Set a written retention period tied to a purpose rather than keeping records indefinitely. Most organisations retain unsuccessful applicant data for a defined window covering legal claim periods and future consideration, then delete or anonymise automatically. Confirm the exact period with legal counsel for each jurisdiction you hire in, and configure the system to enforce it.
Because keeping candidate data requires a justification, and the justification expires. Privacy regimes in Europe, the United Kingdom, India, Brazil and several US states share a common expectation: personal data is kept only as long as necessary for the purpose it was collected for, and that purpose has to be stated. An applicant tracking system makes indefinite retention effortless, which is exactly why it needs deliberate limits. There is also a practical argument. A database full of five-year-old applications produces poor search results, misleading pipeline reporting and awkward outreach to people who no longer remember applying. Retention discipline improves the usefulness of the system as well as its compliance posture, which is a rare case where the legal and operational incentives point the same way.
Work from purposes rather than picking a round number. There are usually three. First, defending against a claim relating to the recruitment decision, which sets a floor based on the limitation period in each jurisdiction. Second, considering the person for future roles, which requires their awareness and, in some jurisdictions, consent, and should have its own shorter clock that resets on genuine engagement rather than on any system activity. Third, aggregate reporting, which can normally be satisfied with anonymised data instead of identifiable records. Write a period for each category, document the reasoning, and have counsel confirm it per jurisdiction, since the answer differs by country and sometimes by state. Then apply the shortest period that satisfies the purposes rather than the longest that is defensible.
Automatically, on a schedule, with a record of what was done. Check during evaluation whether the system supports retention rules by record type and by region, whether deletion is genuine removal or a hidden flag, whether anonymisation is offered as an alternative that preserves reporting, and whether attachments and interview recordings are covered as well as the candidate record. Ask how a manual deletion request from an individual is executed and whether a recruiter can perform it without a support ticket. Also confirm what happens in backups, since a record deleted from the live system may persist for a defined period afterwards. These questions belong on your security list alongside [the other data questions you ask vendors](/ats), because retention is where policy meets product capability.
Tell candidates the retention period at the point of application, in plain language on the application form or privacy notice. Separate the talent pool from the applicant record, so people you want to contact again have knowingly opted into that rather than being retained by default. Run the deletion job on a schedule and keep a log. Review the policy annually, and review it whenever you start hiring in a new country. Give one person ownership, usually in HR operations, so requests do not sit unanswered. None of this is burdensome once configured, and it removes a category of risk that tends to surface at the worst moment, typically during a candidate complaint or a customer security review of your own organisation.
Get a personalized walkthrough of Pitch N Hire on your own roles and workflow. No slides, no obligation.
Prefer to talk? Book a demo · View pricing
Free 1-user plan · No credit card · Talk to a real hiring expert
See your true cost-per-hire and how much Pitch N Hire could save you — our free Recruitment ROI Calculator gives you the numbers in under a minute. No signup required.
Open the free ROI calculatorPrefer a tailored walkthrough on your real roles? Drop your work email:
★ Free 1-user plan · No spam · Talk to a real hiring expert
