A practical playbook for recruiting-ops and TA leaders on how long to keep applicant records, how to honor deletion requests, and how to log consent under GDPR and CCPA.
One platform for consent, retention, and deletion. No setup fees, no long-term contracts.
Every applicant who hits submit hands you personal data: a name, a phone number, a resume, screening answers, and a trail of messages. Under GDPR and CCPA, that data comes with obligations you cannot ignore once your pipeline runs at volume. The teams that stay clean are the ones that decide three things up front, then let the system enforce them.
Retention: how long you keep each kind of record before it is deleted. Deletion: how fast you can honor a candidate who asks to be forgotten. Consent: how you prove the people you message agreed to hear from you. Get those three right and candidate data privacy stops being a legal fire drill. This guide walks each one, and shows how ATS Mako handles it when all your recruiting lives in one place instead of nine disconnected tools.
High-volume pipelines collect resumes, phone numbers, screening answers, interview notes, SMS threads, and call recordings across thousands of applicants a month. Every one of those records is personal data under GDPR and CCPA. The bigger your funnel, the bigger your retention and deletion obligation, and the more a scattered toolset turns that obligation into risk.
Applicants know their rights. A rejected candidate can send a deletion request, and under GDPR you generally have one month to respond. If your records live in a spreadsheet, an old SMS tool, an inbox, and a legacy ATS, honoring that one request means hunting across nine systems that do not talk to each other.
Messaging candidates by SMS or email means you need lawful prior consent and the ability to prove it. A checkbox at apply time is only useful if you logged who agreed, to what, and when. Regulators and candidates both expect that audit trail, and it has to survive long after the recruiter who ran the campaign has moved on.
Keeping candidate records forever is not caution, it is exposure. The safer position is a defined retention window, a clean deletion process, and documented consent. Get those three right and privacy stops being a legal fire drill and becomes a background process that runs on its own.
Nail these three and the rest of candidate data privacy falls into place.
Set a retention window per record type, tie the clock to a clear event like the application date or the hiring decision, and delete on schedule instead of hoarding data by default. A defined window is your single best defense in any privacy audit.
When a candidate asks to be deleted, you need to find every record tied to them, remove it, and confirm it is gone, within the legal window. One platform instead of nine is the difference between a five-minute task and a cross-system scavenger hunt.
Capture opt-in at the source, record the timestamp and the scope, honor opt-out on every message, and keep that trail intact. Consent you can prove is consent that protects you.
These are directional bands, not legal mandates. Set your actual windows with your own counsel, then let the platform enforce the clock.
Candidates who applied and were not advanced carry the least business value and the most privacy cost. A common practice is to keep these records for a defined, limited period tied to anti-discrimination record-keeping, then delete, unless the candidate opted in to a talent pool.
These records support defensible hiring decisions and future outreach. Many teams keep them for a bounded window that covers claim windows, then either delete or move the candidate into a consented silver-medalist pool for re-engagement.
If a candidate agreed to ongoing contact, you can retain their record while that consent stands. Retention is tied to consent, not a fixed timer, so a withdrawal of consent ends it. Review these pools periodically and re-confirm interest.
Once a candidate becomes an employee, their record shifts under employment and tax record-keeping rules, which run far longer. Separate the recruiting record from the employment record so each follows the right clock.
The proof that someone opted in, or out, is evidence. Keep consent records and suppression lists longer than the underlying candidate data so you can always show you had permission and that you honored a withdrawal.
When a candidate asks to be deleted, speed and completeness both matter. Here is the loop that keeps it clean.
A deletion request has to come from the candidate, not an imposter. Confirm identity against the record on file before you touch anything. Logging the request and the verification step is part of proving you handled it correctly.
This is where a consolidated platform earns its keep. When a candidate record carries their SMS thread, email history, screening answers, interview notes, and call results in one profile, finding everything tied to a person is a search, not a nine-system hunt. Global search surfaces the full footprint fast.
Remove the personal data while preserving the minimal record that proves you honored the request and that the person opted out. A suppression entry keeps them off future campaigns without keeping the data they asked you to erase.
Respond to the candidate to confirm deletion, and do it within the window the law gives you, generally one month under GDPR. Role-based access and an activity feed mean the action is logged, attributed, and defensible.
Consent is only useful if you can prove it. Here is how ATS Mako keeps the record intact from first touch to offer letter.
Ask candidates to opt in to SMS and email on your branded Apply Here page at the point of application. Consent captured at capture, on your own domain, is clean, scoped, and recorded, so your first message is welcome and lawful.
Every automated message carries a clear opt-out, and the platform handles unsubscribe and STOP automatically. A candidate who opts out is suppressed across future campaigns without a recruiter remembering to do it.
A timestamped activity feed records who was messaged, when, and how they responded. Open, click, reply, and delivery signals live on the candidate record, so the proof of consent and contact survives staff turnover.
Templates let you lock legal, privacy, and equal-opportunity sections so a recruiter in a hurry cannot strip a disclosure. Update once, deploy everywhere, and the compliant language rides on every send.
Audience segmentation lets you build outreach from consented pools only. Re-engage silver medalists and warm past applicants who agreed to contact, and leave the rest out of the campaign by design.
Role-based access control limits candidate data to the people who need it. Local teams see their pipeline, headquarters sees the group, and every action is attributable, which is exactly what a privacy review wants to see.
Candidate data privacy breaks down when records live across a texting tool, an inbox, a spreadsheet, a scheduler, and a legacy ATS. A deletion request turns into a cross-system hunt, and consent proof scatters. ATS Mako replaces roughly nine disconnected recruiting tools with one white-label platform, so finding a record, deleting it, and proving consent all happen in one place with one activity feed.
Educational, not legal advice. This guide explains common practices for candidate data privacy, retention, and consent in recruiting. It is not legal advice, and privacy obligations vary by jurisdiction and change over time. Confirm your retention windows, deletion process, and consent language with your own legal counsel before you put them into production.
There is no single universal number. The practical approach is to set a retention window per record type, tie the clock to a clear event like the application date or the hiring decision, and delete on schedule. Rejected applicants are usually kept for a short, defined period that covers anti-discrimination record-keeping, interviewed candidates for a medium window, and consented talent-pool candidates only while their consent stands. Treat this as a policy decision to confirm with your own legal counsel, not a fixed rule.
Verify the request came from the candidate, find every record tied to them, delete the personal data while keeping a minimal suppression record that proves you honored the request, then confirm back to the candidate inside the legal window, which is generally one month under GDPR. A consolidated platform makes step two fast because the candidate record carries their messages, notes, and history in one profile instead of scattered across separate tools.
Yes. Both treat applicant information as personal data. GDPR applies when you process data of people in the EU and UK, and gives candidates rights to access and deletion. CCPA and its CPRA update give California residents similar rights, including deletion and the right to know what you hold. If you hire across borders or in California, your recruiting records fall in scope, so build retention, deletion, and consent into your workflow rather than bolting them on later.
Capture opt-in at the point of application on your branded apply page, record the timestamp and what the candidate agreed to, and keep that log. Honor a clear opt-out on every message and keep a suppression list. In ATS Mako, consent is captured at the source, opt-out and unsubscribe are handled automatically, and a timestamped activity feed preserves the audit trail, so you can show who agreed, to what, and when.
Generally yes. The proof that someone opted in or opted out is evidence that protects you, so it is common practice to retain consent and suppression records longer than the underlying candidate profile. Deleting a candidate record should still leave a minimal entry that shows you had permission and that you honored any withdrawal, so you do not accidentally re-contact someone who opted out.
It helps a lot. Candidate data privacy breaks down when records live across nine disconnected tools, because deletion and consent become a cross-system scavenger hunt. Consolidating SMS, email, scheduling, notes, and tracking into one white-label platform means one place to find a record, one place to delete it, one audit trail, and one consent log, which turns privacy from a fire drill into a background process.
See how ATS Mako captures consent at the source, keeps every record in one profile, and makes deletion a search instead of a scavenger hunt. Designed for speed. Built for scale.
Free support and guided onboarding included. No hidden fees.
