How long can you keep candidate CVs under GDPR?

GDPR sets no fixed retention period for CVs; it requires that you keep them no longer than needed for the purpose. In practice, common guidance in the Netherlands is four weeks after the process ends, or up to one year with the candidate’s consent. Longer retention needs fresh consent or a clear legal reason.

This is practitioner guidance, not legal advice. Retention numbers vary by country and situation; confirm yours with counsel or your privacy officer.

What does GDPR actually say about keeping CVs?

GDPR’s storage-limitation principle says personal data may be kept no longer than necessary for the purpose it was collected for. For a CV, that purpose is usually “assess this person for this vacancy”, and it ends when the process ends. After that point you need either a new purpose with its own lawful basis, in practice the candidate’s consent to stay on file, or a defensible legal reason to retain. GDPR deliberately avoids fixed numbers; regulators and national practice fill them in.

How long do recruiters keep CVs in practice?

These are working norms rather than statutes. The four-week and one-year figures come from guidance published by the Dutch regulator and are widely used as a rule of thumb beyond the Netherlands, but member states differ, and some employers keep application records longer where local rules around discrimination claims justify it. Treat the table as a starting point, not a verdict. Agencies juggling client-side copies of the same CV carry extra duties; see whether you are controller or processor in client work.

The Dutch guidance: four weeks, or one year with consent

The commonly cited Dutch position is refreshingly concrete: delete application data within four weeks after the procedure ends, unless the candidate consents to longer retention, in which case about one year is considered reasonable before you ask again. Two details get missed in practice. The consent must be a genuine choice, not a pre-ticked box buried in the application form. And the year is not a free pass: if the candidate withdraws consent in month three, the clock stops in month three. Recruiters working the Dutch market will find more in our guide on what ATS Dutch recruiters should use.

What about talent pools and keeping candidates on file?

A talent pool is simply retention with a new purpose, which means it runs on consent in most setups. Ask for it explicitly, record the scope and date, make leaving effortless, and renew before the period lapses. A pool full of profiles nobody re-consented is not an asset. It is a liability with search filters.

How scheduled deletion and anonymization work in an ATS

Modern systems attach a retention clock to each record based on its situation: rejection date, consent date, placement date. When a clock runs out, the system deletes the record or anonymizes it, stripping the name, contact details, documents, and free-text notes while keeping non-identifying pipeline data so your reporting survives. An audit trail records what happened and when, which is the evidence you want if a regulator ever asks.

Recruitifly automates exactly this: consent tracking per candidate, scheduled retention with anonymization, data-subject request handling, and audit trails are built into the platform. The wider compliance picture, from processor agreements to access requests, is covered in what makes an ATS GDPR-compliant.

A retention policy you can actually follow

1. List your purposes: active process, talent pool, placement administration.
2. Set a period per purpose and write one sentence of justification for each.
3. Decide deletion versus anonymization per purpose.
4. Automate enforcement in your ATS, with audit trails, so the policy runs without willpower.
5. Review yearly, and whenever you enter a new market.

Recruitifly is in private beta. If your retention policy currently lives in a calendar reminder, talk to us; the platform does the remembering for you.