---
title: "Candidate Data Retention: How Long Should an ATS Keep Applicant Records?"
description: "Learn how to set an ATS candidate data retention policy covering legal holds, talent pools, deletion, anonymization, privacy notices, and audit records."
canonical: "https://recooty.com/resources/blogs/candidate-data-retention-ats"
author: "Recooty Team"
date: "2026-09-15T00:00:00+05:30"
updated: "2026-09-15T00:00:00+05:30"
image: "https://recooty.com/media/2026/09/29-candidate-data-retention-ats-e186c64987c9.png"
---

# Candidate Data Retention: How Long Should an ATS Keep Applicant Records?

An [ATS](https://recooty.com/applicant-tracking-system) should keep candidate data only for a documented business or legal purpose, then delete or anonymize it when that purpose ends. There is no single retention period that works everywhere. Employers must account for local employment-record rules, privacy laws, limitation periods, active disputes, talent-pool consent, and the type of information stored.

A practical policy separates unsuccessful applicants, hires, prospects, screening material, interview notes, and legal holds.

Use an [interview question generator](https://recooty.com/tools/interview-question-generator/) to prepare role-specific questions before the conversation. It assigns an owner, deletion method, and review date to each category. This is operational guidance, not legal advice; ask counsel to approve each jurisdiction's periods.

## Key takeaways

- Do not keep every resume forever “just in case.” Each category needs a stated purpose and retention period.  
Teams comparing [recruiting software](https://recooty.com/) can use this overview to assess which workflow fits their hiring process.
- The EU GDPR applies a storage-limitation principle rather than setting one recruitment period for every employer.
- U.S. EEOC rules generally require covered employers to retain personnel or employment records for one year, with longer preservation when a charge is filed.
- Talent-pool use is a separate purpose and may require a separate notice, lawful basis, or consent.
- Sensitive vetting records should usually be deleted sooner than ordinary application records when the underlying document is no longer needed.
- Configure automated reminders or deletion in the ATS, but keep a human-approved legal-hold process.

## What is candidate data retention?

Candidate data retention is the period during which an employer stores personal information collected through recruiting. It covers resumes, application answers, recruiter notes, interview scorecards, emails, assessments, source data, salary expectations, offers, identity details, reference information, and screening results.

Retention applies across copies. Deleting an ATS profile is insufficient if the resume remains in an inbox, integration, spreadsheet, backup, assessment tool, or agency portal.

## How long should employers keep unsuccessful candidate records?

Keep unsuccessful candidate records for the shortest period that supports a defined need and meets applicable law. That period may need to cover an employment-claim window or recordkeeping rule. It should not silently become permanent storage.

Under [GDPR Article 5](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32016R0679), identifiable personal data should be kept no longer than necessary for its processing purpose. The regulation does not prescribe one applicant-retention number. Employers must set and justify their own schedule while also observing member-state employment rules.

The UK Information Commissioner's recruitment guidance follows the same principle: set documented periods and consider claim windows. A possible claim does not support indefinite retention. It also advises deleting information no longer relevant when a candidate becomes an employee.

In the United States, the [EEOC says](https://www.eeoc.gov/employers/recordkeeping-requirements) covered employers generally must keep employment records for one year. Relevant records must remain until final disposition after an EEOC charge. Other rules may impose different periods.

Canada's PIPEDA framework also limits retention to the identified purpose. Provincial rules may apply instead of or alongside the federal framework.

## What should a candidate retention schedule include?

A usable schedule distinguishes records by purpose and risk. The periods below are policy categories to assess, not recommended legal deadlines.

| Record category                | Retention trigger                         | Questions to resolve                                          |
| ------------------------------ | ----------------------------------------- | ------------------------------------------------------------- |
| Unsuccessful application       | Rejection or vacancy closure              | Claim period, recordkeeping rule, audit need                  |
| Hired candidate file           | Employment start                          | Which recruiting data belongs in the employee record?         |
| Talent-pool profile            | Consent or last meaningful contact        | Renewal date, withdrawal, continuing relevance                |
| Interview notes and scorecards | Hiring decision                           | Defensible evidence, relevance, inappropriate free text       |
| Assessment result              | Test completion or decision               | Vendor copy, validation evidence, accommodation record        |
| Background or vetting material | Screening decision                        | Whether the full report is needed after recording the outcome |
| Identity or right-to-work data | Collection or employment event            | Specific statutory rule and access restriction                |
| Legal hold                     | Notice of claim, charge, or investigation | Scope, owner, release approval, final disposition             |

For each row, record the authority, period, start event, owner, deletion action, exceptions, and approval date. Review the schedule after entering a country, changing screening tools, or adding AI.  
For a current comparison, see this guide to [AI-powered applicant tracking systems](https://recooty.com/resources/blogs/best-ai-powered-applicant-tracking-systems).

## Should hired-candidate data move into the employee record?

Only recruiting information needed for employment should move into the employee record. Contact details, signed offers, required eligibility documents, and role information may be needed. Rejected interview speculation, duplicate resumes, sourcing notes, or unrelated assessment detail often is not.

Map the ATS-to-HRIS handoff by field, with a stated purpose, limited recipients, and an audit record. Apply the relevant recruiting-record rule to material left behind.

## Can employers keep candidates in a talent pool?

Yes, but future-opportunity contact is a purpose separate from deciding the original application. Tell candidates what will be stored, why they may be contacted, how long the profile will remain, who can access it, and how to withdraw or request deletion.

Set an expiry or renewal date and record the last meaningful interaction. Remove stale, inaccurate, or irrelevant profiles before the maximum period when appropriate.

## What data should be deleted sooner?

Sensitive information deserves a shorter path to deletion when the source document is no longer needed. The [UK ICO's vetting guidance](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/employment/recruitment-and-selection/pre-employment-vetting-of-candidates/) says intrusive vetting material should be securely destroyed as soon as reasonably practicable after recruitment, although an employer may retain the outcome and decision.

Review these categories closely:

- Criminal, credit, medical, disability, biometric, and identity information
- Copies of background-check reports and reference documents
- Diversity monitoring data that should be separated from selection
- Interview recordings, transcripts, and AI-generated summaries
- Free-text notes containing assumptions or unrelated personal details

Minimization starts before retention. If a field is not needed for the stage or role, do not collect it.

## How should an ATS automate data retention?

The ATS should calculate review or deletion dates from clear events such as rejection, job closure, consent, last contact, or employment start. It should support different rules by country, candidate category, and data type rather than applying one global timer.

A controlled workflow looks like this:

1. Assign the candidate to a retention category and jurisdiction.
2. Calculate the review date and show it to authorized users.
3. Pause deletion when a documented legal hold applies.
4. Notify the privacy or recruiting owner before expiry when review is required.
5. Delete or irreversibly anonymize the record across connected systems.
6. Keep a limited audit entry proving the policy action without recreating the deleted profile.

Integrations matter. Ask assessment, scheduling, background-check, e-signature, and sourcing vendors whether an ATS deletion propagates to their systems. If it does not, assign a separate deletion job and evidence log.

## What should the candidate privacy notice say?

The notice should explain identity, collection, purposes, legal basis where required, recipients, transfers, retention, automated processing, rights, and a contact route. Write it for candidates.

Avoid promising one fixed period if valid exceptions may apply. A clearer approach explains the standard period or criteria, then identifies legal holds and statutory obligations as limited exceptions.

## How can you audit retention inside an ATS?

Run a quarterly report by status, country, last activity, category, and scheduled action. Sample deletions across connected tools. Check holds and whether users can restore deleted data from exports.

[Recooty's GDPR recruiting guide](https://recooty.com/resources/blogs/gdpr-and-recruitment-a-complete-guide-for-recruiters) provides more context on candidate privacy. When evaluating any ATS, ask it to demonstrate retention settings, deletion requests, permissions, audit history, exports, and integration behavior using a test profile.

## Frequently asked questions

### Can we keep resumes forever for future jobs?

Usually, indefinite resume storage is hard to justify. Create a defined talent-pool purpose, notify the candidate, use the required lawful basis or consent, set a review period, keep information accurate, and offer a clear withdrawal or deletion route.

### Is anonymization the same as deletion?

Only irreversible anonymization falls outside many personal-data rules. Replacing a name with an ID while retaining a lookup key is pseudonymization, not full anonymization. Keep aggregated recruiting metrics only when individuals cannot reasonably be identified again.

### What happens to retention when a claim is filed?

Place relevant records under a documented legal hold and suspend routine deletion for that scope. In the United States, EEOC guidance requires relevant records to remain until final disposition of the charge or related lawsuit. Counsel should define when the hold can be released.

### Who owns candidate data retention?

The employer is generally responsible for its candidate-data purposes and schedule, even when an ATS processes the data. Recruiting, privacy, legal, security, and IT should divide ownership clearly, with one person accountable for approvals and periodic audits.

## Structured data

```json
{
  "@context": "https://schema.org",
  "@graph": [
    {
      "@type": "Article",
      "headline": "Candidate Data Retention: How Long Should an ATS Keep Applicant Records?",
      "description": "Do not keep every resume forever “just in case.” Each category needs a stated purpose and retention period. Teams comparing recruiting software can use this overview to assess which workflow fits their hiring process. The EU GDPR applies a storage-limitation principle rather than setting one recruitment period for every employer. U.S. EEOC rules generally require covered employers to retain personnel or employment records for one year, with longer preservation when a charge is filed. Talent-pool use is a separate purpose and may require a separate notice, lawful basis, or consent. Sensitive vetting records should usually be deleted sooner than ordinary application records when the underlying document is no longer needed. Configure automated reminders or deletion in the ATS, but keep a human-approved legal-hold process.",
      "inLanguage": "en",
      "author": {
        "@type": "Organization",
        "@id": "https://recooty.com/#organization",
        "name": "Recooty"
      },
      "publisher": {
        "@type": "Organization",
        "@id": "https://recooty.com/#organization",
        "name": "Recooty",
        "url": "https://recooty.com/",
        "logo": {
          "@type": "ImageObject",
          "url": "https://recooty.com/wp-content/uploads/2020/10/recooty-logo.png"
        }
      },
      "datePublished": "2026-09-15",
      "dateModified": "2026-09-15",
      "@id": "https://recooty.com/resources/blog/candidate-data-retention-ats#article",
      "url": "https://recooty.com/resources/blog/candidate-data-retention-ats",
      "mainEntityOfPage": {
        "@type": "WebPage",
        "@id": "https://recooty.com/resources/blog/candidate-data-retention-ats#webpage"
      }
    },
    {
      "@type": "FAQPage",
      "mainEntity": [
        {
          "@type": "Question",
          "name": "Can we keep resumes forever for future jobs?",
          "acceptedAnswer": {
            "@type": "Answer",
            "text": "Usually, indefinite resume storage is hard to justify. Create a defined talent-pool purpose, notify the candidate, use the required lawful basis or consent, set a review period, keep information accurate, and offer a clear withdrawal or deletion route."
          }
        },
        {
          "@type": "Question",
          "name": "Is anonymization the same as deletion?",
          "acceptedAnswer": {
            "@type": "Answer",
            "text": "Only irreversible anonymization falls outside many personal-data rules. Replacing a name with an ID while retaining a lookup key is pseudonymization, not full anonymization. Keep aggregated recruiting metrics only when individuals cannot reasonably be identified again."
          }
        },
        {
          "@type": "Question",
          "name": "What happens to retention when a claim is filed?",
          "acceptedAnswer": {
            "@type": "Answer",
            "text": "Place relevant records under a documented legal hold and suspend routine deletion for that scope. In the United States, EEOC guidance requires relevant records to remain until final disposition of the charge or related lawsuit. Counsel should define when the hold can be released."
          }
        },
        {
          "@type": "Question",
          "name": "Who owns candidate data retention?",
          "acceptedAnswer": {
            "@type": "Answer",
            "text": "The employer is generally responsible for its candidate-data purposes and schedule, even when an ATS processes the data. Recruiting, privacy, legal, security, and IT should divide ownership clearly, with one person accountable for approvals and periodic audits."
          }
        }
      ],
      "@id": "https://recooty.com/resources/blog/candidate-data-retention-ats#faq"
    }
  ]
}
```