# Data retention policy in hiring

A data retention policy in hiring is a documented rule for how long candidate data, such as resumes, interview transcripts, and scores, is kept before it's deleted, along with the process for deleting it.

It exists to make sure candidate data doesn't sit indefinitely once it's no longer needed for the purpose it was collected for.

**Data retention policy in hiring** — A data retention policy in hiring documents how long an employer keeps candidate data and defines the process for deleting it once that period ends. Candidate data in a modern hiring process can include resumes, application answers, interview recordings and transcripts, AI-generated scores, and internal notes, and a proper policy addresses each category rather than treating all candidate data as one undifferentiated pile. A common structure sets one retention window for candidates who are hired, another for candidates who applied but weren't selected, and rules for how a candidate can request earlier deletion. Without a defined policy, data tends to accumulate indefinitely by default, since deletion requires an active decision while retention doesn't, which is exactly the kind of unbounded retention that data-privacy laws like GDPR are built to prevent.

A retention policy matters for both legal exposure and practical risk. Keeping rejected-candidate data indefinitely, for instance, creates a growing store of sensitive personal information with no ongoing purpose, which is both a compliance liability under laws requiring retention limits and a larger target if that data is ever exposed. A documented policy, applied consistently and paired with an actual deletion process rather than just a written rule, is what turns retention from a theoretical commitment into something that happens.

Intervieux documents a retention policy for candidate and hiring data as part of its ATS data governance, paired with a full-delete path so retention limits translate into an actual deletion process rather than a policy that exists only on paper.

## Frequently asked questions

### Should rejected-candidate data be kept as long as data for a hired employee?

Usually not. Most retention policies set a shorter window for candidates who weren't selected, since the ongoing business reason for keeping their data is weaker than it is for someone who was hired.

### What happens if a company has no data retention policy?

Data tends to accumulate indefinitely by default, since deletion requires an active process while retention doesn't. That creates both compliance risk under laws requiring limited retention and unnecessary exposure if the data is ever breached.

### Can a candidate request their data be deleted early?

Under many privacy frameworks, including GDPR, candidates can request deletion of their personal data. A working retention policy needs an actual process to fulfill that kind of request, not just a written retention schedule.

## Related pages

- [GDPR in recruiting](/glossary/gdpr-in-recruiting)
- [Candidate consent management](/glossary/consent-management)
- [Browse open roles](/jobs)

## See a documented policy with a real delete path

Intervieux pairs a documented data retention policy with a full-delete path, so candidate data doesn't sit indefinitely past its purpose.

Start practicing free: https://www.intervieux.ai/register · Hire with Intervieux: https://www.intervieux.ai/employers/signup