How Long Should You Keep Job Applications? GDPR Data Retention for CVs
Table of Contents
How Long Must You Keep CVs Under GDPR?
Under GDPR, you must not keep personal data longer than necessary. For job applications, the general rule is: if you don't hire the candidate, delete their CV within 6 months after the recruitment process ends. If you hire them, keep it for the duration of employment plus any applicable statute of limitations (usually 2-5 years after termination).
Featured Snippet: GDPR does not set a fixed number for CV retention, but the principle of storage limitation means you should delete unsolicited CVs after 6 months and unsuccessful applicants' data within 6 months of the decision, unless you have consent to keep it longer.
Why 6 Months? The Logic Behind the Timeline
Think of GDPR like a fridge: you wouldn't keep leftovers for years. Six months is the sweet spot: long enough to handle any discrimination claims (which typically have a 3-6 month filing period) but short enough to respect privacy. Some EU countries have specific laws (e.g., Germany allows up to 2 years with consent), but 6 months is the safe default.
What About Unsolicited CVs?
If someone sends you a CV out of the blue, you have no legitimate interest to keep it. Delete it within 6 months unless you ask for and receive explicit consent to keep it for future roles. Pro tip: add a checkbox on your careers page saying 'I agree to have my CV stored for 12 months for future opportunities.'
Consent vs. Legitimate Interest
You can rely on legitimate interest to keep CVs for a short period (e.g., to defend against legal claims). But for longer storage, you need consent. And consent must be freely given, specific, and revocable. So don't trick candidates into agreeing – be transparent.
What Happens If You Keep CVs Too Long?
Fines up to €20 million or 4% of annual global turnover – whichever is higher. Plus reputational damage. Not worth it. Set up an automatic deletion policy: after 6 months, CVs go to the digital shredder.
Practical Steps for Compliance
- Create a data retention policy specifying CV deletion timelines.
- Automate deletion using your ATS or email rules.
- Get explicit consent if you want to keep CVs longer.
- Document your legal basis (legitimate interest or consent).
For official guidance, check the GDPR Regulation.
FAQ
Can I keep CVs for 2 years if I have consent?
Yes, if the candidate gives explicit, informed consent. But you must allow them to withdraw consent easily.
Do I need to delete CVs of hired employees?
No, keep them for the duration of employment plus the statute of limitations for employment claims (typically 2-5 years after termination).
What if a candidate asks me to delete their CV earlier?
You must comply with their right to erasure unless you have a legal obligation to keep it (e.g., ongoing litigation).
NakedPact Editorial Committee
Article created by the NakedPact editorial team. Our mission is to analyze, simplify, and expose unfair terms and hidden risks in everyday contracts to protect citizens and consumers.
Sources and Legal References
Do you own a website?
Want to communicate your data processing transparency to your users? Dynamically use our badge and showcase your platform's compliance.
Recommended Readings
🛡️ Protect your rights with one click
Don't risk signing abusive clauses. Install the free NakedPact extension for Chrome or Firefox and instantly analyze any contract on the web.
Don't trust, verify.
Now that you know the risks, don't sign blindly. Upload your contract to NakedPact and let AI find the hidden clauses for you. It's 100% free.
Analyze Your Contract Now