Application data after rejection: erasure, consent and talent-pool evidence

After a rejection, organisations must assign application data to a clear purpose, legal basis and reviewable erasure point. The GDPR does not set one uniform period for every application. The key factors are the end of the recruitment process, any specific legal duty or claim and a separate decision about inclusion in a talent pool.

This article explains how organisations can classify application data after a rejection, when further retention may be justified and what is required for consent to a talent pool. It focuses on purpose expiry, information, access and evidence of the actual erasure process.

Article 5(1)(e) GDPR requires storage limitation. Personal data should remain identifiable only for as long as necessary for the purposes of processing. The original selection purpose will generally end when the specific recruitment process is completed. That does not answer every question about a short further retention period or voluntary inclusion in a talent pool.

Organisations must describe purpose and legal basis separately. Application data may be processed for selection, a specific legal duty or the establishment, exercise or defence of legal claims. Each purpose requires its own assessment. A blanket internal practice of keeping every rejection for the same period does not provide that allocation.

The employee data protection section places recruitment in the lifecycle of employment data. The section on privacy governance and compliance provides a further framework for purposes and responsibility.

A rejection is an important review point, but it is not automatically the same erasure date in every case. The organisation should record when the selection decision ended, whether any communication remains open and which records are still needed for the original purpose. Every remaining record then needs its own reason for retention.

Articles 13 and 14 GDPR require information about the purposes of processing and, where possible, the planned storage period or the criteria used to determine it. Applicant information should therefore explain how the documents are used during recruitment and by which criteria further retention ends. A phrase such as “as long as necessary” is weak if the organisation has no internal criteria.

The erasure process must reflect the actual environment. In addition to a recruitment portal, email inboxes, interview notes, exports and service providers may be involved. Backups need a separate rule. They should not become a convenient permanent archive, and the technical deletion cycle and effective access restriction before deletion should be documented.

A talent pool has a different purpose from a completed application. Future vacancies, later contact and longer availability of the documents must therefore be described separately. An application should not silently become a permanent record for possible future recruitment.

If the talent pool relies on consent under Article 6(1)(a) GDPR, the organisation must be able to demonstrate that consent under Article 7. The statement should identify the defined purpose and explain which data are retained for which future contact. The data subject must be able to withdraw consent as easily as it was given.

Consent should be presented as a distinct step. It should not be hidden in a general statement covering the application, rejection and every possible later purpose. A refusal or withdrawal should not alter the completed selection process retroactively. Talent-pool data require their own erasure or restriction review.

Article 17 GDPR provides exceptions to the right to erasure. Continued retention may be necessary for compliance with a legal obligation or for the establishment, exercise or defence of legal claims. A general wish to be prepared for a possible dispute is not enough as a blanket reason.

The organisation should record the specific reason, the affected documents and the necessary scope. If the issue concerns one decision or communication, the full application does not automatically have to remain accessible indefinitely. Access should be limited to responsible persons and further use should be defined.

Once the retention ground ends, the exception must be reviewed. A note without a review date can leave application data in active systems for years. The record therefore needs an owner and a control point for the end of the exception.

Articles 5(2) and 24 GDPR require the controller to demonstrate compliance. The process should show who recorded the rejection, who decides on an exception, which systems are cleaned and how the result is checked. An erasure concept is reliable only when it fits the real workflow.

Articles 25 and 32 GDPR require data protection by design and appropriate security. Application data should therefore be accessible only to people responsible for the recruitment task. Talent-pool data, completed application files and documents with sensitive details should not be mixed in one open repository. Personal accounts, limited roles and access logs support control.

Article 30 GDPR may be relevant when describing the processing activity. The internal record should connect purpose, data categories, recipients, erasure criteria, systems and safeguards. The record itself also needs minimisation. It should prove the decision and erasure without creating a second complete application archive. The article on technical and organisational measures under Article 32 GDPR provides further guidance.

One period for every application: Every rejection is retained for the same period without assigning purpose, legal basis or review criteria.

Talent pool as a silent continuation: Application data remain active for future vacancies although there is no separate information and consent.

Consent without a withdrawal route: The statement is archived, but withdrawal reaches neither the recruitment portal nor connected storage.

Only the recruitment portal is erased: Emails, interview notes, exports or accessible copies remain elsewhere.

An exception has no end: A possible claim is recorded, but nobody checks whether continued retention is still necessary.

Start with a list of systems and data categories. Map the application form, CV, certificates, interview notes, emails, assessments and talent-pool entries separately. Assign purpose, legal basis, recipients, access group and erasure criterion to each record.

Then review the applicant information and actual consent journey. Is the talent pool voluntary? Is its scope clear? Can the person withdraw through an accessible channel? Does the withdrawal reach all relevant systems? These questions belong in the process before a dispute arises.

Finally record the rejection, erasure decision, exception, systems involved and result. The article on Article 15 GDPR access requests may help with questions about processing and storage periods. The specific application case still needs its own assessment.

We review the purpose after rejection, the legal basis, applicant information, talent-pool consent, access and the erasure process with you. Send us the recruitment workflow, information texts, system overview and an example of the record. New articles and legal guidance are available through BRANDaktuelle Rechtsnews. Subscribe to the newsletter.