How long should recruiting firms keep candidate data?

What sets the candidate data retention period?#

The candidate data retention period is set by two forces pulling in opposite directions: legal minimums that require you to keep certain hiring records, and privacy rules that expect you to keep personal information no longer than needed. A sound policy finds the window between them for each record type.

Minimums come mainly from federal anti-discrimination recordkeeping rules, federal contractor rules, wage and hour law, background check rules and state employment laws. Upper limits come from privacy laws, your own privacy notices, client contracts and the practical risk old data creates in a breach or a dispute.

Staffing firms carry a double load. They hold applicant records like any employer, and for temporary workers on their own payroll they also hold employee records such as timesheets, payroll and onboarding documents.

Retention by record type#

Retention rules differ by record type, so a single ATS-wide rule is almost always wrong. The table shows where minimums may come from and what to confirm with counsel. It deliberately gives no periods, because the right period depends on your firm's size, contracts, client programs and the states where candidates live.

Federal minimums and state caveats#

Federal minimums for candidate data come from several overlapping rule sets. EEOC regulations require covered employers to keep applications and other hiring records for a minimum period, a staffing firm may be covered both as an employer and as an employment agency, and federal contractors and subcontractors may have longer obligations under OFCCP rules. Check the current text of each rule with counsel rather than relying on a summary, including this one.

Two further principles apply across the board. When a discrimination charge, lawsuit or government audit is pending, the records relevant to it generally must be kept until the matter is fully resolved, whatever the normal schedule says. And background check reports carry their own disposal requirements under the FCRA, which address how records are destroyed as well as when.

States add their own layer. Some set longer periods for employment records, some regulate recordings, biometrics or automated hiring tools, and state privacy laws such as the CCPA may give California applicants rights to know about and delete their data. Because staffing firms recruit across state lines, map where your candidates live, not only where your offices are.

Why keeping everything forever is also a risk#

Keeping every candidate record forever creates risk because old personal data still counts in a breach, still answers to access and deletion requests, and can be pulled into disputes long after it stopped being useful. Privacy laws such as the GDPR, for any candidates in the EU, and the CCPA expect a defined purpose and retention period for personal information.

Old records are also less accurate. A resume from many years ago describes a different person in a different market, and recruiters who rely on it waste time on stale contact details and outdated skills. Deleting on schedule is good hygiene as well as good compliance.

Writing a retention schedule your ATS can enforce#

A retention schedule works only if your ATS and back-office systems can apply it, so write it in terms the software understands: record type, trigger event and action. A policy that lives only in a handbook tends to be ignored until a request or a breach forces the issue.

• 1Classify records into the types in the table above, including those held outside the ATS.
• 2Set a trigger event for each type, such as application date, last candidate activity or end of placement.
• 3Agree each period with employment and privacy counsel and record the reason behind it.
• 4Configure automated purges or scheduled review lists in the ATS and the payroll system.
• 5Add a legal hold flag that stops deletion for records tied to a charge, lawsuit or audit.
• 6Cover copies outside the ATS: email, shared drives, VMS downloads and vendor backups.
• 7Log deletions so you can show the schedule was followed.

What happens to value when the retention period ends?#

When the retention period ends, personal candidate data should be deleted or de-identified, and that decision should never be bent to keep records for licensing. De-identification has to meet the standard of the laws that apply, which counsel should confirm; removing names alone is rarely enough when work history, employers and locations remain.

Some records keep value without any candidate identity. Job orders, the sequence of submission stages, the time between steps, client feedback categories and placement outcomes can describe how recruiting work flows without describing a person. Those workflow records can support internal benchmarks and, after rights and privacy review, may be licensed for AI development.

Illustrative: a deletion request arrives while a charge is pending#

Illustrative: a fictional staffing firm with clerical and light industrial desks receives a deletion request from a California applicant who was not placed. Its privacy lead finds the applicant's profile, resume, interview notes and a background check report in the ATS, plus copies in recruiter email and a client's VMS.

Counsel confirms that an EEOC charge filed by a different applicant for the same opening is still open, so records for every candidate on that requisition, including this applicant's application, interview notes and scorecards, sit under a legal hold. The firm deletes only what counsel confirms no hold or minimum covers, such as stray copies in recruiter email, explains in writing what it must keep and why, and sets the held records to return to the normal schedule once the matter is fully resolved.

The episode also exposes a gap: the ATS had no legal hold flag. The firm adds one, along with trigger-based deletion rules, so the next request can be answered from the system rather than by searching recruiters' inboxes.

How SourceX treats candidate records#

SourceX treats candidate personal data as material to remove or exclude, not as the asset being licensed. Any review starts from records inside the firm's retention schedule, and preparation removes names, contact details and other identifying details; resumes and background check material are typically left out altogether.

Rights and privacy questions are handled within the SourceX five-step transaction: Supply, Rights, Preparation, Approval and Delivery. The SourceX Evidence Packet records the privacy record and permitted use for each package, and the laws that may apply are assessed deal by deal with the firm's counsel.