Candidate Data Consent (GDPR)

Submitting an application is usually understood as the candidate asking you to consider them, which is not the same thing as consent to every later use such as long-term pool storage or outreach about unrelated roles. Many employers rely on a different lawful basis for the application itself and seek explicit permission for the extras. Which reading applies where you operate is a question for counsel.

For as long as your documented retention rule allows and no longer, with the period justified by purpose rather than convenience. Because permitted durations differ by jurisdiction and record type, the number belongs in a policy your legal counsel has approved. Practically, refreshing permission before a new campaign both respects the person and keeps the pool useful, since stale profiles rarely convert anyway.

The employer deciding why and how candidate data is processed generally acts as controller, while a vendor processing it on the employer's instructions acts as processor. The distinction drives who answers a candidate's request, who signs which contract terms and where responsibility sits after an incident. Agency and outsourced recruiting arrangements complicate it, so have the roles confirmed in writing rather than assumed.

Publicly visible does not automatically mean freely usable, and the answer varies by jurisdiction. Many frameworks still require a lawful basis, a privacy notice at first contact and a way to object. Some regions apply additional restrictions to unsolicited outreach. Sourcing teams should work to a documented approach reviewed by counsel rather than assuming that visibility equals permission.