected candidates forever by default because storage is cheap. Cheap storage does not remove your duty to have a reason. The eleventh is using automated scoring without being able to explain how a decision was made, since a candidate may ask. Rules differ by country, so check local law and take advice for anything unclear.

Where Rezumz fits

Rezumz is a hiring workspace for small and mid-size hiring teams, and it helps with the practical side of data handling rather than with legal judgement. Each candidate has one record that holds the CV, notes, scores with the supporting CV lines, scorecards and decisions, which makes the search for data inside the system simple. Job and candidate lists can be exported to a CSV, and a data download is available from the profile page. Scoring shows its evidence, so a team can explain how a shortlist was formed, and people make every decision. You are still the employer responsible for lawful basis, notices, retention periods and replies to candidates, and Rezumz does not give legal advice or make your decisions for you. Always read the current privacy policy and terms and ask questions in writing. Rezumz suits small and mid-size teams, and Team is for four or more recruiters. It does not suit large enterprises needing deep HRIS or payroll links, and it does not do one-click multiposting. Prices: a free plan with 2 free candidate analyses, $29 a month, $199 a year, or a limited $499 lifetime option; Team is $79 a month or $699 a year for up to 10 teammates. See /pricing and /demo.

Who this guide is not for

This guide is not for anyone who needs a definitive legal answer, such as the exact number of days to reply or the exact period to keep a record in a specific country. For that, speak to a qualified lawyer or data protection adviser in your jurisdiction, and consider the supervisory authority's own published guidance, which is often free. It is also not for large organisations with a dedicated privacy team, who will have their own procedures, nor for hiring that crosses many countries at once, where the strictest applicable rule may need to be applied. It does not cover employee data once someone is hired, background checks in detail, or any collective or union rules. Finally, it is not a reason to avoid hiring software. Good tools can make requests easier to answer, because the data is in one place and deletion is a defined action. What they cannot do is decide your retention periods or your lawful basis for you. Treat the workflow and templates here as a starting point, adapt them to your local rules, and review them at least once a year.