Candidate Data Retention

What counts as candidate data

Far more than the resume. A typical hire leaves a trail across several systems:

• Applications, resumes, cover letters and screening question answers in the applicant tracking system
• Recruiter notes, interview scorecards and debrief comments
• Assessment scores, video or audio interview recordings and AI-generated summaries or scores
• Emails and text messages with the candidate
• Background check consents and reports, reference notes
• Self-identification data (race, ethnicity, sex, veteran and disability status) collected for EEO reporting
• Job postings, requisitions and the criteria used to decide

A retention policy has to cover all of it, including copies in recruiters' inboxes, spreadsheets and vendor platforms. Once someone is hired, much of this record moves into their personnel file and falls under employee record rules instead.

US minimums: how long to keep applicant records

Federal law sets floors, not ceilings:

• Title VII, the ADA and GINA (EEOC regulation 29 CFR 1602.14): private employers must keep employment records, including applications and records about hiring, for one year from the date the record was made or the personnel action taken, whichever is later.
• ADEA (29 CFR 1627.3): similar one-year retention for applications and records related to hiring and other decisions.
• Federal contractors (VEVRAA and Section 503, 41 CFR 60-300.80 and 60-741.80): two years for contractors with 150 or more employees and a contract of at least $200,000 (VEVRAA) or $150,000 (Section 503); one year for smaller contractors. Outreach assessments and veteran applicant and hire counts are kept for three years. The older EO 11246 rule (41 CFR 60-1.12) was rescinded effective October 26, 2026.
• Pending charges or lawsuits: once a discrimination charge is filed or litigation is reasonably anticipated, all relevant records must be kept until the matter is finally resolved, whatever the normal schedule says.

States can require more. California's Fair Employment and Housing Act requires employers to keep applications and personnel records for four years, and California's Civil Rights Council regulations on automated-decision systems, effective October 1, 2025, extend that to data from automated tools used in employment decisions. Form I-9 rules apply only to people actually hired. Rules vary by state, so map each state where you hire.

Privacy laws: keep it no longer than needed

Privacy laws push the other way. Under the GDPR, personal data may be kept only as long as necessary for the purpose it was collected for (storage limitation). There is no fixed number of months, but many EU employers keep unsuccessful candidates' data for six months to a year after the decision, roughly matching the window for discrimination claims, and need separate consent to keep people in a talent pool longer. See GDPR in recruitment for the wider rules.

In the US, California's privacy law gives applicants rights to know, correct and delete their data, and requires employers covered by it to disclose retention periods in the notice at collection. Illinois BIPA requires destruction of biometric data within set limits. The practical result: each data type needs both a minimum and a maximum.

Worked example: a simple retention schedule

A national retailer hiring in 30 states, including California, and holding no federal contracts might set:

• Applications, resumes, scorecards, interview notes, assessment results: 4 years from the hiring decision, company-wide, to meet California's rule with one standard instead of 30.
• Video interview recordings: 1 year, then delete, unless a legal hold applies. The scorecard and decision are kept for the full period.
• Background check reports for candidates not hired: per the vendor contract and FCRA disposal rules, typically 1 to 2 years after adverse action.
• EEO self-identification data: kept separately from the application, same period as the application.
• EU candidates: 12 months after the decision unless the candidate consents to longer talent pool storage.

A legal hold flag overrides every automatic deletion.

Common mistakes

• Keeping everything forever. It feels safe, but it increases breach exposure, discovery costs and privacy liability.
• Deleting too early, especially after a charge is filed. Destroying records under a legal hold can lead to sanctions and an adverse inference against the employer.
• Forgetting vendors. Assessment, video and background check platforms hold their own copies. The contract should require deletion on your schedule.
• Off-system records: interview notes in personal notebooks, candidate lists in spreadsheets.
• Mixing self-ID data with hiring files where interviewers can see it.

How to build and run a retention policy

Start with an inventory of every place candidate data lives. Assign each data type a retention period based on the longest legal minimum that applies and the shortest period privacy law allows. Configure automatic deletion or anonymization in the ATS and ask each vendor to match it. Document the policy, train recruiters on what not to store elsewhere, and audit once a year. This page is general information; have counsel review your schedule against the states and countries where you hire.