The retention period for application documents regulates how long you may store candidates‘ documents. Under the GDPR, this period is generally six months after the conclusion of the application process. After that, you must delete all personal data unless consent for longer storage has been given. This regulation protects the rights of applicants and prevents unnecessary data storage. For your recruiting team, this means: establish and document clear deletion processes.
What does the retention period for application documents actually mean?
The retention period defines how long you may store application documents after the end of the application process. It covers all documents created during the recruiting process: CVs, cover letters, certificates, motivation letters, and notes from job interviews. Digital applications submitted via online forms or email are also included.
The legal basis is found primarily in the General Data Protection Regulation (GDPR) and the General Equal Treatment Act (AGG). The GDPR protects personal data and requires that you retain it only for as long as necessary for the original purpose. The AGG gives applicants the opportunity to assert discrimination claims within two months of receiving a rejection.
Why do these deadlines matter? They protect the privacy of applicants and minimize your legal risk. Storing documents longer than permitted constitutes a violation of data protection law — one that can be costly and damaging to your reputation as an employer.
For your applicant management process, this means you need clear rules about which documents are deleted and when. Without a systematic approach, you will quickly lose track — especially when handling large volumes of applications.
How long may application documents be retained under the GDPR?
Under the GDPR, you may retain application documents for a maximum of six months after the conclusion of the application process. This period applies to both successful and unsuccessful applications. The application process ends once the position has been filled and all other candidates have been notified of rejection.
For rejected applications, the period begins from the date of the rejection. If you send a rejection on March 15, the documents must be deleted by September 15 at the latest. For successful applications, the period begins upon signing of the employment contract, as the documents then become part of the personnel file and are subject to different retention obligations.
There are important exceptions: with the explicit consent of the applicant, you may store data for longer — for example, for a talent pool. This consent must be given voluntarily and must be revocable at any time. Importantly, consent must not be a condition for participating in the application process.
Practical examples from everyday recruiting:
- You fill a position in January and send rejections to all others in February — deletion required by August
- Applicants consent to being added to a talent pool — storage possible until consent is withdrawn
- You conduct multiple rounds of interviews — the period begins after the final round
Violations can result in substantial fines: up to €20 million or four percent of global annual turnover, whichever is higher. Data protection authorities impose these penalties for serious or repeated violations.
What happens if you retain application documents for too long?
The legal consequences of failing to comply with retention periods are significant. Applicants can file complaints with data protection authorities if they discover that their data has been stored beyond the permitted timeframe. The authorities will then review your processes and may impose fines.
The level of fines depends on the severity and duration of the violation. Systematic violations, or cases where your organization has previously been flagged, result in considerably higher penalties. Smaller companies are not exempt: while authorities do take company size into account, five-figure fines are also imposed on medium-sized businesses.
Beyond the direct financial costs, additional risks include:
- Reputational damage: Data protection violations become public and deter potential talent
- Administrative burden: Documentation, written responses, and internal audits consume significant resources
- Loss of trust: Applicants share negative experiences on employer review platforms
- Competitive disadvantage: Your employer branding suffers lasting harm
A typical scenario: a rejected candidate reapplies two years later and discovers that you still hold all their previous documents. They file a complaint with the data protection authority. The authority audits your entire recruiting process and finds hundreds of outdated applications. The fine is then calculated based on the total violation, not just the individual case.
The situation becomes especially problematic when you have no documentation. If you cannot demonstrate when applications were received and when they should have been deleted, authorities will assume the worst-case scenario.
How do you organize the deletion of application documents in a legally compliant way?
Legally compliant deletion requires a systematic approach and clear documentation. You must be able to demonstrate that data has been completely and promptly removed. This is only achievable through structured processes within your applicant management workflow.
Practical steps for systematic deletion:
- Create a deletion policy: Define which documents are deleted when, and who is responsible for doing so
- Document deadlines: Record the date of receipt and the planned deletion date for every application
- Set up reminders: Use calendars or automated systems to flag upcoming deletion deadlines
- Carry out deletion: Remove all data from every system and backup
- File documentation: Record what was deleted and when
The distinction between digital and physical documents is important. Delete digital applications from email inboxes, applicant tracking systems, network drives, and backups. Physical documents must be shredded to at least security level P-4 in accordance with DIN 66399.
Secure destruction methods include:
- Digital deletion with overwriting rather than simple deletion
- Professional document shredding for paper-based materials
- Deletion from cloud storage and synchronized devices
- Removal from email archives and backup systems
A modern applicant management system automates many of these steps. It reminds you of upcoming deletion deadlines, automatically documents deletion events, and ensures that no data is overlooked. This saves time and significantly reduces the risk of errors.
Checklist for legally compliant deletion:
- Identify all storage locations (email, systems, folders, cloud)
- Set and document deletion deadlines for each application
- Assign responsibilities clearly
- Schedule regular reviews of deletion processes
- Retain documentation for verification purposes
- Train your team and raise awareness
Professional tools such as an applicant manager help you implement these processes efficiently and in full legal compliance, ensuring that no important deadlines are missed.
When may you retain application documents for longer than 6 months?
There are legitimate reasons to store application documents for longer than six months. The most important is the explicit consent of the applicant for inclusion in a talent pool. This consent must be voluntary, obtained separately from the application process, and revocable at any time.
Here is how to obtain legally sound consent: after the application process has concluded, ask the individual whether they would like to be added to your talent pool. Clearly explain which data you will store, for how long, and for what purpose. Make it clear that consent is voluntary and that declining will have no negative consequences.
Additional exceptions involve statutory retention obligations: if an applicant announces or files a discrimination claim under the AGG, you may retain the relevant documents until the proceedings are concluded. The AGG gives applicants two months to lodge complaints, which is why the six-month period already accounts for this possibility.
The distinction between an active talent pool and passive retention is important:
- Active talent pool: You contact candidates when suitable positions arise, nurture the relationship, and provide genuine value
- Passive retention: You store data without consent or contact — this is not permitted
Practical tips for communicating about extended storage: be transparent about your intentions. Explain the mutual benefit — candidates learn about relevant opportunities, and you save time in your search. Provide concrete information about the storage duration and the right to withdraw consent.
An important note on talent pools: contact individuals regularly and give them the opportunity to update their profile or withdraw their consent. Anyone who has not heard from you in over a year is unlikely to feel valued and may begin to view the continued storage of their data as problematic.
In the event of legal disputes, document the necessity of the extended retention. Delete the data immediately once proceedings have concluded. This exception applies only to the directly affected documents, not to your entire pool of applications.
