May an employer keep rejected applicants' CVs for years?
NVP guideline: max 4 weeks without consent, max 1 year with explicit consent. Removal mandatory thereafter. Fine risk on longer retention.
Application data of rejected candidates = classic storage-limitation application (GDPR Art. 5(1)(e)). NVP Application Code guideline: 4 weeks without consent — for objection/complaints procedure. 1 year with explicit consent — for "in the valuable talent pool" future roles. Beyond = unlawful without special reason. What falls under "application data": CV, cover letter, references, interview notes, assessment results, desired salary, possibly video pitch. Common employer mistakes: (1) "We keep CVs for 3 years for possible future roles" without consent. (2) Recruitment software (Workable, Personio, BambooHR) keeps everything automatically — often unintentional multi-year retention. (3) Headhunter database with rejected candidates without consent. (4) LinkedIn-related profiles kept after application. For rejected applicant: GDPR Art. 17 erasure request works directly. Request confirmation within 30 days. On refusal: AP complaint — enforcement priority since 2023. Fines 2024-2025 for recruitment platforms and large employers: €30k-€200k. For employers: schedule automatic deletion in ATS (Applicant Tracking System) — privacy by design. For "talent pool": separate opt-in form at application. Not implicit.
Sources
🔎 Common search variants
Recognise your own search? Our answer above covers these too.
- “cv retention employer netherlands”
- “application cv years”
- “recruitment ats retention”