The rule: 2 years after last contact
France's CNIL recommends not keeping a rejected candidate's data beyond 2 years after the last exchange, absent a legal basis or specific consent. Past that, without justification, you are no longer compliant.
The clock starts from the last real contact (interview, reply, message), not the application date.
Consent: the door to keeping a profile longer
To reach back out to a strong candidate for a future role, you need their explicit consent to keep them in a "talent pool". That consent must be freely given, specific and revocable at any time.
Without it, keeping a CV "because they were good" is not a sufficient legal basis.
The candidate rights you must be able to honour
Right of access: what data you hold. Right to erasure: have it deleted. Right to portability: get the data back in a reusable format.
In practice you must answer these quickly — ideally self-service on the candidate side.
Why doing it by hand is unsustainable
Manually tracking each candidate's last-contact date and then deleting at the right time becomes unrealistic past a few dozen applications. It is exactly the kind of task a tool should automate for you.
How aiKip handles retention
aiKip automatically anonymises candidate data after 24 months. Talent-pool consent is explicit, logged and revocable from the candidate space, and candidates can export or erase their data themselves.
Compliance becomes a default setting, not a monthly chore.
Frequently asked questions
How long can you keep a rejected candidate's CV?
The CNIL recommends a maximum of 2 years after last contact, unless the candidate specifically consents to longer retention (talent pool).
Can I keep a CV "just in case"?
Not without a legal basis. To keep a profile beyond the period you need the candidate's explicit, revocable consent.
Can a candidate request deletion of their data?
Yes — the right to erasure (GDPR art. 17). You must be able to honour it; aiKip lets the candidate do it self-service.