To get the deadlines for a specific case, enter your dates in our free retention calculator, no sign-up needed.
The GDPR sets no numeric period for recruitment. Its Article 5(1)(e) lays down a principle: data is kept in a form that identifies the person only for as long as the purpose requires. The figures in circulation come from the CNIL (French data protection authority), in its 2023 recruitment guide and in its framework of retention periods for human resources management, published on 2 April 2026 and updated on 20 May 2026.
- Rejected candidate, process file: kept in the active database for the duration of the recruitment. The guide gives the example of keeping it for 3 months after the process ends, so the reasons for the rejection can be explained to the candidate.
- Rejected candidate added to the talent pool: up to 2 years from the last contact, only for profiles the recruiter is interested in, and provided the candidate consented or did not object after being informed.
- Hired candidate: the file stays in the active database until the hiring decision, then the relevant data is carried over into the employee file and follows the personnel management retention periods. The 2026 framework states that no intermediate archiving of the application file is then needed.
- Unsolicited application with no open position: the guide considers it possible to treat the candidate, by sending their application, as agreeing to its retention in a CV database. The 2-years-after-last-contact benchmark also applies. Mentioning this retention and its duration in the acknowledgement of receipt removes any ambiguity.
- Evidentiary archiving: 5 years from the date the position was filled, for only the documents needed in case of a discrimination claim, in a separate database with restricted access.
These periods are benchmarks. The CNIL states that you can depart from them provided you document and justify your choice.
Sheet no. 12 of the CNIL guide covers video in recruitment. As with an in-person interview, it finds no need to keep video and audio streams, unless the recruiter has a specific justification. The accepted example is an agency that records a pre-screening interview to present it to the hiring organisation, which did not attend the meeting. Even in that case, the CNIL writes that this data need not be kept beyond the date of the hiring decision, unless there is a particular justification.
The same sheet asks recruiters to check the settings of their video conferencing tools, since some record sessions by default. Elsewhere in the guide, the CNIL points out that filming a job interview without telling the candidate is not fair and transparent collection.
For written notes and interview reports, no text sets a specific period. They are part of the application file and follow its course (the duration of the process, then the talent pool if the candidate is in it, or evidentiary archiving for only the items useful as proof). Keeping the raw recording longer than the report drawn from it will be hard to justify. By comparison, for calls recorded in the workplace, the 2026 framework provides for deleting recordings within a short time and keeping only the analysis documents.
Each period has its own starting point, and getting it wrong is enough to undermine a whole retention policy.
- Talent pool: the 2-year period runs from the last contact with the person, not from the date the CV was received. An actual exchange (an interview, the candidate's reply to an offer, a call) can reasonably be treated as a new contact. To be safe, a mass mailing that got no reply should not be.
- Evidentiary archiving: the 2026 framework uses the date the position was filled, the 2023 guide the date of the hiring decision. Neither uses the application date.
- Limitation period for discrimination claims: Article L1134-5 of the French Labour Code starts the 5 years from the moment the discrimination comes to light, which can be after the recruitment. A 5-year archiving period remains a reasonable benchmark, though it does not cover every case.
The software you use must therefore reliably date each last contact, otherwise the expiry date of a talent pool profile cannot be calculated.
When the period runs out, there are three possible outcomes.
- Delete, the default outcome. The CNIL guide asks for technical or organisational measures to regularly delete data that has reached its expiry date, which calls for a scheduled purge rather than a one-off clean-up.
- Anonymise. Once the intermediate storage period has passed, the information must be deleted or anonymised. Anonymisation must be irreversible. Replacing the name with an identifier while keeping the CV, history and notes is pseudonymisation, and the data then remains personal data. Anonymisation is mainly useful for keeping statistics, such as the number of applications per position or time to hire.
- Ask for consent again, for the talent pool. According to the guide, when the 2 years expire, the recruiter can ask the candidate to consent again to the retention of their data, for a reasonable period of at most 2 years. A possible wording: "Your profile has been in our talent pool for almost two years. Would you like us to keep it so we can offer you future positions? If we do not hear from you by 30 November, it will be deleted." Without explicit agreement, the profile is deleted.
- A single period for the whole file. The CV, the recording, proof of degrees and evidentiary documents do not share the same period. The guide cites the example of proof of degrees, which no longer needs to be kept once the process is over.
- Evidentiary archives the whole team can browse. The CNIL requires physical or logical separation from the active database, with access limited to authorised people. A 5-year talent pool open to every recruiter in the name of evidence does not meet this rule.
- Retention periods missing from the candidate information notice. Article 13 of the GDPR requires stating the retention period, or the criteria used to determine it, at the time of collection. The guide also asks for these periods to be entered in the record of processing activities.
- A five-year talent pool. The CNIL guide considers keeping the CVs of rejected candidates for five years in order to contact them again to be "in principle excessive".
- Forgetting the copies. Mailboxes, spreadsheet exports, video conferencing tools that record by default and tools connected to your recruitment software each keep their own copy, which a deletion at the source does not always erase.
The 2026 framework explicitly covers intermediaries. The 2-year benchmark for the CV database and the 5-year evidentiary archiving apply to recruitment agencies as well as to employers.
The guide makes an allowance for temporary staffing agencies. The candidate's data can stay in the active database after their placement with the client company, so that new offers can be proposed at the end of their assignment. The candidate can ask for their file to be removed at any time.
When a candidate requests erasure, Article 17 of the GDPR requires action without undue delay, in particular when they withdraw the consent on which retention was based. The same article provides an exception for data needed for the establishment, exercise or defence of legal claims, which allows only the documents covered by evidentiary archiving to be kept separately.
This page gives general guidance. For a specific case, contact your data protection officer or a lawyer.
No. It is a period recommended by the CNIL in its recruitment guide and its HR framework. The CNIL states that applying its recommended periods creates a presumption of compliance. You can choose a different period if you document and justify it, for example a short period for applications to a seasonal job that you plan to contact again the following year.
For a candidate rejected at the end of a process, the CNIL recommends obtaining their consent. It also accepts legitimate interest, provided the candidate is expressly informed and can object easily, without having to give a reason. For an unsolicited application, the guide considers it possible to treat sending the CV as agreement to its retention in a CV database.
Yes. The 2-year period runs from the last contact, and a new application or a new exchange with the candidate can be treated as a new contact. Keep a dated record of that exchange so you can justify it.
The relevant data is carried over into their employee file, which is as a rule kept for the duration of the employment relationship, then archived if an obligation or a litigation risk justifies it, within the applicable limitation period. Documents used only for recruitment, such as proof of degrees, no longer need to be kept in the active database.
The texts cited on this page do not settle this point. Many providers do not erase a piece of data inside backups and let it disappear when the backups expire. Ask each of your processors how long that cycle lasts and record it in your documentation.