Candidate data and GDPR: keep less, delete on time

Hiring produces exactly the kind of personal data that’s easy to accumulate and awkward to clean up: names, CVs, interview notes, the reasons someone wasn’t chosen. It arrives through several channels, often lands in more than one place, and nobody is clearly responsible for removing it once a role is filled.

This is a practical overview rather than legal advice, and your obligations depend on your jurisdiction and circumstances. But a few GDPR principles cover most of what a small team needs to handle, and the biggest risk is usually the simplest one: keeping everything, forever, by default.

Three ideas do most of the work. Storage limitation — you shouldn’t keep personal data longer than you need it for the purpose you collected it (Article 5 of the GDPR). The right to erasure — in many cases people can ask you to delete their data (Article 17). And a lawful basis for what you do: processing an application is one thing; keeping someone’s details after a rejection, to consider them later, generally needs their consent.

Alongside these, collect only what you actually need to make a decision. Extra “nice to have” fields are more data to secure, justify and eventually delete. The less you keep, the less there is to get wrong.

Pick a period you can justify for each situation — for example, how long you keep an unsuccessful applicant’s data after a decision, versus someone who agreed to stay in your talent pool. Many small teams settle on something in the range of six to twelve months for unsuccessful applicants, but the right answer is the one you can explain, not a number copied from elsewhere.

Record the decision somewhere your team can see it, and tell candidates in your privacy information. A retention period that only exists in good intentions isn’t really a period; it’s a backlog waiting to happen.

When someone asks what you hold, or asks you to erase it, you need to be able to act without a frantic search. That means knowing where candidate data lives and being able to export or remove a person’s record cleanly, including the files attached to it.

Practise it before you need to. If a request would currently mean digging through an inbox, a drive and a spreadsheet, that’s a sign the data is too scattered to manage — which is both a compliance risk and a daily inconvenience.

The step teams miss is the last one: actually deleting. Rolefern is built so retention runs on a schedule, consent to stay in touch is recorded against the candidate, and erasing someone’s data is a single action rather than a manual sweep.

That turns good intentions into routine. You still decide the periods and the lawful basis — those are your calls — but the cleanup that’s easy to forget stops depending on anyone remembering to do it. For a small EU team, that’s one genuine risk quietly taken off the list.