The retention paradox in hiring tech: more data, more risk
Talent acquisition teams love data because it promises better hiring decisions. Yet the same candidate data that powers rediscovery, sourcing and AI matching will quietly turn into a compliance time bomb if you ignore retention rules. The uncomfortable truth is that every extra CV you keep for unnecessary years increases legal exposure faster than it improves quality of hire.
Most global organisations now run Workday Recruiting, Greenhouse, Lever or SmartRecruiters as their primary hiring stack, and each system encourages storing more personal data for longer periods. Vendors highlight how historical candidate records will be retained in talent pools, how every contact and interview note is stored for future rediscovery, and how AI models improve when more personal data is available. Yet none of those glossy demos explain who owns the retention policy, how long each data category will be kept, or when the system will delete data automatically.
The paradox is simple to state but hard to manage in practice. More historical candidate data improves pass-through-rate analytics, adverse impact monitoring and AI model performance, but every extra retention year you accept without scrutiny multiplies recordkeeping obligations under GDPR, CPRA and the EU AI Act. In the United States, the same candidate records that help you defend discrimination claims must also respect privacy expectations from regulators and plaintiffs’ lawyers who now understand data retention better than many HR teams.
Regulators are converging on one core idea for candidate data in hiring. Personal data must be collected for a clear purpose, processed lawfully, and retained only for the minimum period that purpose requires. Under GDPR, that means you need a documented retention policy that explains which candidate data will be retained, which data will be deleted, and how each retention rule aligns with legal bases such as legitimate interest or consent.
Recent enforcement decisions show that this is not theoretical. In 2018, the Danish Data Protection Authority reprimanded a company for keeping unsolicited job applications for longer than six months without a clear legal basis, and in 2020 the Spanish authority sanctioned an employer that retained CVs indefinitely after a recruitment process had closed. These cases, alongside decisions from German and French regulators on excessive storage of applicant files, illustrate how quickly “nice to have for talent pooling” becomes “unlawful retention” when timelines are vague.
California’s CPRA adds another layer by treating many candidate records as personal information with specific retention and disclosure obligations. When you use automated decision tools in hiring, CPRA expects you to keep records of the logic, the data processing steps and the outcomes for a period that aligns with applicable recordkeeping rules, often several years under related employment and civil rights laws. New York City’s AEDT law then requires that bias audit data, candidate notifications and related records be retained long enough to demonstrate ongoing compliance, which again pushes TA leaders to think in explicit retention timelines rather than vague promises.
The EU AI Act goes further for high-risk HR systems, including AI used for candidate screening, scoring or automated shortlisting. It requires documented data governance, clear rules for training sets, and evidence that personal data used for AI model development respects both privacy and data protection law. Emotion recognition in workplace contexts is banned, which means any vendor claiming to infer traits from video interviews is now a direct compliance risk, not just an ethical dilemma.
For procurement and IT buyers, the message is blunt. A candidate data retention policy for hiring is no longer a nice-to-have appendix in the contract; it is a core control that determines whether your ATS, CRM and assessment stack can survive regulatory scrutiny over multiple regulation timelines. The candidate data you are hoarding will cost you, not only in storage fees and system complexity, but in the legal and reputational damage when regulators ask why you retained personal data for ten years without a clear retention rule.
What “minimum necessary” really means for candidate data
Compliance teams often repeat that candidate personal data must be limited to what is necessary, but TA leaders rarely translate that phrase into concrete retention rules. Minimum necessary does not mean deleting all candidate records after every hiring campaign; it means defining a specific retention period for each category of candidate data, aligned with legal, operational and analytics needs. The nuance is where most organisations fail audits.
Start with four core categories that every serious hiring tech stack generates. First, applicant records in the ATS, including CVs, application forms, contact details and communication logs, which are the backbone of candidate data and must be retained long enough to defend against discrimination or wrongful hiring claims. Second, screening and scoring decisions, including recruiter notes, structured ratings, pass–fail outcomes and automated decision outputs, which are essential records for demonstrating that your hiring rules were applied consistently.
Third, AI model training data, which often includes large volumes of historical personal data extracted from CVs, assessments and internal HRIS records. Fourth, assessment results from coding tests, cognitive tools or video interviews, which are frequently processed by third-party vendors and then fed back into your ATS or HR data warehouse. Each of these categories needs its own retention policy, its own timelines and its own logic for when data will be deleted or anonymised.
Under GDPR, the storage limitation and data minimisation principles force you to justify every retention period you choose. If you say applicant records will be retained for two years, you must show why that duration is necessary for legal defence, talent pooling or quality-of-hire analytics, and why longer retention would be excessive. If you keep AI training data for five years, you must explain how that aligns with both data protection law and your internal privacy compliance framework.
In the United States, the concept of minimum necessary is shaped by a patchwork of federal and state rules. Equal Employment Opportunity Commission guidance, Fair Credit Reporting Act obligations and emerging state privacy laws all influence how long candidate records should be retained, how quickly you must delete data on request, and which recordkeeping requirements apply to automated decision systems. The Eightfold AI Fair Credit Reporting Act class action, filed in 2022 and focused on adverse action notices and background report handling, has already shown procurement teams that AI vendors who mishandle candidate data can create significant liability, which is why any evaluation of vendor questions your procurement team now owes you must include explicit retention rules.
Minimum necessary also applies to the granularity of data stored, not just the duration. You may need to keep a record that a candidate failed a coding assessment for three years, but you probably do not need to retain every keystroke or webcam frame for that entire period. A smart retention policy will delete data that is not required for legal defence or analytics, while keeping high-level records that preserve your ability to explain past hiring decisions.
For TA and HR tech buyers, the practical test is simple. If you cannot explain to your Data Protection Officer why a specific type of candidate data will be retained for a specific period, you probably should not store it at all. The candidate data retention policy for hiring must be written in plain language that procurement, IT security and TA leaders can all defend in front of a regulator, not buried in a vendor’s generic privacy policy.
A retention schedule that survives changing regulations
Regulatory timelines move faster than most ATS roadmaps, so you need a candidate data retention policy that can outlive any single law. The goal is not to predict every future rule but to build a retention framework that can absorb new recordkeeping requirements without tearing up your hiring tech stack every two years. That means structuring your retention policy around data types and risk levels, not around the current fashion in privacy law.
Start by mapping all candidate data stored across your ecosystem, including ATS, CRM, assessment platforms, background check vendors and internal data warehouses. For each system, list the personal data fields, the purpose of processing, the legal basis, the current retention period and whether data will be deleted automatically or only on request. This mapping exercise often reveals shadow databases where candidate records have been retained for many years without any explicit retention rule or privacy compliance review.
Next, define a small set of standard retention periods that you can apply consistently. Many organisations use tiers such as 6 months, 2 years, 4 years and 7 years, aligning them with litigation risk, analytics value and statutory limitation periods in key jurisdictions. Applicant records for unsuccessful candidates might follow a 2-year retention period, while bias audit data and automated decision logs might require 4 years to satisfy CPRA, NYC AEDT and related employment recordkeeping requirements.
Then assign each data category to one of these standard retention periods, documenting the rule and rationale. A simple working schedule might look like this: applicant CVs and contact details retained for 2 years in the ATS on the basis of legitimate interest and equal opportunity recordkeeping; screening notes and interview ratings retained for 2–4 years depending on jurisdictional litigation windows; assessment raw data kept for 6 months with only summary scores and pass–fail flags retained for 2 years; AI training datasets refreshed every 3–5 years with older identifiable records anonymised; and anonymised analytics aggregates retained for up to 7 years to preserve trend lines without storing identifiable personal data.
For global organisations, you will need jurisdiction-specific overlays on top of this core schedule. In the EU, GDPR and the EU AI Act drive stricter retention rules for personal data used in automated decision making, while in the United States, federal anti-discrimination law and state privacy statutes shape how long candidate records must be retained. A robust retention policy will state that where multiple laws apply, the longest legally required retention period wins for that specific data type, but no data will be retained longer than necessary for the stated purpose.
TA leaders also need to think about how retention periods interact with talent pooling and internal mobility strategies. If your sourcing team wants to keep candidate data for five years to support long-term pipelining, you must either obtain explicit consent with clear information about the retention period, or anonymise data after a shorter period while keeping only minimal contact metadata. When you evaluate whether staffing versus recruiting in tech is the right strategy for your organisation, your retention policy should already explain how candidate records will be handled across both models, which you can align with your broader approach to staffing versus recruiting in tech.
Do not forget edge cases such as temp roles, gig work and high-volume seasonal hiring. These often generate large volumes of candidate data with short-term value but long-term compliance risk, especially when drug testing or background checks are involved. Your retention schedule should explicitly cover how long such sensitive records are retained, how quickly you delete data when it is no longer needed, and how you communicate these rules to candidates who may already be anxious about how their personal data is processed, as seen in debates about whether temp jobs require drug testing.
From hoarding to governance: the DPO conversation and purge logistics
Once you have a candidate data retention policy on paper, the hard work begins. You must turn that policy into system-level retention rules, automated deletion jobs and audit-ready evidence that data will actually be deleted when the retention period expires. This is where TA leaders need a tight partnership with the Data Protection Officer, IT security and procurement.
Your DPO will expect more than a high-level statement about data retention. They will want a data inventory that shows where candidate data is stored, which vendors process personal data on your behalf, and how each system enforces retention periods in practice. They will also ask how you handle candidate rights requests, such as access, rectification and delete data requests, and whether your ATS and CRM can execute those requests across all linked records.
For each major hiring system, you should document three things in language your DPO can use in front of regulators. First, the specific retention periods applied to each data category, including applicant records, screening decisions, AI training data and assessment results. Second, the technical controls that ensure data will be deleted or anonymised at the end of the retention period, such as scheduled purge jobs, database partitioning or vendor-managed retention rules. Third, the evidence you can produce to show that data deletion events actually occurred, such as purge logs, system reports or third-party attestations.
Purge logistics are often underestimated because they are operationally messy. Deleting candidate data from an ATS is relatively straightforward, but many organisations forget about downstream systems where stored data has been replicated for analytics, machine learning or reporting. If you delete data in the ATS but leave full personal data in a BI warehouse for ten years, your retention policy is fiction and your privacy compliance posture is weak.
The challenge is to clean candidate databases without destroying the analytics baselines your dashboards depend on. One pragmatic approach is to separate identifiable candidate records from aggregated metrics as early as possible, so that you can delete personal data while retaining non-identifiable trend data for long-term analytics. That way, your quality-of-hire dashboards, pass-through-rate reports and adverse impact analyses can rely on anonymised aggregates that fall outside strict personal data retention rules.
When you negotiate contracts with ATS, CRM and assessment vendors, insist on configurable retention rules and clear recordkeeping requirements in the data protection addendum. Ask whether the vendor supports field-level anonymisation, whether retention periods can differ by jurisdiction, and how they handle backups where candidate data may be retained longer than in production systems. In the United States and the EU alike, regulators are increasingly asking not just whether you have a retention policy, but whether your vendors can prove that data will be retained only as long as necessary.
To make this operational, build a short sign-off checklist that procurement and the DPO can use for every hiring technology. Confirm that data categories and retention periods are documented, that automated purges and backup handling are configured, that vendor audit logs for deletion events are available, that candidate rights requests can be executed end-to-end, and that AI training datasets and analytics warehouses follow the same retention and anonymisation rules as the core ATS.
Ethically, the shift from hoarding to governance sends a powerful signal to candidates. It shows that you treat their personal data as a temporary trust, not a permanent asset, and that you are willing to delete data when it no longer serves a legitimate hiring purpose. In the end, the metric that matters is not the size of your candidate database, but whether your retention policy, your rules and your purge processes can stand up to a regulator’s questions in the twelfth month of adoption.
Key figures on candidate data retention in hiring tech
- Under GDPR, regulators in multiple EU member states have issued fines exceeding several million euros for organisations that retained candidate personal data beyond stated retention periods, as documented in enforcement databases maintained by national data protection authorities.
- Industry surveys of large enterprises using AI in HR indicate that only around one quarter have started formal EU AI Act compliance preparation, which means most TA teams lack documented data governance and retention rules for AI training data used in hiring systems.
- California’s CPRA requires organisations to retain certain automated decision-making records, including logic and outcome data, for long enough to support civil rights enforcement and privacy investigations, creating a multi-year baseline that many United States employers must now incorporate into their hiring data retention policy.
- New York City’s AEDT law obliges employers using automated employment decision tools to keep bias audit documentation and candidate notification records for multiple years, effectively turning short-lived hiring campaigns into long-term recordkeeping obligations.
- Vendors and employers deploying emotion recognition or similar high-risk AI in workplace contexts face outright bans under the EU AI Act, which forces them to delete data and models built on such techniques rather than simply shortening retention periods.