Separate purposes
Active applications, future-opportunity pools and justified restricted archives serve different purposes. Do not merge them into an unrestricted old-CVs folder.
GDPR Articles 5 and 6 require defined purposes, lawful grounds and limited retention. Consent is not automatically the only basis for every recruitment operation. Document data, access and end-of-period treatment for each purpose.
Understand the two-year reference
For unsuccessful candidates retained for future opportunities, the CNIL recommends a reasonable period generally not exceeding two years after last contact. This is neither a requirement to keep every CV that long nor a universal rule for all purposes.
Explain the purpose attached to your chosen period rather than storing an unexplained date.
Make rules operational
Define review triggers such as closure, withdrawal and expiry, with an owner for exceptions. Do not assume an unanswered automated message proves continuing interest.
Migration is not a new exchange with the applicant. Preserve relevant origins and dates.
| Purpose | Document | End of period |
|---|---|---|
| Active hiring | Role, lawful basis, information and access. | Assess remaining purposes separately. |
| Talent pool | Purpose, applicable authorization and withdrawal. | Delete or renew where permitted. |
| Justified archive | Reason, necessary data and restricted access. | Delete when the documented need expires. |
| Working copies | Purpose, users and period. | Remove unnecessary duplicates. |
Inform people appropriately
GDPR Articles 13 and 14 address information for direct and indirect collection. Examine retention periods or criteria, purposes, recipients and rights.
Make notices accessible in the application process. Keep relevant versions where required and reassess whether a new use is covered.
Keep aiKip’s optional pool separate
aiKip uses separate consent for the optional talent pool. Applying for one vacancy is not treated as blanket agreement to every future opportunity.
Check permitted use and current context before recontact. Agency presentation sharing also has its own workflow; pool membership does not open every profile to clients.
Handle rights and exceptions
Assign responsibility for access, correction and erasure requests. GDPR rights have conditions and specified exceptions; avoid promising either immediate total deletion in every case or automatic refusal.
Identify relevant processing and copies, verify identity proportionately and document the response. A justified restricted archive must not silently become an active sourcing pool.
Check copies and deletion
Exports, attachments and personal folders can undermine a retention policy. Examine backups and logs too.
Deletion, anonymization and pseudonymization are different. Replacing a name with an identifier may still leave a person identifiable. aiKip documents retention and anonymization mechanisms, including a 24-month horizon; product settings do not replace your policy or control external copies.
Apply and review the policy
Inventory actual recruitment records and prioritize missing context, excessive access and unwritten rules. Give each correction an owner.
Review exceptions and new uses over time, including migrations and new sources.
-
Inventory
Identify purposes and origins.
-
Define
Document periods and access.
-
Apply
Handle notices, requests and copies.
-
Review
Check exceptions and actual use.
Frequently asked questions
Should every CV have the same retention period?
No. Assess active hiring, optional pools and justified archives separately.
Is consent always required for recruitment?
GDPR provides different lawful grounds for different processing. aiKip specifically uses separate consent for its optional talent pool.
Does migration restart retention?
No. A technical transfer does not itself renew authorization or the processing framework.