How Long Can You Keep a Candidate’s CV? The Retention Rule Hiding in Your Inbox

What the Law Actually Says About Keeping CVs

Start with the principle. Under the GDPR, personal data can be kept only for as long as it is needed for the purpose you collected it, a rule known as storage limitation. There is no single number written into the regulation. You are expected to set a period, be able to justify it, and state it plainly to the people whose data you hold. Keeping something forever because deleting it feels risky is not a justification the law recognises.

France puts a concrete number on it. The CNIL, the national data protection authority, has published a reference framework for recruitment that sets the expectation clearly: the data of a candidate you did not hire can be kept for a maximum of two years from your last contact with them, according to CNIL guidance for small companies. Two years covers the legitimate reasons to hold onto it: a similar role opening up, or being able to answer a complaint if one is filed. After that, the reason runs out, and so does your right to keep the file.

The Keep Them Just in Case Trap

Almost everyone builds a mental talent pool. The strong runner-up, the profile that was right but a year early, the person you would call the moment a role opens: it feels wasteful to delete them. You can keep them, but on two conditions that scattered files make hard to meet. Past the two-year window, holding a CV in a talent pool is only lawful if the candidate has agreed to it, and they have to have been told you are keeping their data in the first place.

That is where the trap closes. Consent and notice are not hard to obtain; they are hard to prove after the fact when the data lives in six places at once. If a candidate asks you to delete everything you hold, you are legally required to do it, and you cannot delete what you cannot find. The problem is rarely that a team decided to break the rule. It is that no single place holds the answer to a question as basic as “what do we still have on this person, and why?”

Regulators have stopped treating this as a paperwork detail. The CNIL has named excessive retention one of its priority areas for enforcement, and it has issued six-figure fines against companies that kept personal records for years with no defined retention period and no notice to the people concerned. Those cases were not about hiring, but the principle lands the same way: data with no expiry date and no owner is a liability, whether it is a customer record or a rejected CV.

Where the Risk Actually Lives

The retention rule is not the hard part. Almost everyone can recite “two years, then delete.” The hard part is that candidate data does not sit in one place where a rule like that can be applied. It scatters as a normal consequence of how a small team runs a search, and every copy is a fresh clock nobody is watching.

This is the same fragmentation that makes it hard to say where each candidate stands in your pipeline, seen from the compliance side instead of the productivity one. If you run hiring on a spreadsheet and an inbox, the data has no single home and no shared expiry date. Teams that do have a tool are not automatically safe either: when an ATS goes half-adopted, the parallel spreadsheets and email chains that grow up around it hold copies the system never sees, and never deletes.

Retention Without More Admin

The instinct is to fix this with discipline: a quarterly reminder to purge old files, a policy document nobody reads. That fails for the same reason the problem started, because it depends on a person remembering to do unrewarding work on top of the actual job. Retention holds when it is a property of the system, not a task on someone’s list. A few things make that real:

• One home for candidate data. A single place a file lives means a single clock, and a single answer when someone asks what you hold on them.
• A defined period, stated up front. Candidates are told how long you keep their data when they apply, so the notice the law asks for is handled once, not chased later.
• Deletion that happens on its own. Files that reach the end of the period are cleared without anyone deciding to run a purge, and anyone kept for the talent pool sits on recorded consent.

This is a large part of why we built Kynto around a single system rather than a stack of disconnected tools that each keep their own copy. Candidate data lives in one place, hosted in Europe, deleted on a fixed schedule, and never used to train models for anyone else. You can read exactly how that works on our data protection page. None of this replaces a conversation with your own DPO or counsel, but it does mean retention is something the tool does quietly, rather than one more thing you have to remember on a Friday afternoon.

Key Takeaways

• In France, the data of a candidate you did not hire can be kept for a maximum of two years from your last contact. The GDPR sets no fixed number but requires a defined, justified, and stated period.
• Keeping a strong runner-up in a talent pool past two years is fine, but only with the candidate’s consent, and only if they were told their data was being kept. Both are easy to obtain and hard to prove when data is scattered.
• The risk is not your judgment, it is fragmentation. Inboxes, drives, spreadsheets, and old exports each hold a copy with its own clock. Retention holds when one system owns the data and deletes it on schedule.

FAQ

How long can I keep a rejected candidate’s CV in France?

The CNIL sets the expectation at a maximum of two years from your last contact with the candidate, which covers recontacting them for a similar role or responding to a complaint. After two years the justification runs out, and the file should be deleted or anonymised unless the candidate has consented to being kept in a talent pool.

Can I build a talent pool of past candidates?

Yes, within the two years on the legitimate interest of future hiring, and beyond two years only if the candidate has agreed to it. In both cases they must have been informed that you are keeping their data. The practical requirement is being able to show that consent and notice exist, which means the data cannot be spread across places you would struggle to audit.

What happens if a candidate asks me to delete their data?

You are required to honour the request, which means finding and removing every copy you hold. That is straightforward when candidate data lives in one system and close to impossible when it is split across inboxes, drives, and old spreadsheets. A single home for the data is what turns a deletion request from a scramble into a click.