The candidate you rejectedis still in your database.

An application is for one role, not for a lifetime.

In one line: Only as long as needed for the recruitment purpose, unless the candidate consents to longer retention, for example for future roles. Data should be erased once the purpose is served.

The estate · HR & StaffingHover to inspect

A CV is not a subscription.

The scene

A candidate applied in 2017 and was rejected. Since then she has been called for eleven roles, her CV has been shared with four clients, and her salary expectation from nine years ago is still in the system as a filter.

Where the thinking breaks

The unclear thoughtWhat it breaksThe clearer thought
Candidates consented by applying. They applied for a role; storing and sharing for others is a new purpose. Ask separately to keep a CV for future roles.
Employment legitimate use covers recruitment. Section 7(i) covers employment purposes; its reach before employment is uncertain. Rely on consent for talent pools.

A talent pool with consent

Offer the candidate a clear choice: keep my CV for twelve months for similar roles, or delete it when this role closes. Honour the choice automatically.

Monday morning

  1. 01Count CVs older than two years.
  2. 02Set a default retention for rejected candidates.
  3. 03Add the talent-pool opt-in to applications.

Questions, answered plainly

Can companies keep CVs of rejected candidates under DPDPA?

Only as long as needed for the recruitment purpose, unless the candidate consents to longer retention, for example for future roles. Data should be erased once the purpose is served.

Does the employment exemption cover job applicants?

Section 7(i) permits processing for employment purposes. Whether it extends to candidates who never become employees is not settled; relying on consent for talent pools is safer.

Sector · HR & StaffingThe candidate you never hired is still your Data Principal.Read → HR & Staffing · Deep diveThe software can see everything. The law asks what you need.Read → HR & Staffing · Deep diveThe verifier knows more than the hiring manager.Read →

Tell us where your data sits.We'll show you where the exposure is.

A partner replies within one working day, with a first view on your penalty exposure.

Speak to a partner