A candidate record needs more than a date in an ATS. Record the purpose, lawful basis, access, review event and deletion decision so the next action is explainable.
There is no universal “six-month rule” for every CV. Start with purpose, lawful basis, access and the event that ends the purpose. GDPR Articles 5, 17 and 18 provide the primary framework.
This guide gives you a practical record for each decision. It supports review; it does not replace legal advice or a documented assessment for your jurisdiction.
A filled worksheet for each candidate record
| Record | Purpose | Necessary fields | Review event | Evidence |
|---|---|---|---|---|
| Active application | Assess one vacancy | CV, role, notes, source | Vacancy closes or withdrawal | Decision date and reason |
| Client shortlist | Present agreed candidates | Approved profile and role-fit evidence | Mandate closes | Recipient and scope |
| Future talent pool | Consider later roles | Contact, skills, notice and basis | Documented review event | Retain, restrict or delete reason |
| Rights request | Answer the candidate | Request, identity check, systems searched | Request completed | Response and exceptions |
Do not call an invented test record “anonymised”. A fictional record never belonged to a person; anonymisation transforms real data so the person is no longer identifiable.
Why GDPR Sets No Fixed Retention Period (and What It Actually Requires)
GDPR's storage limitation principle does not name a number of months. The regulation requires that personal data be kept only as long as necessary for the purpose for which it was collected — and that you can demonstrate this is proportionate. Your retention period isn't handed to you; you have to justify it, document it, and enforce it.
This design is deliberate. A CV collected to fill a specific CFO role in Munich has a fundamentally different retention window than a speculative application to a talent pool. The ICO's recruitment and selection guidance illustrates why the purpose, statutory context and documented review event must be assessed for the relevant jurisdiction rather than copied as a universal period.
When a vacancy closes, review the record against its documented purpose. If continued use is not justified, restrict or delete it; if a different purpose is proposed, assess the new processing and information duties before using the record again.
The 7-Year Myth: Where It Comes From and Why It Doesn't Apply to CVs
The "GDPR 7-year rule" is one of the most persistent compliance misconceptions in HR. The 7-year figure refers to financial and accounting records — invoices, fee notes, payroll — required under tax legislation in most EU member states. It has no bearing on candidate CVs, interview notes, or personal data collected during recruitment.
The confusion is understandable. Recruitment agencies may need to retain accounting or contractual records under applicable national rules, but those records can still contain personal data and must be assessed separately. A CV, interview note or reference needs its own purpose, basis and review decision.
Lawful Basis for Candidate Data: Legitimate Interest vs Consent
Most recruitment activity sits under one of two GDPR lawful bases: legitimate interest (Article 6(1)(f)) or consent (Article 6(1)(a)). Choosing the right one for each type of candidate data is not a technicality — it determines what you can do with the data and for how long.
When legitimate interest is your lawful basis
Legitimate interest lets you process candidate data without explicit consent — provided you pass a three-part test: there's a genuine interest, processing is necessary for it, and that interest isn't overridden by the candidate's rights. For recruiters, it works best when a candidate has a reasonable expectation of being approached. The European Commission's guidance on legitimate interest emphasises that you must show the candidate's privacy interests are not "seriously impacted" — which means documenting your assessment, not assuming it.
Legitimate interest typically covers:
- Candidates who applied directly for a specific open role
- Candidates sourced from professional networks (LinkedIn, Xing) where their profile is clearly career-oriented and public
- Candidates referred by clients or contacts where the referrer had a reasonable basis for sharing their details
- Previously placed candidates within the guarantee period
What legitimate interest does not cover: keeping a candidate in your database indefinitely after the original purpose has ended. Once the role is filled and the claim window has passed, the legitimate interest has expired with it. You need either a new basis or a deletion.
When consent is required
Consent is the right tool when you want to keep candidates in a talent pool beyond the original role — which is exactly the situation most agencies are trying to manage. The ICO's storage limitation guidance is clear that long-term talent pool retention requires an active opt-in: specific, informed, freely given, and easily revocable.
Consent also applies to sensitive personal data (disability information, right-to-work status), any marketing communication to candidates beyond the immediate placement process, and any re-purposing of data from one search to another.
"Consent in recruitment isn't a checkbox you ask candidates to tick during onboarding. It's a documented permission for a specific purpose, with a clear expiry — and it has to be as easy to withdraw as it was to give."
The Consent Refresh: Why Your Talent Pool Has an Expiry Date
Consent-based talent pool records don't last forever. Once the documented purpose or review event no longer supports continued use, reassess the basis before retaining or contacting the candidate. A consent refresh is one possible mechanism: a short, transparent communication asking candidates to confirm they still want to be in your pool.
A consent refresh that works is not a marketing email. Candidates can tell the difference. It needs to include: what data you hold, why you want to keep it, how long you'll hold it for, and a clear way to say no. Something like:
"We've had your details since [date] and want to make sure you still want us to. If you're open to hearing about suitable opportunities, confirm below. If not, you can ask us to stop using the record — no hard feelings."
Record the message, purpose, response and resulting decision. Do not treat non-response as consent; follow the documented review and deletion process that applies to your basis.
According to the ICO's November 2024 audit of AI recruitment tools, one of the most common compliance failures was retaining candidate data indefinitely "without candidate knowledge" — meaning no retention limit had been set and no refresh process existed. Regulators flagged this as a clear violation, not a grey area.
What GDPR Enforcement Actually Looks Like for Recruiters
Enforcement risk is context-specific. Keep the purpose, basis, review and deletion evidence together so a candidate request can be handled consistently.
Enforcement against recruitment agencies rarely arrives through proactive regulatory audits. It comes from candidate complaints. The most common scenarios:
- A candidate uploaded their CV to a job board three years ago. They receive an unsolicited call from your agency about an unrelated role. They have no idea how you got their details. They complain to the ICO or their national DPA.
- A candidate requests deletion. You delete their ATS record but miss the CV in an email thread, a Google Drive folder, and last month's backup. The candidate finds out their data is still findable. They escalate.
- Your agency changes systems. A review reveals records with no retention schedule or documented lawful basis, so the team must pause and decide what can be retained.
The same purpose-limitation question applies to recruitment databases: if a candidate gave you data for a specific vacancy, assess any later use against the documented purpose and information duties before reusing it.
From Compliance Problem to Active Pipeline: The Reactivation Move
A review can also improve sourcing discipline. Before deleting a segment, assess whether a new purpose and lawful basis are available, provide the required information and give the candidate a clear choice. Do not assume a response rate or future availability.
The find, rank, reactivate model treats your existing database as one possible sourcing channel. Reuse only the fields and history needed for the current purpose, and reassess the candidate's context before contact.
That reactivation only works when the record supports the proposed use. Review the purpose, basis, information, objection history and review event before contact; if the assessment is incomplete, pause and resolve it first. This sequence keeps the decision visible:
- Segment by purpose and review status. Keep the source, basis, last relevant interaction and unresolved questions visible.
- Provide the required information. If a new purpose is proposed, document the assessment and a clear objection route before contact.
- Record the decision on no response. Follow the documented process for the applicable basis; do not treat silence as consent.
- Reconfigure your ATS to support retention review going forward. Every new candidate record should carry its purpose, basis and review event from creation.
- Work only the reviewed subset as active pipeline. Keep recruiter review and the candidate’s decision explicit.
See also: the dark matter problem in candidate databases — candidates who exist in your records but never get surfaced because the data isn't clean enough to query reliably.
What Your ATS Should Handle Automatically
Manual processes can break down as records and mandates accumulate. A workflow should make purpose, review events, objections and decisions visible instead of relying on individual memory.
A platform built for compliant recruiting should handle these without manual intervention:
Retention review. Every candidate record should have a documented review event. When that event arrives, the system can flag the record for review or a consent-refresh workflow — not leave the decision to a calendar reminder that may be missed.
Consent state tracking. The system should record when consent was captured, what it covered, the expiry date, and any subsequent changes (refresh confirmed, withdrawal logged). This is your audit trail if a regulator asks.
Erasure request workflow. When a candidate requests deletion, the system should surface every location where their data exists — record, pipeline entries, notes, attachments — and log the deletion with a timestamp. The one-month compliance window requires a traceable response, not a manual search across four systems.
DSAR (Data Subject Access Request) reporting. Candidates can request a copy of the personal data you hold on them. A useful workflow should identify relevant records across the systems in scope, preserve review steps and record what was disclosed or withheld.
Transfers and supplier scope. Check where each supplier processes data, the contractual roles, transfer safeguards and the actual retention and deletion controls available in your plan. Do not infer these details from a generic compliance label.
For a broader comparison of how ATS platforms handle compliance, the candidate sourcing automation guide covers what to look for in platforms that touch candidate data at volume.
Country-Specific Notes: UK, Germany, France
GDPR sets the floor. National law can raise it — and in several key European recruiting markets, it does.
UK (ICO). UK GDPR is enforced independently by the Information Commissioner's Office. Agencies operating across the UK-EU boundary should verify current transfer arrangements and document the purpose, basis and review event for each category of record.
Germany (BfDI / BDSG). Germany applies the BDSG alongside the GDPR in employment contexts. Assess the applicable basis and information duties for the particular process, and check whether a Works Council has a role in tool governance at the client organisation.
France (CNIL). The CNIL recruitment guide frames retention around purpose and proportionality. French agencies should document the applicable basis, information, review event and deletion process for each candidate-data purpose.
Frequently Asked Questions
How long can a recruiter keep a CV under GDPR?
There is no single GDPR-wide period. Justify the period for the purpose, inform the candidate, review it and delete or change the basis when the purpose ends.
Does the 7-year GDPR data retention rule apply to candidate CVs?
No. A tax or accounting period does not automatically apply to candidate CVs. Set and document a period that is necessary and proportionate to the recruitment purpose.
Can you keep passive candidates in your database under GDPR?
Possibly, but only after assessing the purpose, context, information given to the person and any objection. Document the lawful basis and review route; a public profile alone does not settle the question.
What happens if a candidate asks you to delete their data?
Assess the request under Article 17, verify identity, search active systems and record the response. A lawful exception may apply, so document what was retained and why.
What is a consent refresh and when do you need one?
A consent refresh asks candidates whether they still want to remain in a talent pool. Use the documented purpose and review event, provide a clear objection route, and record what happens when there is no response.
GDPR candidate data retention is manageable when each record has a purpose, basis, review event and decision. Build that evidence into the workflow and keep recruiter review explicit.
Use a fictitious mandate in Yena’s 10-day trial: create two records, record purpose and review event, prepare a shortlist, then process one objection and one deletion request. The trial tests workflow, not compliance. Explore sourcing workflows.