Data Retention Policy

There is no single correct answer, and any source offering one without asking where you operate is guessing. Periods depend on the country, the record type, the sector, contractual commitments and sometimes the reason data was collected. Set them with qualified legal counsel, write the reasoning down alongside each period, and revisit when you enter a new market or take on a client with its own requirements.

Not quite. Deletion removes the record; anonymization strips identifying elements so what remains cannot reasonably be linked back to a person, while aggregate counts survive for reporting. The bar for genuine anonymization is higher than blanking a name field, because combinations of remaining attributes can still identify someone in a small pool. Whether it satisfies a given obligation is a legal question worth confirming.

Yes, and these are frequently the most sensitive records in the system. Notes contain opinions about identifiable people, which makes them both a privacy matter and a potential exhibit in a dispute. Give them their own category with a defined period rather than treating them as an appendix to the application, and keep access restricted while they are held.

It stays your responsibility. Data flows into spreadsheets, email, scheduling tools, assessment vendors and downstream HR systems, and a retention rule enforced only in the applicant tracking system leaves those copies untouched. Map where data goes before writing the policy, cover each destination explicitly, and prefer integrations that respect a deletion signal over exports nobody tracks.