Candidate Data Retention: How Long Can Recruiters Keep CVs?

There is no single legal number of months for keeping candidate data. Under the GDPR you may keep personal data only as long as you need it for the purpose you told candidates about, so you should set a retention period, tell candidates what it is, and delete when it ends. Some places have specific recordkeeping rules for hiring, so check your own country.

Why not keep everything

Old CVs go out of date, create a risk if there is a data breach and may breach privacy law if there is no good reason to keep them. Candidates also have the right to ask what you hold and to ask you to delete it.

Choose a period and a reason

Typical reasons to keep data are to defend against a claim about a hiring decision, and to consider the person for future roles if they agreed. Write down the period for each reason. Keeping candidates who were not hired for a short period after a role closes is a common approach, and keeping them longer for a talent pool normally needs the person's agreement.

Tell candidates

State the period in the data notice they see when they apply, together with who sees their data and how to ask for deletion.

Delete on schedule

A policy that depends on someone remembering to delete will fail. Automate deletion, or schedule a regular clean-up. Delete the CV and personal details, and keep only what you need, such as anonymous counts for reporting.

Handle requests

If a candidate asks for their data or asks you to delete it, have a way to receive the request, confirm identity, act within the legal time and record what you did.

In Rezumz

Each job has a retention setting. When it ends, Rezumz deletes candidate data on that job under your setting and records that it did. Candidates can also make a privacy request on the public page. Rezumz is a processor of the data on your behalf, and you remain the controller. This is not legal advice.