Sector wise readiness
Recruitment and staffing: the CV you kept for three years
- How long can you keep a candidate's CV?
- Only while a live purpose supports it. The purpose that justified holding a CV ends the moment the hiring decision is made. Indefinite retention, and re sharing CVs with new employers without a fresh basis, is the typical failure here.
- Who this affects
- Job boards, staffing firms, ATS platforms and in house recruiters.
- What to do about it
- Set a retention period for candidate records, and obtain a fresh basis before circulating a CV again.
A misconception I keep seeing when job boards, staffing firms and ATS platforms read DPDP checklists: "candidate data is business as usual, we keep CVs on file."
That habit is the exposure. Indefinite retention of CVs, and re sharing them with new employers without a fresh basis, is the typical failure here, and the first thing an auditor looks for.
Think about what your database holds. Someone applied for one role three years ago and did not get it. The purpose that justified holding their CV ended the moment that decision was made. Yet the CV is still there, still searchable, still going to clients who never met them. That is not a filing habit. It is processing without a live purpose.
A sector map is a superset, not a launch checklist.
What applies from the start, whatever your size
- ✅ Notice
- ✅ Consent and easy withdrawal
- ✅ Security safeguards
- ✅ Rights handling
- ✅ Grievance mechanism
- ✅ Processor contracts
- ✅ Breach response
What recruitment carries from day one
- ✅ Candidate data retention. Erase stale profiles. Do not keep CVs indefinitely because they might be useful someday. "Might be useful" is not a purpose.
- ✅ Purpose limitation on sharing. Real control over what goes to which employer. Re sharing a CV with a new client needs a basis, not just a folder.
- ✅ Know which hat you wear. An ATS sold to employer clients is a Processor for them. A job board signing up its own users is a Data Fiduciary. Many platforms are both, in different parts of the same product, and the obligations differ.
- ✅ Under 18 candidates. Watch for minors in your pipeline and avoid prohibited profiling. This applies absolutely, at any size.
What may not apply yet
- ❌ SDF obligations. Large job platforms are worth assessing, but Significant Data Fiduciary status comes only on Government notification, not from candidate volume.
- ❌ A mandatory Data Protection Officer, annual DPIAs and independent audits. These attach to SDF status once notified.
The better question
The better question is not "are we allowed to keep candidate data?"
It is "for every CV in our database, what live purpose justifies it still being there?"
Law creates obligations. Scale and risk influence implementation. But retention discipline and the Processor versus Fiduciary line apply from your first candidate. Neither waits for scale.
How old is the oldest CV in your database, and what purpose still justifies it?