How long should staffing firms keep candidate records?

Is there one retention period for all candidate records?#

No single retention period covers all candidate records; a staffing firm needs a schedule by record type. The minimum for each type comes from the law that requires it, the maximum comes from privacy law and the firm's own notices, and a legal hold suspends deletion whenever a claim is pending or reasonably expected.

Staffing firms carry more record types than a typical employer because they act as recruiter and, for temporary workers, as employer of record. A direct-hire candidate who was never placed and a temp who worked many assignments sit in the same ATS but carry very different obligations.

A written schedule also protects the firm. Records kept past their purpose add breach exposure and discovery cost without adding value, and a schedule applied consistently is easier to defend than ad hoc deletion after a dispute begins.

Retention by record type#

The table lists the main candidate record types with their drivers, limits and de-identification options. It names drivers rather than durations, except where a cited source gives one, because periods vary by state, client contract and firm size; counsel should fill in the periods for your firm.

Which laws set the minimum?#

The minimum comes from several overlapping rules. Federal anti-discrimination laws require employers, and in some cases employment agencies, to keep applicant and hiring records for a set period, and longer once a charge or lawsuit is filed. For temps on the firm's payroll, the IRS says employment tax records should be kept for at least four years after the date the tax becomes due or is paid, whichever is later.

State laws can add longer periods, and client contracts, especially managed service provider and vendor management system programs, often require the staffing firm to keep submission and timesheet records for audit. When drivers conflict, the longest applicable period usually governs that record type.

Which laws set the maximum?#

The maximum comes from privacy law and from what the firm told candidates. Since January 1, 2023, when the CCPA's employee and business-to-business exemptions lapsed, California applicants may have privacy rights over what staffing firms covered by the law hold about them, and the California Privacy Protection Agency opened preliminary rulemaking in April 2026 on how the law applies to employees, applicants and contractors.

Other comprehensive state privacy laws, such as Virginia's and Colorado's, generally do not reach data about people acting in an employment context. Candidates in other countries may bring laws such as GDPR, which expect data to be kept no longer than its purpose needs, and the firm's candidate privacy notice may promise its own period.

The practical result is a ceiling for unplaced candidates. Keeping a sourced profile forever because the person might fit a future job is hard to defend under these rules and under most notices.

Building the schedule into your ATS#

A retention schedule only works if the ATS enforces it. Many applicant tracking systems support retention rules; Greenhouse, for example, lets site admins set rules per office, separately for rejected and hired candidates, after which flagged personal data is deleted manually or in bulk. Check what your own system supports before designing around it.

Test each rule on a single office or a copy of the data first, because ATS deletions are usually permanent.

• 1Classify each candidate by status: never submitted, submitted, placed, or employed as a temp.
• 2Pick a trigger date for each class, such as last meaningful activity or assignment end date.
• 3Define meaningful activity so that automated emails and enrichment do not restart the clock.
• 4Override deletion for legal holds and open client audits.
• 5Log each deletion run with the rule applied, the record count and the approver.
• 6Copy stage and outcome fields into a de-identified table before deleting person-level records, if the firm wants to keep analytics.

Illustrative: a finance staffing firm sets its first schedule#

Illustrative: a fictional finance and accounting staffing firm has run the same ATS for many years and never deleted a candidate. Its general counsel finds that most profiles have had no real activity in years, yet recruiters still include them in mass email campaigns.

Counsel defines record classes and trigger dates, adds a legal hold flag, and works with the ATS administrator so campaign emails no longer reset the activity date. Before the first deletion run, the firm copies job order, submission stage and outcome fields into a de-identified reporting table.

The first run removes long-inactive unplaced profiles, while payroll and I-9 records stay in the back office under their own periods. Recruiters lose nothing they were using, and the privacy notice now matches practice.

How SourceX handles candidate records#

SourceX handles candidate records with one fixed rule: candidate identities are never part of a license. In the SourceX five-step transaction, the Rights step checks notices and client contracts, and the Preparation step removes names, contact details, identifiers and identifying free text before the supplier approves anything.

What can qualify are de-identified work records, such as job orders, stage histories and outcomes, which a well-run retention program tends to preserve anyway. A SourceX Evidence Packet records the privacy record and release authorization for each package.