How long you can keep candidate data depends on the law where you hire and on why you are keeping it. In the UK, regulator guidance ties retention for unsuccessful applicants to the period in which someone could bring a claim arising from the recruitment, which is why around six months is a common starting point. In the US, federal recordkeeping rules require employers to preserve hiring records for at least one year from the record or the action, and some contractors and states require more. EU member states differ. Keep data only as long as you need it for a stated purpose, tell candidates what you do, and delete or anonymise on schedule. This is general information, not legal advice, as of October 2026.
Write the schedule down, and make someone responsible for running it.
What the main sources say
| Place | Starting point | Source |
|---|---|---|
| UK | Do not keep applicant records beyond the period in which a claim could be brought, unless there is a clear reason. Six months is a common baseline, following the time limit for discrimination claims under the Equality Act 2010 | General principle: ICO storage limitation guidance |
| US federal | Preserve application and hiring records for one year from the making of the record or the personnel action, whichever is later | 29 CFR 1602.14 |
| EU | GDPR storage limitation applies; national rules and limitation periods vary by member state | Check the national authority |
| AI-specific laws | Some require records of automated decisions. Colorado's amended AI law is reported to require records for at least three years; confirm the current text | Check the statute |
Federal contractors in the US have additional recordkeeping duties, and some states set longer periods. Take advice for your location.
Why not keep everything forever
- GDPR and similar laws require data to be kept no longer than necessary.
- Old data becomes inaccurate and creates breach risk.
- More data means more to produce in a request for access. See candidate subject access requests.
- Candidates expect their information to be handled with care.
Build a retention schedule
A simple table works.
| Data | Purpose | Keep for | Then |
|---|---|---|---|
| Application, resume, answers | Considering the role | Role duration plus the claim window, such as 6 to 12 months | Delete |
| Interview notes and scorecards | Decision and defence of claims | Same period | Delete |
| Test and assessment results | Decision | Same period | Delete |
| Demographic monitoring data | Fairness checks | As needed, separate from decisions; aggregate when possible | Anonymise |
| Talent pool (with consent) | Future roles | 12 to 24 months, renewed | Delete or ask to renew |
| Hired candidate's records | Employment | Moves to the employee file under its own rules | Per policy |
| Suppression list | Do not re-contact | Until needed | Minimal record |
Adjust the periods to the law that applies, and write the reason beside each.
Talent pools
Keeping strong candidates for future roles is useful, and it is a separate purpose from the original application. In the UK and EU, ask for consent or rely on another lawful basis you can justify, say how long you will keep the data and allow people to withdraw. See candidate consent in recruitment. Refresh the consent periodically, and delete if it is not renewed.
Where candidate data lives
Data is rarely in one place. Check:
- Your applicant tracking or screening tool.
- Email inboxes, including forwarded resumes.
- Spreadsheets and shared drives. See applicant tracking spreadsheet.
- Calendar invitations and chat messages.
- Vendor and agency systems.
- Local downloads and printouts.
A retention policy that covers only one system will leave copies elsewhere. Reduce copies by keeping resumes in one place and sharing links with access controls.
Running deletion
- Set a retention date on each record when the role closes.
- Run a monthly job or reminder to find records past their date.
- Delete or anonymise, including backups according to your backup cycle.
- Record what was deleted and when, without keeping the personal data.
- Tell vendors to delete, and confirm.
Automatic retention enforcement in your tool saves effort. Resume World includes retention controls and data export, which helps with this. Whatever tool you use, check it deletes from all stores.
Exceptions
You may need to keep data longer if there is a legal hold, a pending claim or a regulator's request. Note the reason, limit access and delete when it ends.
Tell candidates
State in your privacy notice and on the application form what you keep, why and for how long, and how to ask for deletion. See GDPR and recruitment data, right to erasure for candidates and candidate AI disclosure.
Common inquiries regarding this topic.
How long can you keep unsuccessful candidates' data?
It depends on the law where you hire and your reason for keeping it. UK guidance ties retention to the period in which a discrimination claim can be brought, which is why six months is a common starting point. In the US, federal rules require keeping hiring records for at least one year. Some places and some contractors require longer.
It depends on the law where you hire and your reason for keeping it. UK guidance ties retention to the period in which a discrimination claim can be brought, which is why six months is a common starting point. In the US, federal rules require keeping hiring records for at least one year. Some places and some contractors require longer.
The Resume World Team
VerifiedProduct & hiring research, Resume World
We build the screening engine behind Resume World. Everything here comes out of working on resume parsing, scoring and hiring workflows day to day — including the parts that turned out harder than expected.
See more than just keywords.
Resume World extracts verifiable evidence from every applicant against role criteria and delivers an explained, ranked shortlist. 100% free to start with zero card required.
