How long can you keep a candidate CV? The GDPR guide
Keeping CVs "just in case" is one of the most common GDPR mistakes in recruiting. Here are the clear rules, and how to stop worrying about them.
The rule: 2 years after last contact
France's CNIL recommends not keeping a rejected candidate's data beyond 2 years after the last exchange, absent a legal basis or specific consent. Past that, without justification, you are no longer compliant.
The clock starts from the last real contact (interview, reply, message), not the application date.
Consent: the door to keeping a profile longer
To reach back out to a strong candidate for a future role, you need their explicit consent to keep them in a "talent pool". That consent must be freely given, specific and revocable at any time.
Without it, keeping a CV "because they were good" is not a sufficient legal basis.
The candidate rights you must be able to honour
Right of access: what data you hold. Right to erasure: have it deleted. Right to portability: get the data back in a reusable format.
In practice you must answer these quickly — ideally self-service on the candidate side.
Why doing it by hand is unsustainable
Manually tracking each candidate's last-contact date and then deleting at the right time becomes unrealistic past a few dozen applications. It is exactly the kind of task a tool should automate for you.
How aiKip handles retention
aiKip automatically anonymises candidate data after 24 months. Talent-pool consent is explicit, logged and revocable from the candidate space, and candidates can export or erase their data themselves.
Compliance becomes a default setting, not a monthly chore.
Frequently asked questions
How long can you keep a rejected candidate's CV?
The CNIL recommends a maximum of 2 years after last contact, unless the candidate specifically consents to longer retention (talent pool).
Can I keep a CV "just in case"?
Not without a legal basis. To keep a profile beyond the period you need the candidate's explicit, revocable consent.
Can a candidate request deletion of their data?
Yes — the right to erasure (GDPR art. 17). You must be able to honour it; aiKip lets the candidate do it self-service.
aiKip is the sovereign, compliant ATS that makes all of this simple.
Start the 30-day free trial →