How long can the employer process the data of applicants?

Even before the employment is established, several personal data of jobseekers will be in the possession of the future employer. According to the GDPR, the company qualifies as a data controller of this data, so it is important to know how long it is possible to retain the data of selected and promising but non-selected candidates.

Following the recruitment and selection process, the employer will hire some job applicants into their organization, but there are also others who will be rejected. Many businesses record personal data of rejected jobseekers in a so-called candidate database. The purpose of this data processing is that the employer can later notify these applicants if a position becomes vacant. Aspirants must give their consent to this, as this is the only way for the employer to build the database and process their data. Data processing lasts for a pre-determined and reasonable period of time (e.g. one year) provided that the applicant does not withdraw their consent earlier. In the event of expiry of the data processing period or withdrawal of consent, the data shall be deleted from the database. This must be ensured by the employer as date controller.

If the job applicant does not want to be included in such a database, they are only interested in the position they have applied for, then their data can only be processed in connection with the given position. In such cases, processing takes place due to the performance of the employment contract to which the data subject is party and to take steps at the request of the applicant prior to entering a contract. Once the position has been filled, the employer must delete the applicant’s details unless they are hired.

Regarding the recruited applicants – now employees – the data processing happens primarily for the purpose of fulfilling the employment contract and legal obligations to which the employer is subject.

The employer must also take data processing rules into account when designing HR processes. We recommend that if you operate a candidate database, you inform applicants and ask for their consent to the data processing. Develop appropriate procedures for how long to store data and when to delete it.