The CNIL recruitment guide distinguishes three situations, and the answer changes from one to the next.
- The candidate asks to join a talent pool themselves (registering with an agency, uploading a CV to a job board). Since joining is their own initiative, they can be considered to have consented to their data being kept.
- The candidate sends an unsolicited application when no position is open. The CNIL considers it also seems possible to treat the sending of the CV as consent for the company to keep it in order to contact them again.
- The candidate is not selected at the end of a hiring process. This is the most common and most delicate case. The recruiter should obtain their consent before adding them to the talent pool. If it prefers to rely on its legitimate interest, for example for candidates who had an interview, it must inform them and allow them to object easily, without having to give any reason other than their wish not to be contacted again.
The CNIL presents this reliance on consent as a change from its former framework, which recommended legitimate interest, and says it takes into account the time needed to adapt for talent pools already built on that basis. Temporary work agencies have their own regime, since they can base their talent pool on steps taken at the candidate's request prior to entering into a contract.
Valid consent requires a positive action, for example a dedicated box that is not pre-ticked. It cannot be inferred from tacit agreement, from a lack of objection, or from acceptance of terms and conditions. If consent is withdrawn, the processing stops and the data collected on that basis is deleted, unless it needs to be kept for litigation.
When the data comes from the candidate, the information is given at the time of collection (Article 13 of the GDPR). It covers in particular the purpose, the legal basis, the retention period, the recipients and the person's rights. If you rely on legitimate interest, the right to object must be presented clearly and separately from any other information, at the latest at the time of the first communication with the person (Article 21(4)).
When the profile comes from elsewhere (a referral, a professional network, a database passed on by a partner), Article 14 requires you to inform the person within a reasonable period of no more than one month, and at the latest in the first message if their data is used to contact them. The information must then also state the source of the data.
The French Labour Code adds a rule specific to recruitment. No information personally concerning a candidate may be collected by a method that has not been disclosed to them beforehand (Article L1221-9).
Here is an example of wording for a rejection email based on consent, to be completed with the other mandatory information.
"We were interested in your profile. We would like to keep your CV and our interview notes for two years from the date of this message so that we can offer you other positions. Reply yes to this email if you agree. You can withdraw your agreement at any time by writing to [address]."
A version based on legitimate interest: "Unless you object, we will keep your file for two years in order to offer you other positions. Simply reply to this email and we will delete it."
The CNIL framework on retention periods in human resources management, published on 2 April 2026 and updated on 20 May 2026, provides for a talent pool type CV database to be kept in the active database for up to 2 years from the last contact with the unsuccessful candidate. This period is a CNIL recommendation, not a legal obligation. The recruitment guide states that it must remain reasonable given the type of position, that keeping data for five years to feed a talent pool is in principle excessive, and that these periods are a benchmark the recruiter may depart from if it documents and justifies its choice. When the period expires, the operation can be renewed with the candidate.
The 5-year period that appears in the same table serves a different purpose. It is based on Article L1134-5 of the French Labour Code, which sets a five-year limitation period for claims for compensation for discrimination, and the framework counts it from the date the position was filled, for employers and intermediaries alike. Only the information strictly necessary for that evidence then moves to intermediate archiving, separated from the active database, either physically in a dedicated database or through restricted access rights. A file archived on this basis is no longer used to contact the candidate again.
The notion of "last contact" is not defined in these documents. Set your own rule (for example, the last exchange initiated by either party), write it into your record of processing activities and apply it the same way across the whole talent pool.
Offering a new position to a candidate added to the talent pool matches the stated purpose, since the CNIL defines a CV database as one in which the recruiter records applications with a view to contacting people to present job offers. Contacting them again is therefore part of the processing itself.
The guide does, however, list uses that fall outside this scope. Reusing a candidate file for a commercial prospecting campaign is not compatible with the original purpose. Building a talent pool from an advert for a fake job offer is not a legitimate purpose. For a reuse that is compatible but different (statistics on the placement process, for example), the candidate must be informed before it takes place and be able to object where applicable.
Article L1221-6 of the French Labour Code, cited by the CNIL, provides that the information requested from a candidate may only be used to assess their ability to hold the position offered or their professional aptitudes. The guide adds that the recruiter must not extract or use sensitive data a candidate may have volunteered, unless it has a direct and necessary link with the job. An interview note recording a health condition, family situation or plans to have children therefore has no place in the talent pool.
According to the CNIL, an agency that builds a generic talent pool for its usual placement business is the controller of that processing. It is responsible for informing candidates, setting the retention period and responding to access or erasure requests.
When the agency passes a selection of CVs to a client, that client becomes the controller of the processing it carries out with this data. Candidates must be informed of the recipients or categories of recipients of their data, and the CNIL counts agencies' clients among those recipients. If the client wants to keep these profiles in its own talent pool, it needs its own legal basis and must provide its own information.
A company hiring directly is the controller for its own recruitment. In the case, considered highly exceptional by the CNIL, where an agency builds a database specifically for a client using parameters set by that client, the agency may be a processor, or even a joint controller if the tool and method are designed together. The allocation of roles is then set out in a contract.
- Counting the two years from the application rather than from the last contact, or never counting them at all because the tool has no reliable date.
- Keeping the working talent pool and the evidence archive in the same database, accessible to the same people.
- Inferring agreement from silence after a rejection sent without a clear question.
- Forgetting to record objections in the tools, so that a candidate who asked not to be contacted again turns up in a search six months later.
- Leaving notes unrelated to the job (private life, health) from transcribed interviews in the talent pool.
- Screening out candidates through fully automated sorting. Article 22 of the GDPR gives the person the right, subject to the exceptions set out in that article, not to be subject to a decision based solely on automated processing that significantly affects them.
A compliant talent pool is also a more useful one. Up-to-date last contact dates, respected objections and notes focused on skills make searches more reliable.
This page sets out the CNIL's general recommendations and the applicable texts. For a specific case, have your choices validated by your DPO or a lawyer.
If you chose consent as your legal basis, the CNIL points out that it cannot result from tacit agreement or from a lack of objection. Without a positive answer, the CV does not go into the talent pool. Only the information strictly necessary as evidence in the event of a discrimination claim may be kept in intermediate archiving, and it must not be used to contact the person again.
The CNIL framework counts the period from the last contact with the candidate, and the recruitment guide provides that the operation can be renewed. A new exchange can therefore serve as a new starting point, provided you date it in your tool and have defined in your record of processing activities what counts as a contact.
Article 12 of the GDPR requires a reply within one month of receiving the request. This period can be extended by two months, taking into account the complexity and number of requests, provided you inform the person of the extension and the reasons for it within the first month.
In that case the data was not collected from the person. Article 14 of the GDPR requires you to inform them within a reasonable period of no more than one month, and at the latest in your first message if you contact them, stating the source of their data. You also need a legal basis for this processing.
They are part of the stored file and in principle follow the same retention period. They must be limited to what helps assess the ability to hold a job or professional aptitudes (Article L1221-6 of the French Labour Code). Anything relating to private life or health should be removed.