There is no single fixed retention period in the GDPR itself. The safest baseline is 6 months after rejection, aligned with discrimination claim windows in Germany and the UK. France's CNIL allows up to 2 years from last contact.
Retention beyond these periods needs explicit consent (for a talent pool) or a documented legitimate interest. Keeping data indefinitely is a fast-growing fine trigger: CNIL has issued six-figure fines against companies that retained personal data without a defined retention period, and the same principle applies to candidate records.
DPA recommendations by country
- France (CNIL): up to 2 years from last contact. Inform the candidate at collection and delete automatically unless consent is refreshed
- Germany: 6 months after rejection, covering the AGG (General Equal Treatment Act) two-month written-claim window plus the three-month court-filing window plus a buffer. Some data processing agreements accept up to 12 months with justification
- UK (ICO): no fixed period, but "no longer than necessary." Most employment lawyers advise 6 to 12 months, aligned with the 3-month tribunal deadline plus extensions
- Netherlands: 4 weeks after rejection as default, and up to 1 year with explicit consent
- Spain: unclear guidance. Most practitioners follow the 1-year statute of limitations for labour claims
- Ireland: DPC recommends 12 months maximum
For companies operating across several EU countries, 6 months is the safest default and 12 months is defensible with documented justification.
What can and cannot be kept
- Delete after the retention period: CVs, cover letters, interview notes, test results, reference check data, correspondence, and any special category data disclosed during the process
- Keep with consent: anonymized data for reporting; a candidate profile in a talent pool, only with freely given, specific, informed, and unambiguous consent (GDPR Art. 7)
- Legal basis matters: legitimate interest (defending against discrimination claims) justifies 6 to 12 months. Anything beyond needs consent.
- Make deletes automatic in the applicant tracking system. Manual processes are the most common cause of accidental over-retention.
What to do now
- Set a default retention period (6 months recommended) in the ATS
- Configure automatic deletion or anonymization when the period expires
- Add a clear retention notice to the application form and offer an opt-in to the talent pool
- Audit existing candidate data: delete CVs older than the retention period without consent
Disclaimer:
This article informs. It does not advise on the law. DPAs interpret the rules on retaining candidate data differently. The rules vary by EU member state and are still changing.
TL;DR
- No fixed GDPR period, and 6 months is the safest baseline for most EU countries.
- France allows 2 years, while Germany and the UK recommend 6 to 12 months, and the Netherlands defaults to 4 weeks. Talent pools require explicit consent.
- Make deletes automatic in the ATS. CNIL has fined companies hundreds of thousands of euros for keeping personal data without defined retention periods.