How Long Can You Keep Candidate Data Under GDPR? An ATS Retention Guide
The short answer: only as long as you actually need it
There is no single number written into the GDPR that says "keep resumes for X months". Instead, the regulation sets a principle: storage limitation (Article 5(1)(e)). You may keep personal data only for as long as it is necessary for the purpose you collected it for, and no longer.
For recruitment, that purpose is filling a role. Once the role is filled, the original reason for holding most applications is gone. Keeping every resume "just in case" is exactly what the GDPR is designed to prevent.
So the honest answer to "how long can I keep candidate data?" is: as long as the hiring purpose lasts, plus a limited, documented period if you have a reason to extend it. Below is how that translates into practice.
Hired vs. not hired: two different clocks
The retention question splits in two, depending on the outcome.
The candidate you hired. Their data stops being "application" data and becomes part of the employment relationship. From that point, different rules apply (payroll, employment law, social security), often with their own, longer legal retention periods. That's a separate topic from recruitment retention.
The candidates you didn't hire. This is where recruiters get exposed. Once the position is filled, you no longer have an active reason to keep their resume. You then have two clean options:
- Delete or anonymize the application shortly after the decision, or
- Keep it for a limited period to consider the person for future roles, provided you inform them and, in many jurisdictions, obtain their agreement.
The two-year rule of thumb (and why it's not a law)
Many data protection authorities publish practical guidance. In France, for example, the CNIL suggests that data on an unsuccessful candidate can typically be kept for up to two years after your last contact, if you intend to keep them in a talent pool and you have informed them.
Two important caveats:
- It's guidance, not a hard EU-wide limit. The number varies by country and by regulator. Always check your local data protection authority. The GDPR itself gives a principle, not a fixed duration.
- The clock resets on meaningful contact, not indefinitely. "Last contact" means a real interaction, not a silent record sitting in a database for years.
If you have no intention of re-contacting the person and no legal reason to keep the file, the safest posture is to delete or anonymize soon after the hiring decision.
Why keeping data "too long" is a real risk
An over-full candidate database feels harmless. It isn't.
- It's a direct GDPR breach. Holding data past its necessary period violates storage limitation, one of the principles regulators check first.
- It enlarges your exposure in a breach. Every resume you no longer need is extra sensitive data that can leak. Minimizing what you store is also basic security.
- It undermines candidate trust. Applicants increasingly ask what happens to their data. "We deleted it once the role was filled" is a far better answer than silence.
Retention isn't about keeping less for its own sake. It's about keeping only what has a purpose, and being able to prove it.
How to enforce retention without doing it by hand
The weak point in most teams is not the policy, it's the execution. Deletion dates get forgotten, spreadsheets pile up, and old resumes survive in email attachments and shared drives.
The reliable way to enforce retention is to let your tooling do it:
- Define a written retention policy (how long, for which category, on what legal basis).
- Store applications in one system, not scattered across inboxes and drives.
- Automate deletion so files are removed or anonymized when their period ends, without anyone remembering to act.
- Give candidates a one-click erasure path to honor the right to be forgotten on request.
This is precisely where a modern, GDPR-compliant ATS earns its place: it applies your retention rules automatically, keeps an audit trail, and spares you the manual clean-up that never actually happens. Candidalyze, for instance, enforces a defined retention window and deletes expired applications automatically, rather than leaving it to your memory.
A quick retention checklist
Before your next hiring round, confirm you can answer yes to each:
- Do you have a written retention policy for candidate data?
- Do you inform candidates how long you keep their application?
- Do you delete or anonymize unsuccessful candidates once the role is filled, unless you have a documented reason to keep them?
- Is any extended retention time-boxed (e.g. two years) and consented to where required?
- Is deletion automated, not dependent on someone remembering?
- Can a candidate ask for erasure and get it quickly?
If any answer is no, that's your next fix.
Frequently asked questions
Does the GDPR set a maximum retention period for resumes?
No. The GDPR sets the storage-limitation principle (keep data only as long as necessary), not a fixed number. Specific durations come from national regulator guidance and from other laws that may apply. Check your local data protection authority.
How long can I keep an unsuccessful candidate's resume?
Only as long as you have a purpose. If you want to keep them for future roles, many regulators (such as France's CNIL) point to around two years after last contact, provided you informed the candidate. Otherwise, delete or anonymize shortly after the position is filled.
Do I need consent to keep a resume in a talent pool?
In many jurisdictions, yes, or at least clear information and a genuine opportunity to object. The safe approach is to tell candidates upfront and honor any request to be removed.
What's the easiest way to stay compliant?
Centralize applications in one compliant tool and automate deletion, so retention rules apply themselves. Manual tracking across inboxes and spreadsheets is where compliance quietly breaks.
Conclusion
"How long can you keep candidate data under the GDPR?" has a simple guiding answer: only as long as it serves a real purpose, plus a limited, documented extension if you have a reason. Regulator guidance like the two-year mark helps, but the principle matters more than the number, and the hardest part is enforcement.
Automate it. A retention policy that runs itself protects you far better than one that lives in a document nobody opens.
Want retention handled for you? Try Candidalyze for free: AI resume analysis with a built-in ATS, hosted in France, GDPR compliant, with automatic deletion of expired applications. 5 free analyses, no commitment.