Right to Erasure for Candidates: How to Handle Deletion Requests

Under the GDPR and UK GDPR, a candidate can ask you to erase their personal data in certain situations: the data is no longer needed for the purpose, they withdraw consent, they object and nothing overrides their objection, or it was processed unlawfully. You must respond without undue delay and within one month, which can be extended by up to two months for complex or numerous requests if you explain why. Delete across all systems, tell any vendors you shared it with, and record what you did. You may keep data you are required or entitled to retain, such as what you need to defend a claim, if you justify it and limit its use. This is general information, not legal advice, as of October 2026.

Handling requests well is mostly a matter of knowing where your data is.

When the right applies

Article 17 of the GDPR sets out the grounds. In recruitment, the common ones are:

• The data is no longer necessary for the purpose you collected it for, for example after the role is filled and the retention period has passed.
• The candidate withdraws consent, for example for a talent pool.
• The candidate objects and there are no overriding legitimate grounds.
• The data was processed unlawfully.

It does not give a right to delete everything in every case.

When you can keep data

The right has exceptions. Those most relevant to recruiters are:

• Compliance with a legal obligation, such as a recordkeeping requirement.
• Establishing, exercising or defending legal claims, for example data you need while a discrimination claim could still be brought.

If you keep data under an exception, tell the person, explain briefly, restrict access to what is needed and delete it when the reason ends. See candidate data retention for typical periods.

A process you can follow

1. Log the request with the date received. The clock starts when you receive it, not when you read it.
2. Verify the person's identity in a proportionate way, without asking for more than you need.
3. Locate the data: your applicant tracking or screening tool, email, spreadsheets, shared drives, interview notes, vendor systems and agencies.
4. Decide what you must keep, if anything, and why.
5. Delete the rest, or anonymise so the person cannot be identified.
6. Notify third parties you shared the data with, where required and feasible.
7. Reply in writing, within the deadline, saying what you deleted, what you kept and why.
8. Record the request and the outcome, without keeping the deleted data.

What to say in the reply

"Thank you for your request. We have deleted your application, resume and interview notes from our systems and asked our recruitment software supplier to do the same. We have kept a record of your name and the fact that you asked not to be contacted, so that we do not contact you again, and we hold limited records for [period] to meet our legal obligations. If you have questions, contact [name and email]."

Be clear and brief, and give the person your complaint route to the regulator, where the law requires it.

Common problems

• Scattered copies: resumes forwarded by email or saved in downloads. Search them.
• Vendors and agencies: you remain responsible for instructing them.
• Backups: delete from live systems at once, and let backups expire on their cycle, noting that they are put beyond use.
• Interview notes with several people's data: separate what concerns the candidate.
• Re-contact: if you erase everything, you may contact the person again by mistake. Keep a minimal suppression record.

Prevent the work

Fewer copies and a clear retention schedule reduce requests. Keep resumes in one place, share links instead of files, set deletion dates on every record and tell candidates up front how long you keep data. See GDPR and recruitment data and applicant tracking spreadsheet.

Related rights

Candidates may also ask for access to their data, ask you to correct it, restrict processing or object. See candidate subject access requests. If automated tools affect decisions, other rules apply, such as those on solely automated decisions and notices. See candidate AI disclosure.

Tools

A system that holds applications in one place and supports export and deletion makes this simpler. Resume World lets you enforce retention and delete candidate data, and export it for access requests. Check how any tool you use deletes data from every store, including files and notes. If you use a spreadsheet, keep a log of requests and the steps taken.

An example from start to finish

A candidate emails on 3 March asking to be removed from your talent pool and for their data to be deleted. You log the request on 3 March, so the one-month deadline is 3 April. You confirm identity from the email address on file. Searching finds the application in your tracking tool, the resume in a shared folder, three emails with the hiring manager and a spreadsheet row. The role closed in January, and your retention schedule says to keep records for six months, so nothing needs keeping to defend a claim beyond a short note. You delete the data from all four places, ask your software supplier to confirm deletion and keep a single line, "do not contact", on a suppression list. On 10 March you reply with a short summary. The whole thing takes about an hour because you knew where the data was.