Personal Data Protection in Hiring and General Principles
Human resources departments are at the forefront of a company's units that process personal data most intensively and sensitively. Throughout the process from publishing a job posting to the interview stage, technical tests, and reference checks, the names, surnames, contact information, educational backgrounds, health declarations, and reference evaluations of hundreds of candidates are recorded.
The General Data Protection Regulation (GDPR) strictly prohibits the random collection of personal data and keeping it in archives for unlimited periods. In particular, retaining the resumes of candidates eliminated during the hiring process for years by saying "we are keeping them in the pool for positions that may arise in the future" is among the violations most frequently subjected to substantial fines by the data protection supervisory authority.
In this article, we examine the legal retention periods for candidate data, resumes, and reference check reports, periodic destruction rules, and the technical and administrative measures companies need to take, in line with GDPR principles.
GDPR Art. 5 and Art. 17: Purpose Limitation and the Obligation to Erase
Article 5 of the GDPR regulates the general principles that must strictly be followed in the processing of personal data. Chief among these principles are:
- Processed for specified, explicit, and legitimate purposes
- Adequate, relevant, and limited to what is necessary in relation to the purposes for which they are processed
- Kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed
Article 17 of the Regulation clearly states that personal data must be erased, destroyed, or anonymized by the data controller, either ex officio or upon the request of the data subject, when the reasons requiring their processing no longer exist.
The fundamental legal rule here is this: You cannot retain data forever. Data can only be kept for the minimum period required to fulfill the purpose for which it was collected. Once the purpose is completed, the legal validity of that data expires.
Retention Periods for Accepted and Rejected Candidates
Candidates whose data is collected during the hiring process are legally evaluated in two separate groups:
1. Accepted Candidates
The application form, interview notes, and reference check reports of an accepted candidate are transferred to the employee's personnel file. National employment law imposes an obligation on the employer to maintain a personnel file; how long the file will be retained is practically derived not directly from this law but from general statute of limitations and the periods for the right to file lawsuits in labor law (e.g., statute of limitations in severance/notice pay and reinstatement lawsuits). In practice, companies may therefore retain the personnel file for many years (with periods up to 10 years in widespread practice); the concrete retention period should be confirmed by each company's own legal counsel.
2. Rejected (Eliminated) Candidates
For candidates who are not accepted for the job, the purpose of processing ends when the hiring decision for that open position becomes final. However, the employer has the right to defend against potential discrimination claims, equal treatment principle violation lawsuits under national employment law, or hiring disputes.
Within this framework, in accordance with the guidance of the data protection supervisory authority and established judicial practices:
- If the candidate has no consent: It can be retained for 6 months to a maximum of 1 year from the completion of the hiring process and the notification of rejection. At the end of this period, the data must be erased.
- If the candidate has consent for the talent pool: If the candidate clearly gave consent with their free will during the application stating "I approve the retention of my resume and data for suitable future positions," this period can be determined as a maximum of 1 to 2 years. Retention periods exceeding 2 years are considered contrary to the principle of proportionality by the authority.
The Legal Status of the Reference Provider's Data
A critical detail often overlooked in the reference check process is the personal data of the person providing the reference. The name, title, institution worked for, work email, phone number, and personal evaluations about the candidate of the person acting as a reference are also personal data.
A dual responsibility arises here:
The person providing the reference must strictly be provided with a privacy notice before answering, and must be informed that their data will only be processed for the purpose of the hiring evaluation of the candidate in question. If the candidate is not hired, the reference provider's data must also be destroyed along with the candidate's data at the end of the determined retention period.
How to Prepare a Personal Data Retention and Destruction Policy?
It is a legal obligation for all companies that have an obligation to register with the record of processing activities (Art. 30) or meet the number of employees/financial balance sheet criteria to prepare a "Personal Data Retention and Destruction Policy".
A destruction policy specific to human resources processes must necessarily include the following headings:
- Legal and factual reasons requiring the retention of candidate data
- Technical methods to be applied in the erasure, destruction, or anonymization of the data
- Periodic destruction periods (By law, periodic destruction must be carried out at least every 6 months)
- Units and titles assigned to destruction processes
- Recording of destruction operations (logging and destruction minutes)
This prepared policy must be accessible on the company's internal intranet or documentation system, and recruitment teams must strictly comply with these rules.
Methods of Erasure, Destruction, and Anonymization
The data protection legislation defines three different methods for the destruction of data:
HR's Obligation Regarding the Candidate's Data Erasure Request (Art. 15-22)
Articles 15-22 of the GDPR grant data subjects the right to request the erasure or destruction of personal data concerning them.
A candidate may apply to the company after their job application is rejected, or even while the process is ongoing, with a request such as:
*"I request the immediate erasure of my resume, interview notes, and collected reference check records that I submitted to your company."*
The employer acting as the data controller is obliged to finalize this request free of charge within one month at the latest and to provide a reasoned response to the candidate in written or electronic form.
If the company does not have a statutory obligation requiring the retention of the data (e.g., an ongoing lawsuit), the request must be fulfilled immediately, and all reference and CV records of the candidate must be erased from the system. Additionally, if the reference data is kept with a third-party service provider, the instruction for erasure must be forwarded to this provider as well.
Conclusion: The Importance of Automation for Legal Security
Tracking candidate data kept manually in Excel spreadsheets, email inboxes, or local computer folders is nearly impossible. Tracking whose data was collected 1 year ago, whose consent has expired, and which reference file needs to be destroyed cannot be managed through manual processes.
GDPR-compliant digital reference management platforms like AuditCV.io track retention periods automatically. When the determined legal retention period expires or the candidate withdraws their consent ("Revoke"), the system automatically erases or anonymizes the data. This automation is the most effective safeguard protecting companies from costly administrative fines and loss of reputation.